Medium, CVSS 5.3
Source controller: Improper path handling allows traversal
Go github.com/fluxcd/source-controller · Upgrade to 1.8.5 or later · >= 0.0.17, <= 1.8.4 · CVE-2026-47680 · GHSA-jjrm-hr5f-673x
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–42 of 42 matching · newest first
- Critical, CVSS 9.4
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
npm dbgate-api · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47670 · GHSA-wm5r-5qp3-5vxf · amended
- High, CVSS 8.3
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47419 · GHSA-7p8g-6c6g-h9w7 · amended
- Critical, CVSS 9.3
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
npm dbgate · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47669 · GHSA-h535-j5hr-mv56 · amended
- Critical, CVSS 10.0
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
npm dbgate-serve · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47668 · GHSA-8v3q-9vmx-36vc · amended
- High, CVSS 7.5
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses
FilePerms::WRITEhost restrictioncrates.io wasmtime-wasi · Upgrade to 44.0.2, 36.0.10 or 24.0.9 by release line · >= 37.0.0, < 44.0.2; >= 25.0.0, < 36.0.10; < 24.0.9 · CVE-2026-47261 · GHSA-2r75-cxrj-cmph
- Medium, CVSS 6.1
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
npm mcp-server-kubernetes · Upgrade to 3.7.0 or later · <= 3.6.2 · CVE-2026-47250 · GHSA-6mx4-4h42-r8vh · amended
- Low, CVSS 2.0
claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision
npm claude-mem · Upgrade to 12.0.0 or later · < 12.0.0 · CVE-2026-11330 · GHSA-5gvr-v6qv-h5mm · amended
- High, CVSS 7.5
Klever-Go KVM: Hash-array amplification in P2P resolver request handling
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · < 1.7.18 · CVE-2026-47249 · GHSA-w342-mj6g-v9c4
- High, CVSS 7.6
Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
Go github.com/siderolabs/omni · Upgrade to 1.7.3 or 1.6.6 by release line · >= 1.3.0, < 1.6.6; >= 1.7.0, < 1.7.3 · CVE-2026-45726 · GHSA-wv8c-6mx2-xf4j
- Low, CVSS 2.7
Omni: Operator can traverse image-factory API paths via unsanitized
talos_versionin CreateSchematicGo github.com/siderolabs/omni · Upgrade to 1.7.3 or 1.6.6 by release line · < 1.6.6; >= 1.7.0, < 1.7.3 · CVE-2026-45723 · GHSA-c66c-vq6w-fvh5
- High, CVSS 7.0
Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token
Go github.com/siderolabs/omni · Upgrade to 1.7.3 or 1.6.6 by release line · < 1.6.6; >= 1.7.0, < 1.7.3 · CVE-2026-45720 · GHSA-5x9f-6vg5-qg4m
- Medium, CVSS 5.9
Vantage6: 2FA can be circumvented with hacked email access
PyPI vantage6 · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2024-27928 · GHSA-4c5c-2vc3-x5w2 · amended
- Low, CVSS 2.1
Vantage6: No limit on emails sent for password/MFA reset
PyPI vantage6 · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2024-24769 · GHSA-5549-c5q7-fj65 · amended
- High, CVSS 7.8
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
PyPI ansible-core · Upgrade to 2.21.1rc1 (pre-release), 2.20.7rc1 (pre-release), 2.19.11rc1 (pre-release) or 2 more by release line · < 2.16.19rc1; >= 2.17.0b1, < 2.18.18rc1; >= 2.19.0b1, < 2.19.11rc1; >= 2.20.0b1, < 2.20.7rc1; >= 2.21.0b1, < 2.21.1rc1 · CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj · amended
- Low, CVSS 2.7
Keycloak: Information disclosure due to user profile permission bypass
Maven org.keycloak:keycloak-services · Upgrade to 26.7.0 or later · < 26.7.0 · CVE-2026-9088 · GHSA-6g26-7cx5-mrrg
- Medium, CVSS 5.3
OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
PyPI ironic · Upgrade to 37.0.0 or later · >= 32.0.0, < 37.0.0 · CVE-2026-50589 · GHSA-q3g8-rjrx-59ph · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.