Critical, CVSS 9.2
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 5.1.1 or later · <= 5.1.0 · CVE-2026-46495 · GHSA-43x2-g84q-fmqx
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 58 matching · newest first
- Critical, CVSS 9.1
motionEye: Authentication possible via password hash
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-46488 · GHSA-r3cw-c95m-wfh9 · amended
- High, CVSS 8.5
Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types
Maven io.spinnaker.rosco:rosco-core +1 · Upgrade all 2 to 2026.0.3, 2025.4.4 or 2025.3.3 by release line · < 2025.3.3; >= 2025.4.0, < 2025.4.4; >= 2026.0.0, < 2026.0.3 · CVE-2026-44795 · GHSA-c8q4-9h32-2ww8
- Low, CVSS 2.3
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via
FSUtils.postToTargetMaven org.openidentityplatform.openam:openam-federation-library · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-44793 · GHSA-fhrq-3gmx-p879 · amended
- Low, CVSS 2.9
Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)
Go github.com/inspektor-gadget/inspektor-gadget · Upgrade to 0.53.1 or later · >= 0.28.0, < 0.53.1 · CVE-2026-44778 · GHSA-7cfq-5mhv-jrp9
- Medium, CVSS 5.4
Paymenter has broken object level authorization via service reference manipulation on ticket creation
Packagist paymenter/paymenter · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-44585 · GHSA-x93q-x9pc-w5hw
- Medium, CVSS 4.3
Paymenter doesn't reset email verification status after email change
Packagist paymenter/paymenter · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-44584 · GHSA-rv89-wch8-c574
- Medium, CVSS 5.3
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
Packagist paymenter/paymenter · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-44583 · GHSA-7wwh-xcc3-9fcg
- High, CVSS 8.3
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · >= 13.0.0, < 16.1.1 · CVE-2026-44203 · GHSA-fq9h-c788-fx73 · amended
- Medium, CVSS 6.2
OpenAM Authenticated Server-Side Request Forgery (SSRF) via
/sessionserviceMaven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-44202 · GHSA-c556-q2mh-477v · amended
- Critical, CVSS 9.9
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
Maven com.xwiki.pro:xwiki-pro-macros · Upgrade to 1.14.5 or later · >= 1.13, < 1.14.5 · CVE-2026-44179 · GHSA-w56x-9778-rppx
- Medium, CVSS 4.8
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
Go github.com/opencontainers/runc · Upgrade to 1.5.0-rc.3 (pre-release), 1.4.3 or 1.3.6 by release line · <= 1.3.5; >= 1.4.0, <= 1.4.2; >= 1.5.0-rc.1, <= 1.5.0-rc.2 · CVE-2026-41579 · GHSA-xjvp-4fhw-gc47
- High, CVSS 8.7
OpenAM has LDAP Injection via
_queryIdParameterMaven org.openidentityplatform.openam:openam-core-rest · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-41573 · GHSA-2vg8-q4c2-5cw3 · amended
- Medium, CVSS 6.5
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
Packagist wwbn/avideo · Upgrade to 29.0 or later · <= 28.0 · CVE-2026-33731 · GHSA-95jh-7r58-xmxw
- High, CVSS 7.5
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
PyPI comfyui-manager · Upgrade to 3.38 or later · < 3.38 · CVE-2025-67303 · GHSA-95pq-hr8p-f5g7 · amended
- High, CVSS 7.5
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Packagist wwbn/avideo · Upgrade to 29.0 or later · < 29.0 · CVE-2026-33692 · GHSA-wf69-r4mx-43rr
- Critical, CVSS 9.1
Chainlit contains a session hijacking vulnerability
PyPI chainlit · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2026-56104 · GHSA-c39v-8hrw-h448 · amended
- Medium, CVSS 6.1
Keras: DiskIOStore permits path traversal through crafted layer names
PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-12479 · GHSA-gh82-f9x8-5frx · amended
- Medium, CVSS 5.3
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
Packagist wwbn/avideo · Upgrade to 29.0 or later · < 29.0 · CVE-2026-33684 · GHSA-8j8m-p79x-g4jm
- Critical, CVSS 9.6
Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
crates.io mise · Upgrade to 2026.3.10 or later · < 2026.3.10 · CVE-2026-33646 · GHSA-fjj5-v948-whjj
- Medium, CVSS 5.5
motionEye's World-Readable Configuration File Exposes Admin Password Hash
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-32315 · GHSA-rhgp-6wq6-9j67 · amended
- Medium, CVSS 6.5
motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-31978 · GHSA-g9fx-5r4h-pcw3 · amended
- High, CVSS 7.7
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-25119 · GHSA-w6j9-vw59-27wv
- High, CVSS 7.7
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
PyPI pycti · Upgrade to 6.8.16 or later · < 6.8.16 · CVE-2026-21887 · GHSA-ffm6-vvph-g5f5 · amended
- Medium, CVSS 4.9
Gogs has a Denial of Service in repository/wiki file listing web pages
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2025-64719 · GHSA-3qq3-668m-v9mj
A vendor fix does not resolve your finding until you verify it in your own systems.