Critical, CVSS 9.2
stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback
PyPI stigmem-node · Upgrade to 0.9.0a2 (pre-release) or later · < 0.9.0a2 · CVE-2026-76243 · GHSA-fp6w-8wpg-74g5 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 87 matching · newest first
- Medium, CVSS 6.5
Admidio: Any logged-in user can delete inventory fields via
mode=field_delete— incomplete fix of #2024Packagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47233 · GHSA-xw54-c3mx-9pm3
- Medium, CVSS 4.4
Admidio writes session IDs and auto-login cookie values to application logs
Packagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47234 · GHSA-mch8-wf3h-6x88
- Medium, CVSS 4.3
Admidio PKCS#12 private key export action lacks CSRF protection
Packagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47232 · GHSA-4rgq-38mh-9xqg
- High, CVSS 8.1
Admidio has IDOR in
documents-files.phpmode=move_savethat lets any folder-uploader exfiltrate files from private foldersPackagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47231 · GHSA-x628-457g-2pw9
- Medium, CVSS 6.5
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
Packagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47230 · GHSA-q6w3-hpfv-rg36
- Medium, CVSS 5.4
Admidio: CSRF in SSO client
enableaction toggles SAML/OIDC clients without token validationPackagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47229 · GHSA-xg76-5qj2-2hhv
- Medium, CVSS 5.2
Admidio's CSRF in registration
send_loginmode resets arbitrary user passwordsPackagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47228 · GHSA-mx25-j3rc-6w2w
- Medium, CVSS 6.5
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in
modules/categories.phpPackagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47227 · GHSA-rwjr-qjj3-mq2f
- Medium, CVSS 6.5
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
Packagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47226 · GHSA-qc4c-hrmc-4f78
- Medium, CVSS 4.6
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12 or 6.4.40 by release line · >= 6.4.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-47212 · GHSA-55rj-x2vc-4whq
- High, CVSS 8.7
Spatie Laravel Media Library contains a file upload restriction bypass
Packagist spatie/laravel-medialibrary · Upgrade to 11.23.0 or later · < 11.23.0 · CVE-2026-48557 · GHSA-3ggm-c5m7-hfv5
- Medium, CVSS 5.3
Spatie Laravel Media Library contains a server-side request forgery vulnerability
Packagist spatie/laravel-medialibrary · Upgrade to 11.23.0 or later · < 11.23.0 · CVE-2026-48555 · GHSA-fggg-964j-3j7h
- High, CVSS 8.6
ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env
PyPI ouroboros-ai · Upgrade to 0.39.0 or later · < 0.39.0 · CVE-2026-47211 · GHSA-c4m7-2gwp-vw76 · amended
- Low, CVSS 2.9
Authelia Missing Username Canonicalization in Basic Auth (LDAP)
Go github.com/authelia/authelia/v4 · Upgrade to 4.39.20 or later · >= 4.38.0, <= 4.39.19 · CVE-2026-47203 · GHSA-hjj4-hfjm-fmrj
- High, CVSS 7.1
CC-Tweaked has an SSRF Protection Bypass with NAT64
Maven cc.tweaked:cc-tweaked-1.20.5-core +7 · Upgrade all 8 to 1.119.0 or later · < 1.119.0 · CVE-2026-47695 · GHSA-5jh9-2h63-pw4q
- Medium, CVSS 6.5
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
PyPI zeroconf · Upgrade to 0.149.7 or later · < 0.149.7 · CVE-2026-47184 · GHSA-rfg2-pjw2-56x2 · amended
- Medium, CVSS 6.5
zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
PyPI zeroconf · Upgrade to 0.149.6 or later · < 0.149.6 · CVE-2026-47183 · GHSA-phvx-9mgw-67r5 · amended
- Medium, CVSS 6.5
zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service
PyPI zeroconf · Upgrade to 0.149.5 or later · < 0.149.5 · CVE-2026-47180 · GHSA-9pgc-3ccv-5297 · amended
- Medium, CVSS 5.3
Nerdbank.MessagePack has Inefficient CPU Computation
NuGet nerdbank.messagepack · Upgrade to 1.2.4 or later · < 1.2.4 · GHSA-92vj-hp7m-gwcj
- High, CVSS 7.7
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Packagist phanan/koel · Upgrade to 9.3.5 or later · <= 9.3.4 · CVE-2026-47260 · GHSA-7j2f-6h2r-6cqc
- Medium, CVSS 5.3
Nerdbank.MessagePack has a memory amplification DoS in collection deserialization
NuGet nerdbank.messagepack · Upgrade to 1.1.78 or later · < 1.1.78 · GHSA-qjvr-435c-5fjh
- Medium, CVSS 6.5
go-git: Malformed Git object data may cause panics or resource exhaustion
Go github.com/go-git/go-git/v6 · Upgrade to 6.0.0-alpha.4 (pre-release) or later · <= 6.0.0-alpha.3 · +1 more package · GHSA-w5pp-99ch-qj29
- Medium, CVSS 5.3
russh server userauth state is not reset when authentication principal changes
crates.io russh · Upgrade to 0.61.0 or later · >= 0.34.0-beta.1, < 0.61.0 · CVE-2026-46705 · GHSA-hpv4-5h6f-wqr3
- High, CVSS 7.5
russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets
crates.io russh · Upgrade to 0.61.1 or later · >= 0.34.0, < 0.61.1 · CVE-2026-46702 · GHSA-wwx6-x28x-8259 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.