High, CVSS 8.7
Twig: Possible sandbox bypass when using a source policy
Packagist twig/twig · Upgrade to 3.26.0; some affected versions have no fix yet · >= 2.16.0, <= 2.16.1; >= 3.9.0, < 3.26.0 · CVE-2026-24425 · GHSA-2q52-x2ff-qgfr
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.9
Shopper: Authorization bypass and RBAC privilege escalation in team settings
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47744 · GHSA-c3qp-2ggw-xjg7
- High, CVSS 8.7
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47743 · GHSA-hr9v-r8r2-hg7j
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin
data-mce-objectinjectionNuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · <= 5.10.9; >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1 · CVE-2026-47761 · GHSA-vg35-5wq7-3x7w
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability through
mce:protectedcommentsNuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1; <= 5.10.9 · CVE-2026-47762 · GHSA-v98h-vmpc-fpqv · amended
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
NuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1; <= 5.10.9 · CVE-2026-47759 · GHSA-q742-qvgc-gc2f · amended
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
NuGet tinymce +2 · Upgrade all 3 to 7.1.0 or later · >= 6.8.0, < 7.1.0 · CVE-2026-47760 · GHSA-mh5m-5hw4-5c69 · amended
- High, CVSS 7.1
skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion
crates.io skillctl · Upgrade to 0.1.2 or later · < 0.1.2 · GHSA-wx3m-whqv-xv47
- Critical, CVSS 9.1
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
PyPI ait-core · Upgrade to 3.1.1 or 2.6.1 by release line · >= 3.1.0, <= 3.1.0; < 2.6.1 · CVE-2026-47731 · GHSA-p462-prxw-mjx4 · amended
- High, CVSS 7.5
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52878 · GHSA-rm5c-5x2p-48wr
- High, CVSS 7.5
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52880 · GHSA-w4c6-7r69-w7j9
- High, CVSS 7.5
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52879 · GHSA-hf2g-6j7h-98wg
- High, CVSS 8.8
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
npm dbgate-api · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-48017 · GHSA-hv83-ggc4-v385 · amended
- High, CVSS 7.7
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
npm @sync-in/server · Upgrade to 2.3.0 or later · <= 2.2.1 · CVE-2026-47684 · GHSA-q4x5-8cj6-52wg · amended
- Critical, CVSS 9.4
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
npm dbgate-api · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47670 · GHSA-wm5r-5qp3-5vxf · amended
- High, CVSS 8.3
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47419 · GHSA-7p8g-6c6g-h9w7 · amended
- Critical, CVSS 9.3
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
npm dbgate · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47669 · GHSA-h535-j5hr-mv56 · amended
- Critical, CVSS 10.0
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
npm dbgate-serve · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47668 · GHSA-8v3q-9vmx-36vc · amended
- High, CVSS 7.5
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses
FilePerms::WRITEhost restrictioncrates.io wasmtime-wasi · Upgrade to 44.0.2, 36.0.10 or 24.0.9 by release line · >= 37.0.0, < 44.0.2; >= 25.0.0, < 36.0.10; < 24.0.9 · CVE-2026-47261 · GHSA-2r75-cxrj-cmph
- High, CVSS 7.5
Klever-Go KVM: Hash-array amplification in P2P resolver request handling
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · < 1.7.18 · CVE-2026-47249 · GHSA-w342-mj6g-v9c4
- High, CVSS 7.6
Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
Go github.com/siderolabs/omni · Upgrade to 1.7.3 or 1.6.6 by release line · >= 1.3.0, < 1.6.6; >= 1.7.0, < 1.7.3 · CVE-2026-45726 · GHSA-wv8c-6mx2-xf4j
- High, CVSS 7.0
Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token
Go github.com/siderolabs/omni · Upgrade to 1.7.3 or 1.6.6 by release line · < 1.6.6; >= 1.7.0, < 1.7.3 · CVE-2026-45720 · GHSA-5x9f-6vg5-qg4m
- High, CVSS 7.8
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
PyPI ansible-core · Upgrade to 2.21.1rc1 (pre-release), 2.20.7rc1 (pre-release), 2.19.11rc1 (pre-release) or 2 more by release line · < 2.16.19rc1; >= 2.17.0b1, < 2.18.18rc1; >= 2.19.0b1, < 2.19.11rc1; >= 2.20.0b1, < 2.20.7rc1; >= 2.21.0b1, < 2.21.1rc1 · CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.