High, CVSS 8.7
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.33.8 or later · < 2.33.8 · CVE-2026-54090 · GHSA-8c9q-7855-wfxq
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
File Browser has incorrect access control for public directory shares via rule path rebasing
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.6 or later · <= 2.63.5 · CVE-2026-54091 · GHSA-j9jx-hp4c-ghhh
- High, CVSS 7.7
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Go github.com/radius-project/radius · Upgrade to 0.58.0 or later · < 0.58.0 · CVE-2026-53999 · GHSA-fp5j-4fj2-4jvq
- High, CVSS 7.6
TYPO3 CMS has Broken Access Control in its Form Framework
Packagist typo3/cms-core +1 · Upgrade all 2 to 14.3.3, 13.4.31, 12.4.46 or 2 more by release line · < 10.4.57; >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-11607 · GHSA-pjpj-v387-x4vq
- High, CVSS 7.2
TYPO3 CMS: Destructive Actions on File Mount Folders
Packagist typo3/cms-core · Upgrade to 14.3.3, 13.4.31, 12.4.46 or 2 more by release line · < 10.4.57; >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-47343 · GHSA-3v8v-4wg6-r7qh
- High, CVSS 8.7
PyO3 has an Out-of-bounds Read in
nth/nth_backforPyListandPyTupleiteratorscrates.io pyo3 · Upgrade to 0.29.0 or later · < 0.29.0 · GHSA-36hh-v3qg-5jq4
- High, CVSS 8.7
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
Packagist typo3/cms-core +1 · Upgrade all 2 to 14.3.3 or later · >= 14.0.0, < 14.3.3 · CVE-2026-49741 · GHSA-jh32-v29g-68pq
- High, CVSS 7.6
TYPO3 CMS has Broken Access Control in its Form Framework
Packagist typo3/cms-core +1 · Upgrade all 2 to 14.3.3, 13.4.31, 12.4.46 or 2 more by release line · < 10.4.57; >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-47346 · GHSA-hwvq-2w67-rvxp
- High, CVSS 7.1
TYPO3 CMS has Broken Access Control in its Media Module
Packagist typo3/cms-filelist +1 · Upgrade all 2 to 14.3.3, 13.4.31, 12.4.46 or 11.5.51 by release line · >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-49742 · GHSA-chm7-4vch-h8vr
- High, CVSS 8.1
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
Maven com.appsmith:server · Upgrade to 2.0 or later · < 2.0 · GHSA-j9gf-vw2f-9hrw
- High, CVSS 8.1
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48152 · GHSA-3gp5-q4jw-3v94 · amended
- High, CVSS 7.5
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48151 · GHSA-qhv3-wjg8-6fx6 · amended
- Critical, CVSS 9.0
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48150 · GHSA-6xp4-cf37-ppjh · amended
- High, CVSS 7.2
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
Maven org.geoserver.web:gs-web-sec-core +1 · Upgrade all 2 to 2.27.3 or 2.26.4 by release line · >= 2.27.0, <= 2.27.2; <= 2.26.3 · CVE-2025-52465 · GHSA-7qmg-grcp-qf25
- High, CVSS 7.7
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48146 · GHSA-g6qx-g4pr-92v7 · amended
- High, CVSS 8.9
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
Go github.com/google/go-attestation · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-12681 · GHSA-9r4w-jg96-92mv
- High, CVSS 8.5
Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
Go github.com/jpillora/chisel · Upgrade to 1.11.5 or later · <= 1.11.4 · CVE-2026-48113 · GHSA-24fp-5v3p-rvpw
- Critical, CVSS 9.8
Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
Maven org.apache.cxf:cxf-rt-transports-jms · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.1.0, < 4.1.7; < 3.6.12 · CVE-2026-50632 · GHSA-93g8-qqv3-mrx8
- High, CVSS 7.5
Apache cxf-core: No restriction on attachment headers per message
Maven org.apache.cxf:cxf-core · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12 · CVE-2026-50645 · GHSA-ghvc-7hp8-2g2v
- Critical, CVSS 9.8
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Maven org.apache.cxf:cxf-integration-jca · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50633 · GHSA-qp3f-rvj8-46c8
- Critical, CVSS 9.1
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50627 · GHSA-9mrv-8pvf-hf4m
- Critical, CVSS 9.8
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50628 · GHSA-g5v7-jchf-7jrr
- High, CVSS 8.2
Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50629 · GHSA-f8p7-h97q-7vx7
- Critical, CVSS 9.8
Apache CXF has Improper Restriction of XML External Entity Reference
Maven org.apache.cxf:cxf-core · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12 · CVE-2026-49875 · GHSA-xw5h-cmh3-8j6j · amended
- High, CVSS 7.4
Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50631 · GHSA-83r6-96m8-r52p
A vendor fix does not resolve your finding until you verify it in your own systems.