Medium, CVSS 4.6
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
Go github.com/crowdsecurity/crowdsec · Upgrade to 1.7.8 or later · >= 1.7.0, < 1.7.8 · CVE-2026-44981 · GHSA-273h-gvwr-c3qj
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 67 matching · newest first
- High, CVSS 7.4
Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
crates.io deno · Upgrade to 2.7.8 or later · >= 2.0.0, < 2.7.8 · CVE-2026-44726 · GHSA-chqv-56wv-7564
- Critical, CVSS 9.8
Langroid has Prompt to SQL Injection, Leading to RCE
PyPI langroid · Upgrade to 0.63.0 or later · < 0.63.0 · CVE-2026-25879 · GHSA-mxfr-6hcw-j9rq · amended
- Critical, CVSS 10.0
LiquidJS is Vulnerable to Remote Code Execution
npm liquidjs · Upgrade to 10.26.0 or later · < 10.26.0 · CVE-2026-45618 · GHSA-gf2q-c269-pqgc · amended
- High, CVSS 7.5
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in
strip_htmlFilter Regexnpm liquidjs · Upgrade to 10.26.0 or later · < 10.26.0 · CVE-2026-45617 · GHSA-r7g9-xpmj-5fcq · amended
- High, CVSS 8.4
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-45368 · GHSA-qvjf-922g-pj44
- High, CVSS 7.5
LiquidJS has a memory and render limit bypass via unbounded width padding in
datefilter (strftime)npm liquidjs · Upgrade to 10.26.0 or later · < 10.26.0 · CVE-2026-45357 · GHSA-hh27-hf48-9f5q · amended
- Medium, CVSS 5.3
Kirby CMS's content locks disclose IDs and emails of inaccessible users from
users.access/listpermissionsPackagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-45334 · GHSA-39vq-49qm-r2mc
- High, CVSS 8.1
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; >= 2026.1.0, < 2026.1.3; <= 11.5.16 · CVE-2026-45260 · GHSA-wc7j-g8wx-m2qx
- High, CVSS 8.0
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; <= 11.5.16; >= 2026.1.0, < 2026.1.3 · CVE-2026-45162 · GHSA-36fc-7wjg-mfvj
- Unrated
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line · < 5.4.52; >= 6.0.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45065 · GHSA-72xp-p242-47p9
- High, CVSS 8.7
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line · < 5.4.52; >= 6.0.0-BETA1, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 · CVE-2026-45063 · GHSA-ph86-p8f6-f9r2
- Low, CVSS 3.8
pretix vulnerable to Authorization Bypass Through User-Controlled Key
PyPI pretix · Upgrade to 2026.4.2 or later · < 2026.4.2 · CVE-2026-9712 · GHSA-72p9-6vv6-gvqh · amended
- Medium, CVSS 4.3
Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability
Maven org.jenkins-ci.plugins:jenkins-multijob-plugin · Upgrade to 669.v9d96a (pre-release) or later · < 669.v9d96a · CVE-2026-9674 · GHSA-hj3h-r49w-34wh
- Medium, CVSS 4.3
Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint
Maven org.jenkins-ci.plugins:job-import-plugin · Upgrade to 143.145.v48f9a (pre-release) or later · < 143.145.v48f9a · CVE-2026-48926 · GHSA-p8jh-4p5p-2rfp
- Medium, CVSS 4.3
Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation
Maven com.rapid7:jenkinsci-appspider-plugin · Upgrade to 1.0.18 or later · <= 1.0.17 · CVE-2026-48923 · GHSA-9wm7-8qf3-9v98
- Medium, CVSS 4.3
Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login
Maven org.jenkins-ci.plugins:bitbucket-oauth · Upgrade to 0.18 or later · <= 0.17 · CVE-2026-48924 · GHSA-r8fj-rff6-f7h5
- Medium, CVSS 4.3
Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability
Maven org.jenkins-ci.plugins:github-integration-parent · Upgrade to 0.7.4 or later · <= 0.7.3 · CVE-2026-48925 · GHSA-rf8w-7c3g-7h3g
- High, CVSS 7.5
Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials
Maven org.jenkins-ci.plugins:credentials-binding · Upgrade to 725.ve52b (pre-release) or later · <= 720.v3f6decef43ea · CVE-2026-48922 · GHSA-fxxf-w25w-mcx2
- Medium, CVSS 6.6
Jenkins Active Directory Plugin follows LDAP referrals by default
Maven org.jenkins-ci.plugins:active-directory · Upgrade to 2.41.1 or later · < 2.41.1 · CVE-2026-48918 · GHSA-wrhr-54p6-q97f
- Medium, CVSS 6.6
Jenkins LDAP Plugin follows LDAP referrals
Maven org.jenkins-ci.plugins:ldap · Upgrade to 807.809.vd3a (pre-release) or later · <= 807.v7d7de30930cf · CVE-2026-48916 · GHSA-fmjp-mw89-c6h6
- Medium, CVSS 6.6
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
Maven org.jenkins-ci.plugins:active-directory · Upgrade to 2.41.1 or later · < 2.41.1 · CVE-2026-48919 · GHSA-p2gw-f3rv-82mw
- High, CVSS 7.5
Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries
Maven io.jenkins.plugins:pipeline-groovy-lib · Upgrade to 798.v5cc688825312 or later · < 798.v5cc688825312 · CVE-2026-48921 · GHSA-qjq3-wqj5-g37q
- High, CVSS 7.6
Gradio contains a cookie injection vulnerability
PyPI gradio · Upgrade to 6.15.0 or later · < 6.15.0 · CVE-2026-48545 · GHSA-7hp7-4p35-3cx2 · amended
- High, CVSS 8.8
Jenkins Email Extension Plugin: Attackers able to control email content may specify
file:URLs for images to read arbitrary files from Jenkins controller filesystemMaven org.jenkins-ci.plugins:email-ext · Upgrade to 1933.1935.v276319e3cc47 or later · < 1933.1935.v276319e3cc47 · CVE-2026-48920 · GHSA-mq58-m26g-46gp
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.