Medium, CVSS 4.0
tuf has platform-dependent delegation path matching
PyPI tuf · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-123806 · GHSA-qp9x-wp8f-qgjj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 46 matching · newest first
- High, CVSS 7.7
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.4 or later · <= 1.19.3 · CVE-2026-47179 · GHSA-c3px-h233-h6fq
- High, CVSS 7.7
Dulwich Vulnerable to Command Injection via Merge Driver Path
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.24.0, < 1.2.5 · CVE-2026-42563 · GHSA-9277-mp7x-85jf · amended
- High, CVSS 8.8
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.10.0, < 1.2.5 · CVE-2026-42305 · GHSA-897w-fcg9-f6xj · amended
- Medium, CVSS 6.0
OpenStack Keystone has an Incorrect Authorization issue
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-43000 · GHSA-q623-f4j4-p4xj · amended
- Medium, CVSS 6.0
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-42998 · GHSA-8f8m-wrvr-wcvf · amended
- Medium, CVSS 6.0
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-44394 · GHSA-whqr-fgm5-x77q · amended
- Medium, CVSS 6.0
OpenStack Keystone has an Authorization Bypass
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-42999 · GHSA-2r23-2g6v-2m5f · amended
- High, CVSS 7.0
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; <= 11.5.16; >= 2026.1.0, < 2026.1.3 · CVE-2026-5394 · GHSA-r2f4-ff2p-xc64
- Medium, CVSS 5.5
FUXA provides guest and invalid-token access to protected read APIs in secure mode
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0-2773, <= 1.3.0-2773 · CVE-2026-47718 · GHSA-r9g5-7q8j-958c · amended
- Medium, CVSS 5.5
Shamefile has an arbitrary file read via shamefile.yaml in shame next
PyPI shamefile +2 · Upgrade all 3 to 0.1.7 or later · <= 0.1.6 · CVE-2026-47144 · GHSA-x6p3-76f2-xxvh · amended
- Medium, CVSS 6.1
nono: Sandbox escape on Linux via D-Bus:
systemd-run --usercrates.io nono-cli · Upgrade to 0.55.0 or later · < 0.55.0 · CVE-2026-47128 · GHSA-27vp-2mmc-vmh3
- Low, CVSS 2.7
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Packagist symfony/polyfill-intl-idn +1 · Upgrade all 2 to 1.38.1 or later · >= 1.17.1, < 1.38.1 · CVE-2026-46644 · GHSA-2xf4-cg6j-vhgq
- Medium, CVSS 5.0
local-deep-research has an SSRF bypass in
safe_getPyPI local-deep-research · Upgrade to 1.6.10 or later · < 1.6.10 · CVE-2026-46526 · GHSA-g23j-2vwm-5c25 · amended
- High, CVSS 7.8
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · <= 3.12.1; >= 4.0.0, < 4.0.3 · CVE-2026-46439 · GHSA-gg2g-p7xc-qqmm · amended
- Medium, CVSS 5.3
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-46405 · GHSA-7j6w-vvw2-5f9c
- Medium, CVSS 6.0
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calico · Upgrade to 3.31.6 or 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f (pre-release) by release line · >= 2.0.0, < 3.31.6; < 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f · CVE-2026-41184 · GHSA-9p7w-w5q6-mxj3
- High, CVSS 7.2
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calicoctl/v3 · Upgrade to 3.31.6 or later · < 3.31.6 · CVE-2026-6720 · GHSA-3m4q-ggcj-j6m4
- Critical, CVSS 9.8
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
Go github.com/casdoor/casdoor · Upgrade to 2.387.0 or later · < 2.387.0 · CVE-2026-9094 · GHSA-c9w5-qp6m-m395
- Medium, CVSS 6.0
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calico · Upgrade to 3.31.6 or 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f (pre-release) by release line · >= 2.0.0, < 3.31.6; < 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f · CVE-2026-41185 · GHSA-m67g-87rx-v42c
- Medium, CVSS 6.7
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, < 4.0.3; < 3.12.2 · CVE-2026-46380 · GHSA-w76h-q7c6-jpjp · amended
- High, CVSS 7.2
OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd
PyPI pycti · Upgrade to 6.9.7 or later · < 6.9.7 · CVE-2026-44730 · GHSA-q537-qhj4-wcjx · amended
- Medium, CVSS 5.4
OpenBao's Inline Auth Incorrectly Redacted Headers
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-46358 · GHSA-q8cj-789h-vg24
- High, CVSS 8.4
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, < 4.0.3; <= 3.12.1 · CVE-2026-46345 · GHSA-4q5v-7g7x-j79w · amended
- High, CVSS 7.1
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-45808 · GHSA-v8v8-cm84-m686
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.