Medium, CVSS 6.3
Kirby: Access to files of top-level drafts is not protected by permissions
Packagist getkirby/cms · Upgrade to 5.4.4 or 4.9.4 by release line · <= 4.9.3; >= 5.0.0-alpha.1, <= 5.4.3 · CVE-2026-54004 · GHSA-89cp-7p28-jffg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 146 matching · newest first
- Critical, CVSS 9.1
Kirby: External Initialization of the Panel on reverse proxy setups with the
ForwardedheaderPackagist getkirby/cms · Upgrade to 5.4.4 or 4.9.4 by release line · <= 4.9.3; >= 5.0.0-alpha.1, <= 5.4.3 · CVE-2026-54003 · GHSA-whxw-24jc-cwmv
- High, CVSS 8.5
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in
Dom::sanitize()Packagist getkirby/cms · Upgrade to 5.4.4 or 4.9.4 by release line · <= 4.9.3; >= 5.0.0-alpha.1, <= 5.4.3 · CVE-2026-54002 · GHSA-wr9h-4r83-f4v6
- Medium, CVSS 6.9
Kirby: Request header injection in
Http\RemotePackagist getkirby/cms · Upgrade to 5.4.4 or 4.9.4 by release line · <= 4.9.3; >= 5.0.0-alpha.1, <= 5.4.3 · CVE-2026-50188 · GHSA-4v4h-m2qq-ppgw
- High, CVSS 7.4
Kirby: Self cross-site scripting (self-XSS) in the writer field
Packagist getkirby/cms · Upgrade to 5.4.4 or 4.9.4 by release line · <= 4.9.3; >= 5.0.0-alpha.1, <= 5.4.3 · CVE-2026-49276 · GHSA-rhj6-r49h-5932
- Medium, CVSS 5.3
Kirby:
pages.accesspermission is not checked in the pages picker for parent pagesPackagist getkirby/cms · Upgrade to 5.4.4 or 4.9.4 by release line · <= 4.9.3; >= 5.0.0-alpha.1, <= 5.4.3 · CVE-2026-49274 · GHSA-23q2-54qv-rq5x
- Medium, CVSS 5.3
opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token
Go github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter · Upgrade to 0.154.0 or later · < 0.154.0 · CVE-2026-47256 · GHSA-4jvg-4jfx-fmhc
- Critical, CVSS 9.3
Jupyter Server: Stored XSS in
NbconvertFileHandler/NbconvertPostHandlervia missingsandboxCSPPyPI jupyter-server · Upgrade to 2.20.0 or later · <= 2.19.0 · CVE-2026-44727 · GHSA-fcw5-x6j4-ccmp · amended
- Low, CVSS 2.2
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
PyPI bbot · Upgrade to 2.8.5 or later · >= 2.0.0, <= 2.8.4 · CVE-2026-12567 · GHSA-rvp7-w75q-9fv2 · amended
- Medium, CVSS 6.5
BBOT: Arbitrary File Write in postman_download Module
PyPI bbot · Upgrade to 2.8.6 or later · >= 2.1.0, <= 2.8.5 · CVE-2026-12568 · GHSA-m54h-vhf9-3w3m · amended
- Low, CVSS 3.1
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
PyPI bbot · Upgrade to 2.8.5 or later · >= 2.0.0, <= 2.8.4 · CVE-2026-12566 · GHSA-3mp7-vp6j-2mxx · amended
- Medium, CVSS 5.3
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
PyPI bbot · Upgrade to 2.8.5 or later · >= 2.3.1, <= 2.8.4 · CVE-2026-12565 · GHSA-3vgw-585j-4m45 · amended
- Medium, CVSS 6.6
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags
npm openclaw · Upgrade to 2026.5.6 or later · <= 2026.5.5 · CVE-2026-53861 · GHSA-c226-q6fx-6j6c · amended
- Medium, CVSS 4.8
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Packagist getgrav/grav · Upgrade to 2.0.0-rc.9 (pre-release) or later · <= 2.0.0-rc.8 · CVE-2026-55890 · GHSA-pmf8-g7c8-7v54
- Medium, CVSS 4.3
praisonai-platform: Authorization Bypass Through User-Controlled Key
PyPI praisonai-platform · Upgrade to 0.1.8 or later · < 0.1.8 · CVE-2026-58653 · GHSA-2fjj-qqg8-fg7x · amended
- Medium, CVSS 6.8
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
Packagist getgrav/grav · Upgrade to 1.7.53 or later · < 1.7.53 · CVE-2026-55885 · GHSA-2f86-9cp8-6hcf
- Medium, CVSS 6.9
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
npm @bitbonsai/mcpvault · Upgrade to 0.11.4 or later · < 0.11.4 · CVE-2026-57441 · GHSA-j99q-93c9-h869 · amended
- Medium, CVSS 6.9
pypdf: Missing stream length values ignore defined limits
PyPI pypdf · Upgrade to 6.13.3 or later · < 6.13.3 · CVE-2026-57204 · GHSA-jm82-fx9c-mx94 · amended
- High, CVSS 7.4
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
npm undici · Upgrade to 8.5.0 or 7.28.0 by release line · >= 7.23.0, < 7.28.0; >= 8.0.0, < 8.5.0 · CVE-2026-9697 · GHSA-vmh5-mc38-953g · amended
- Medium, CVSS 5.9
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
npm undici · Upgrade to 8.5.0 or 7.28.0 by release line · >= 7.0.0, < 7.28.0; >= 8.0.0, < 8.5.0 · CVE-2026-9678 · GHSA-pr7r-676h-xcf6 · amended
- High, CVSS 7.5
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
npm undici · Upgrade to 8.5.0 or later · >= 8.0.0, < 8.5.0 · CVE-2026-9675 · GHSA-38rv-x7px-6hhq · amended
- High, CVSS 7.1
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
npm nodemailer · Upgrade to 9.0.1 or later · <= 9.0.0 · CVE-2026-82659 · GHSA-p6gq-j5cr-w38f · amended
- Critical, CVSS 9.3
python-statemachine SCXML Eval Injection
PyPI python-statemachine · Upgrade to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2026-47103 · GHSA-v4jc-pm6r-3vj8 · amended
- Medium, CVSS 5.1
DOMPurify: Permanent
ALLOWED_ATTRpollution viasetConfig()bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)npm dompurify · Upgrade to 3.4.11 or later · <= 3.4.10 · CVE-2026-65898 · GHSA-cmwh-pvxp-8882 · amended
- Critical, CVSS 9.8
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
PyPI praisonai-platform · Upgrade to 0.1.6 or later · <= 0.1.4 · CVE-2026-57147 · GHSA-cwj8-7gp2-ggcw · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.