High, CVSS 7.5
Gogs Missing Authorization in Attachment Download
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-52799 · GHSA-p9f5-h3rx-j5qw
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.9
Gogs has Stored XSS in
.ipynbPreviewGo gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-52798 · GHSA-jq8v-rmf6-65jw
- High, CVSS 8.5
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
npm @budibase/backend-core · Upgrade to 3.39.9 or later · < 3.39.9 · CVE-2026-54353 · GHSA-gfq7-5x4g-3xhf · amended
- Critical, CVSS 9.6
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
npm @budibase/server · Upgrade to 3.39.9 or later · < 3.39.9 · CVE-2026-54352 · GHSA-w7mq-r738-x278 · amended
- High, CVSS 8.2
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
npm @budibase/server · Upgrade to 3.39.9 or later · < 3.39.9 · CVE-2026-54351 · GHSA-rgvg-3wpc-h44p · amended
- High, CVSS 8.3
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
npm @actual-app/sync-server · Upgrade to 26.6.0 or later · <= 26.5.2 · CVE-2026-49229 · GHSA-cq9c-6w48-qmfg · amended
- High, CVSS 8.2
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-50137 · GHSA-35c4-rvc8-frhm · amended
- High, CVSS 8.8
PYSEC-2026-227
PyPI vllm · Upgrade to 0.22.1 or later · < 0.22.1 · CVE-2026-54232 · GHSA-jrf6-vqxq-pjv2
- High, CVSS 7.4
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
npm @budibase/server · Upgrade to 3.39.2 or later · < 3.39.2 · CVE-2026-50136 · GHSA-jj36-r9w3-3pfh · amended
- High, CVSS 7.3
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-50132 · GHSA-v7j5-vc4m-723w · amended
- Critical, CVSS 9.1
scimPatch vulnerable to prototype pollution via unfiltered keys in patch
npm scim-patch · Upgrade to 0.9.1 or later · <= 0.9.0 · CVE-2026-48170 · GHSA-9m6g-wc8r-q59c · amended
- High, CVSS 8.5
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48153 · GHSA-4q6h-8p4v-67vq · amended
- High, CVSS 8.3
Gogs has SSRF in webhook deliveries
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-47267 · GHSA-c4v7-xg93-qf8g
- High, CVSS 7.4
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46608 · GHSA-87qc-fj39-wccr · amended
- High, CVSS 7.8
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46607 · GHSA-9837-48hr-q32j · amended
- High, CVSS 7.8
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46606 · GHSA-v5r2-qh84-fjx5 · amended
- Critical, CVSS 9.2
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 5.1.1 or later · <= 5.1.0 · CVE-2026-46495 · GHSA-43x2-g84q-fmqx
- Critical, CVSS 9.1
motionEye: Authentication possible via password hash
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-46488 · GHSA-r3cw-c95m-wfh9 · amended
- High, CVSS 8.5
Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types
Maven io.spinnaker.rosco:rosco-core +1 · Upgrade all 2 to 2026.0.3, 2025.4.4 or 2025.3.3 by release line · < 2025.3.3; >= 2025.4.0, < 2025.4.4; >= 2026.0.0, < 2026.0.3 · CVE-2026-44795 · GHSA-c8q4-9h32-2ww8
- High, CVSS 8.3
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · >= 13.0.0, < 16.1.1 · CVE-2026-44203 · GHSA-fq9h-c788-fx73 · amended
- Critical, CVSS 9.9
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
Maven com.xwiki.pro:xwiki-pro-macros · Upgrade to 1.14.5 or later · >= 1.13, < 1.14.5 · CVE-2026-44179 · GHSA-w56x-9778-rppx
- High, CVSS 8.7
OpenAM has LDAP Injection via
_queryIdParameterMaven org.openidentityplatform.openam:openam-core-rest · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-41573 · GHSA-2vg8-q4c2-5cw3 · amended
- High, CVSS 7.5
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
PyPI comfyui-manager · Upgrade to 3.38 or later · < 3.38 · CVE-2025-67303 · GHSA-95pq-hr8p-f5g7 · amended
- High, CVSS 7.5
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Packagist wwbn/avideo · Upgrade to 29.0 or later · < 29.0 · CVE-2026-33692 · GHSA-wf69-r4mx-43rr
- Critical, CVSS 9.1
Chainlit contains a session hijacking vulnerability
PyPI chainlit · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2026-56104 · GHSA-c39v-8hrw-h448 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.