High, CVSS 8.5
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-54329 · GHSA-pwpj-p52h-q484
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 61 matching · newest first
- Low, CVSS 1.3
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Packagist snipe/snipe-it · Upgrade to 8.5.1 or later · <= 8.5.0 · CVE-2026-55542 · GHSA-6mmj-jhqj-6c6q
- Unrated
Snipe-IT has Improper Authorization in File Deletion (IDOR)
Packagist snipe/snipe-it · Upgrade to 8.4.1 or later · <= 8.4.0 · CVE-2026-55519 · GHSA-x667-r589-43m7
- Medium, CVSS 4.9
Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-55483 · GHSA-hf68-g98v-wp9g
- Medium, CVSS 6.3
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
Packagist snipe/snipe-it · Upgrade to 8.4.2 or later · <= 8.4.1 · CVE-2026-55482 · GHSA-33g4-646g-qwmm
- Medium, CVSS 5.8
Snipe-IT has a 2FA reset privilege bypass
Packagist snipe/snipe-it · Upgrade to 8.5.0 or later · < 8.5.0 · CVE-2026-50550 · GHSA-6x4j-8954-5hxm
- Medium, CVSS 6.5
Snipe-IT Vulnerable to User Account Escalation via CSV Import
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-49976 · GHSA-p68w-rgmg-3c2v
- Medium, CVSS 4.7
Flask-Security has an Open Redirect issue
PyPI flask-security · Upgrade to 5.8.1 or later · <= 5.8.0 · GHSA-w2j7-f3c6-g8cw · amended
- Medium, CVSS 5.9
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on
POST /two-factorPackagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-49870 · GHSA-mr8g-2mj4-pcq2
- Medium, CVSS 6.5
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.4 or later · < 4.1.4 · CVE-2026-49205 · GHSA-8c6h-7g6x-m5x4
- High, CVSS 7.1
Snipe-IT: Bulk editing users allowed
ldap_importandactivated_inbulk editing usersPackagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-48507 · GHSA-6f75-x745-xcpr
- Medium, CVSS 6.1
OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree
Go github.com/opentofu/opentofu · Upgrade to 1.11.7 or 1.10.10 by release line · >= 1.11.0, < 1.11.7; < 1.10.10 · GHSA-wcmj-x466-56mm
- Medium, CVSS 6.5
Filament: Unauthenticated temporary file upload on auth pages
Packagist filament/filament · Upgrade to 5.6.5, 4.11.5 or 3.3.52 by release line · >= 4.0.0, <= 4.11.4; >= 5.0.0, <= 5.6.4; >= 3.0.0, <= 3.3.51 · CVE-2026-48500 · GHSA-44wp-g8f4-f4v5
- Medium, CVSS 6.2
opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
Go go.opentelemetry.io/ebpf-profiler · Upgrade to 0.0.202622 or later · >= 0.0.202527, < 0.0.202622 · CVE-2026-48496 · GHSA-f2r5-5m7w-p5cx
- Medium, CVSS 5.5
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-48493 · GHSA-52fw-7fw2-fmv5
- Medium, CVSS 4.9
Snipe-IT's selectlist visibility is too permissive
Packagist snipe/snipe-it · Upgrade to 8.5.1 or later · < 8.5.1 · CVE-2026-48492 · GHSA-f3c5-6cw8-fg57
- Low, CVSS 2.7
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.4 or later · <= 4.1.3 · CVE-2026-48488 · GHSA-58fg-62fg-3fcj
- Medium, CVSS 6.6
OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
Maven io.netty.incubator:netty-incubator-codec-ohttp · Upgrade to 0.0.22.Final or later · < 0.0.22.Final · CVE-2026-48480 · GHSA-r6fj-869h-4f6q
- Medium, CVSS 6.4
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
Packagist filament/tables +1 · Upgrade all 2 to 5.6.5 or 4.11.5 by release line · >= 4.0.0, <= 4.11.4; >= 5.0.0, <= 5.6.4 · CVE-2026-48167 · GHSA-3fc8-8hp6-6jr4
- Medium, CVSS 5.3
Filament: Timing-based user enumeration on login page
Packagist filament/filament · Upgrade to 5.6.5 or 4.11.5 by release line · >= 4.0.0, <= 4.11.4; >= 5.0.0, <= 5.6.4 · CVE-2026-48166 · GHSA-5w46-g9pq-wh6f
- Medium, CVSS 6.1
Slim has Reflected XSS in the HtmlErrorRenderer
Packagist slim/slim · Upgrade to 4.15.2 or later · >= 4.4.0, <= 4.15.1 · CVE-2026-48157 · GHSA-53h4-8rc4-f539
- High, CVSS 8.2
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
Go github.com/xyproto/algernon · Upgrade to 1.17.8 or later · <= 1.17.7 · CVE-2026-48126 · GHSA-jc3j-x6pg-4hmv
- High, CVSS 8.8
Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist
Maven org.springframework.statemachine:spring-statemachine-kryo · Upgrade to 4.0.2; some affected versions have no fix yet · >= 3.2.0, <= 3.2.4; >= 4.0.0, <= 4.0.1 · CVE-2026-41862 · GHSA-85qj-f5wg-rwp9
- Medium, CVSS 5.3
jackson-databind has @JsonView bypass for setterless creator properties
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54517 · GHSA-5hh8-q8hv-fr38
- Medium, CVSS 5.3
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54516 · GHSA-9fxm-vc8v-hj55
A vendor fix does not resolve your finding until you verify it in your own systems.