High, CVSS 8.5
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-54329 · GHSA-pwpj-p52h-q484
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Snipe-IT: Bulk editing users allowed
ldap_importandactivated_inbulk editing usersPackagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-48507 · GHSA-6f75-x745-xcpr
- High, CVSS 8.2
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
Go github.com/xyproto/algernon · Upgrade to 1.17.8 or later · <= 1.17.7 · CVE-2026-48126 · GHSA-jc3j-x6pg-4hmv
- High, CVSS 8.8
Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist
Maven org.springframework.statemachine:spring-statemachine-kryo · Upgrade to 4.0.2; some affected versions have no fix yet · >= 3.2.0, <= 3.2.4; >= 4.0.0, <= 4.0.1 · CVE-2026-41862 · GHSA-85qj-f5wg-rwp9
- High, CVSS 8.1
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54513 · GHSA-rmj7-2vxq-3g9f
- High, CVSS 8.1
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54512 · GHSA-j3rv-43j4-c7qm · amended
- Critical, CVSS 10.0
motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · GHSA-phv5-334h-mxcw · amended
- Critical, CVSS 9.8
motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · GHSA-qxvg-h7q2-hcxh · amended
- High, CVSS 8.6
Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository
crates.io mise · Upgrade to 2026.6.4 or later · < 2026.6.4 · CVE-2026-55441 · GHSA-77g9-363w-rccq
- High, CVSS 7.0
OctoPrint has possible file exfiltration via query parameters on upload endpoints
PyPI octoprint · Upgrade to 2.0.0rc3 (pre-release) or 1.11.8 by release line · <= 1.11.7; >= 2.0.0rc1, <= 2.0.0rc2 · CVE-2026-54134 · GHSA-j4h9-pm27-4rfw · amended
- High, CVSS 7.8
Glances has arbitrary file write and command execution via
secure_popenredirection and chaining operators in AMP command configurationPyPI glances · Upgrade to 4.5.5 or later · >= 4.0.8, < 4.5.5 · CVE-2026-53925 · GHSA-3vwc-qwhc-3mj7 · amended
- Critical, CVSS 10.0
Budibase has nonymous NoSQL operator injection via published-app query templates
npm @budibase/server · Upgrade to 3.39.12 or later · < 3.39.12 · CVE-2026-54350 · GHSA-8qv3-p479-cj62 · amended
- High, CVSS 8.3
OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
Maven org.openidentityplatform.openam:openam-federation · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45049 · GHSA-r9pv-5rpp-vm8g · amended
- High, CVSS 8.5
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
Maven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45048 · GHSA-vvhj-w2jq-263q · amended
- Critical, CVSS 10.0
Gogs has Path Traversal in organization name that results in RCE through Git hooks
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52813 · GHSA-c39w-43gm-34h5
- High, CVSS 7.1
Gogs: LFS dedupe path leaks private repo content across tenants
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52812 · GHSA-6p9m-q3jp-47h4
- Critical, CVSS 9.0
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52811 · GHSA-89mr-xqfv-758m
- High, CVSS 7.1
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52810 · GHSA-wmfg-5p4h-5fw3 · amended
- High, CVSS 7.1
Gogs's write-level collaborators can mutate admin-only repository settings via API
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52808 · GHSA-268j-37xf-pp52
- Critical, CVSS 9.9
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52806 · GHSA-qf6p-p7ww-cwr9
- High, CVSS 8.7
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52805 · GHSA-g2f5-gjr4-qjvm
- High, CVSS 8.1
Gogs has the ability to import local repositories via Mirror Settings
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52801 · GHSA-wv27-2vqp-j7g5
- High, CVSS 8.8
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52800 · GHSA-pwx3-qcgw-vh7h
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.