High, CVSS 7.7
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.4 or later · <= 1.19.3 · CVE-2026-47179 · GHSA-c3px-h233-h6fq
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.7
Dulwich Vulnerable to Command Injection via Merge Driver Path
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.24.0, < 1.2.5 · CVE-2026-42563 · GHSA-9277-mp7x-85jf · amended
- High, CVSS 8.8
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.10.0, < 1.2.5 · CVE-2026-42305 · GHSA-897w-fcg9-f6xj · amended
- High, CVSS 7.0
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; <= 11.5.16; >= 2026.1.0, < 2026.1.3 · CVE-2026-5394 · GHSA-r2f4-ff2p-xc64
- High, CVSS 7.8
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · <= 3.12.1; >= 4.0.0, < 4.0.3 · CVE-2026-46439 · GHSA-gg2g-p7xc-qqmm · amended
- High, CVSS 7.2
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calicoctl/v3 · Upgrade to 3.31.6 or later · < 3.31.6 · CVE-2026-6720 · GHSA-3m4q-ggcj-j6m4
- Critical, CVSS 9.8
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
Go github.com/casdoor/casdoor · Upgrade to 2.387.0 or later · < 2.387.0 · CVE-2026-9094 · GHSA-c9w5-qp6m-m395
- High, CVSS 7.2
OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd
PyPI pycti · Upgrade to 6.9.7 or later · < 6.9.7 · CVE-2026-44730 · GHSA-q537-qhj4-wcjx · amended
- High, CVSS 8.4
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, < 4.0.3; <= 3.12.1 · CVE-2026-46345 · GHSA-4q5v-7g7x-j79w · amended
- High, CVSS 7.1
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-45808 · GHSA-v8v8-cm84-m686
- High, CVSS 8.5
Apache Ignite REST API Has a Relative Path Traversal Vulnerability
Maven org.apache.ignite:ignite-core · Upgrade to 2.18.0 or later · >= 2.0.0, < 2.18.0 · CVE-2025-48977 · GHSA-v45h-mqf4-6939
- Critical, CVSS 9.4
MCP Toolbox for Databases vulnerable to DNS rebinding attacks
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2026-9739 · GHSA-7pf3-8xx7-rvhf
A vendor fix does not resolve your finding until you verify it in your own systems.