Low, CVSS 2.3
nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · <= 0.3.1 · GHSA-6vgg-xhvh-38ff
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 55 matching · newest first
- Medium, CVSS 5.1
pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams
PyPI pypdf · Upgrade to 6.12.0 or later · < 6.12.0 · CVE-2026-48156 · GHSA-248m-82v9-q6g6 · amended
- Medium, CVSS 4.8
pypdf: Possible large memory usage for large offsets for layout mode text
PyPI pypdf · Upgrade to 6.12.0 or later · < 6.12.0 · CVE-2026-48155 · GHSA-cj93-chg6-vgv8 · amended
- Medium, CVSS 5.9
gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362)
Go github.com/pilinux/gorest · Upgrade to 1.12.2 or later · <= 1.12.1 · CVE-2026-48154 · GHSA-cpwg-x64r-rgwg
- High, CVSS 8.1
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
Maven com.appsmith:server · Upgrade to 2.0 or later · < 2.0 · GHSA-j9gf-vw2f-9hrw
- High, CVSS 8.1
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48152 · GHSA-3gp5-q4jw-3v94 · amended
- High, CVSS 7.5
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48151 · GHSA-qhv3-wjg8-6fx6 · amended
- Critical, CVSS 9.0
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48150 · GHSA-6xp4-cf37-ppjh · amended
- Medium, CVSS 5.3
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
npm @budibase/server · Upgrade to 3.35.3 or later · < 3.35.3 · CVE-2026-48148 · GHSA-cv96-5348-p5p8 · amended
- Medium, CVSS 6.5
Budibase: Unanchored Regex in
matchers.tsAllows CSRF Bypass via Query String Injection in Budibase Workernpm @budibase/backend-core · Upgrade to 3.35.4 or later · < 3.35.4 · CVE-2026-48147 · GHSA-wxq7-x3qp-vcr8 · amended
- Medium, CVSS 6.5
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
Maven org.geoserver:gs-main +1 · Upgrade all 2 to 2.27.3 or 2.26.4 by release line · <= 2.26.3; >= 2.27.0, <= 2.27.2 · CVE-2025-58175 · GHSA-x4r9-gmw3-hxww
- High, CVSS 7.2
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
Maven org.geoserver.web:gs-web-sec-core +1 · Upgrade all 2 to 2.27.3 or 2.26.4 by release line · >= 2.27.0, <= 2.27.2; <= 2.26.3 · CVE-2025-52465 · GHSA-7qmg-grcp-qf25
- High, CVSS 7.7
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48146 · GHSA-g6qx-g4pr-92v7 · amended
- Medium, CVSS 5.1
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
npm budibase · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48128 · GHSA-6964-pp88-6wp9 · amended
- Medium, CVSS 6.7
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
npm @langchain/langgraph-checkpoint-mongodb · Upgrade to 1.3.1 or later · <= 1.3.0 · CVE-2026-48121 · GHSA-98xf-r82g-9mhx · amended
- Medium, CVSS 5.1
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
Packagist grumpydictator/firefly-iii · Upgrade to 6.6.3 or later · <= 6.6.2 · GHSA-6jq6-x4cx-qvcm
- High, CVSS 8.9
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
Go github.com/google/go-attestation · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-12681 · GHSA-9r4w-jg96-92mv
- High, CVSS 8.5
Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
Go github.com/jpillora/chisel · Upgrade to 1.11.5 or later · <= 1.11.4 · CVE-2026-48113 · GHSA-24fp-5v3p-rvpw
- Critical, CVSS 9.8
Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
Maven org.apache.cxf:cxf-rt-transports-jms · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.1.0, < 4.1.7; < 3.6.12 · CVE-2026-50632 · GHSA-93g8-qqv3-mrx8
- High, CVSS 7.5
Apache cxf-core: No restriction on attachment headers per message
Maven org.apache.cxf:cxf-core · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12 · CVE-2026-50645 · GHSA-ghvc-7hp8-2g2v
- Medium, CVSS 6.5
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Maven org.apache.cxf:cxf-rt-rs-security-jose-jaxrs · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50634 · GHSA-33j8-j763-4fv5
- Critical, CVSS 9.8
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Maven org.apache.cxf:cxf-integration-jca · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50633 · GHSA-qp3f-rvj8-46c8
- Critical, CVSS 9.1
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50627 · GHSA-9mrv-8pvf-hf4m
- Critical, CVSS 9.8
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50628 · GHSA-g5v7-jchf-7jrr
- Medium, CVSS 6.5
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50623 · GHSA-542g-m3fx-q86f
A vendor fix does not resolve your finding until you verify it in your own systems.