High, CVSS 7.5
Gogs Missing Authorization in Attachment Download
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-52799 · GHSA-p9f5-h3rx-j5qw
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 58 matching · newest first
- High, CVSS 8.9
Gogs has Stored XSS in
.ipynbPreviewGo gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-52798 · GHSA-jq8v-rmf6-65jw
- Low, CVSS 3.5
Gogs has DoS in rendering issue index pattern
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-52796 · GHSA-4j89-2c4f-44c6
- Medium, CVSS 4.2
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
npm @actual-app/web · Upgrade to 26.6.0 or later · < 26.6.0 · CVE-2026-50179 · GHSA-xqjm-27pc-rvwm · amended
- High, CVSS 8.5
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
npm @budibase/backend-core · Upgrade to 3.39.9 or later · < 3.39.9 · CVE-2026-54353 · GHSA-gfq7-5x4g-3xhf · amended
- Critical, CVSS 9.6
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
npm @budibase/server · Upgrade to 3.39.9 or later · < 3.39.9 · CVE-2026-54352 · GHSA-w7mq-r738-x278 · amended
- High, CVSS 8.2
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
npm @budibase/server · Upgrade to 3.39.9 or later · < 3.39.9 · CVE-2026-54351 · GHSA-rgvg-3wpc-h44p · amended
- High, CVSS 8.3
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
npm @actual-app/sync-server · Upgrade to 26.6.0 or later · <= 26.5.2 · CVE-2026-49229 · GHSA-cq9c-6w48-qmfg · amended
- High, CVSS 8.2
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-50137 · GHSA-35c4-rvc8-frhm · amended
- High, CVSS 8.8
PYSEC-2026-227
PyPI vllm · Upgrade to 0.22.1 or later · < 0.22.1 · CVE-2026-54232 · GHSA-jrf6-vqxq-pjv2
- High, CVSS 7.4
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
npm @budibase/server · Upgrade to 3.39.2 or later · < 3.39.2 · CVE-2026-50136 · GHSA-jj36-r9w3-3pfh · amended
- High, CVSS 7.3
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-50132 · GHSA-v7j5-vc4m-723w · amended
- Medium, CVSS 4.9
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
PyPI zeroconf · Upgrade to 0.149.16 or later · < 0.149.16 · CVE-2026-48487 · GHSA-qc2x-6f54-m6h9 · amended
- Medium, CVSS 5.4
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
npm devbridge-autocomplete · Upgrade to 2.0.1 or later · <= 2.0.0 · GHSA-hvqh-jw65-wcpq · amended
- Critical, CVSS 9.1
scimPatch vulnerable to prototype pollution via unfiltered keys in patch
npm scim-patch · Upgrade to 0.9.1 or later · <= 0.9.0 · CVE-2026-48170 · GHSA-9m6g-wc8r-q59c · amended
- Medium, CVSS 5.0
nebula-mesh's stores enrollment tokens unhashed in SQLite
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · <= 0.3.1 · GHSA-ghmh-jhmj-wcmf
- High, CVSS 8.5
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48153 · GHSA-4q6h-8p4v-67vq · amended
- Unrated
skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery
crates.io skillctl · Upgrade to 0.1.3 or later · < 0.1.3 · GHSA-74p7-6h78-gw8p
- High, CVSS 8.3
Gogs has SSRF in webhook deliveries
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-47267 · GHSA-c4v7-xg93-qf8g
- Medium, CVSS 4.3
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
npm @actual-app/sync-server · Upgrade to 26.6.0 or later · < 26.6.0 · CVE-2026-46700 · GHSA-3f62-qv96-4p78 · amended
- Medium, CVSS 4.6
@actual-app/cli
--format csvOutput Vulnerable to CSV Formula Injection via CustomescapeCsvHelpernpm @actual-app/cli · Upgrade to 26.6.0 or later · < 26.6.0 · CVE-2026-46672 · GHSA-7gh7-258j-4mpq · amended
- Medium, CVSS 5.3
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46611 · GHSA-w856-8p3r-p338 · amended
- High, CVSS 7.4
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46608 · GHSA-87qc-fj39-wccr · amended
- High, CVSS 7.8
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46607 · GHSA-9837-48hr-q32j · amended
- High, CVSS 7.8
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46606 · GHSA-v5r2-qh84-fjx5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.