High, CVSS 7.3
Wagtail: Reflected XSS in dynamic image URL generator view
PyPI wagtail · Upgrade to 7.4.2 or 7.3.3 by release line · >= 7.3, < 7.3.3; >= 7.4, < 7.4.2 · CVE-2026-54263 · GHSA-23m2-mghx-vqmf · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.1
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
npm @apify/actors-mcp-server · Upgrade to 0.10.11 or later · < 0.10.11 · CVE-2026-50143 · GHSA-6gr2-qh89-hxwm · amended
- Critical, CVSS 9.6
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
npm ghost · Upgrade to 6.37.0 or later · >= 4.0.0, <= 6.36.0 · CVE-2026-53943 · GHSA-62q6-4hv4-vjrw · amended
- High, CVSS 8.1
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
Go goshs.de/goshs/v2 · Upgrade to 2.1.0 or later · <= 2.0.9 · CVE-2026-50138 · GHSA-3whc-qvhv-xqjp
- High, CVSS 8.2
OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms
Maven com.ongres.scram:scram-common +1 · Upgrade all 2 to 3.3 or later · <= 3.2 · CVE-2026-53712 · GHSA-p9jg-fcr6-3mhf
- High, CVSS 7.1
oras-gotar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionGo oras.land/oras-go/v2 · Upgrade to 2.6.2 or later · <= 2.6.1 · CVE-2026-50163 · GHSA-fxhp-mv3v-67qp
- High, CVSS 8.7
Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks
PyPI gradio · Upgrade to 6.16.0 or later · < 6.16.0 · CVE-2026-49119 · GHSA-j36p-7w88-g82j · amended
- High, CVSS 7.5
oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
Go oras.land/oras-go/v2 · Upgrade to 2.6.1 or later · < 2.6.1 · CVE-2026-50151 · GHSA-jxpm-75mh-9fp7
- High, CVSS 7.3
Keycloak has privilege escalation via improper scope mapping enforcement
Maven org.keycloak:keycloak-services · Upgrade to 26.6.4 or later · < 26.6.4 · CVE-2026-9795 · GHSA-32h4-44jj-c5vx
- Critical, CVSS 9.4
Rancher has Privilege Escalation from Project Owner to Host
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6, 2.12.10 or 0.0.0-20260513182521-2800aaac25b5 (pre-release) by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; < 0.0.0-20260513182521-2800aaac25b5 · CVE-2026-41052 · GHSA-vx8h-4prv-g744
- High, CVSS 8.8
Rancher has over-inclusive team membership expansion in GitHub App authentication provider
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6 or 0.0.0-20260519172014-d0c047bbc6d2 (pre-release) by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; < 0.0.0-20260519172014-d0c047bbc6d2 · CVE-2026-41053 · GHSA-4j6x-2764-m8gh
- Critical, CVSS 9.9
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated
valuesFromreferences in Helm DeployerGo github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44935 · GHSA-xr65-5cpm-g36x
- Critical, CVSS 9.4
Rancher vulnerable to command injection through unsanitized YAML parameter
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6, 2.12.10 or 3 more by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; >= 2.11.0, < 2.11.14; >= 2.10.0, < 2.10.12; < 0.0.0-20260617231817-2aa77eb283e7 · CVE-2026-44939 · GHSA-mhc6-2gfq-xx62
- High, CVSS 7.5
Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44937 · GHSA-jmf4-m7j9-g72r
- High, CVSS 8.8
Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44938 · GHSA-864g-863m-vcvq
- High, CVSS 7.5
SurrealDB has unauthenticated remote DoS via malformed RPC
usecallcrates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63747 · GHSA-wjjj-24cx-f28g · amended
- High, CVSS 7.5
SurrealDB has Denial of Service in JSON parser due to nested objects
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63760 · GHSA-q729-696q-g9pq
- High, CVSS 8.1
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63756 · GHSA-4vgr-h27g-cf9p · amended
- High, CVSS 8.8
SurrealDB: HTTP /rpc
sessionsmethod leaks attached session UUIDs, enabling full session hijack by anonymous callerscrates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63757 · GHSA-5qfp-32cf-69jh · amended
- High, CVSS 7.5
sigstore's
certificateOIDsverification constraints are silently dropped and never enforcednpm sigstore · Upgrade to 4.1.1 or later · <= 4.1.0 · CVE-2026-48815 · GHSA-52v5-jr5w-gjxr · amended
- High, CVSS 8.8
repomix Vulnerable to Command Injection (RCE) via
--remote-branchArgument Injectionnpm repomix · Upgrade to 1.14.1 or later · < 1.14.1 · CVE-2026-49987 · GHSA-9mm9-rqhj-j5mx · amended
- High, CVSS 8.7
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached
TemplatePackagist twig/twig · Upgrade to 3.27.0 or later · <= 3.26.0 · CVE-2026-49981 · GHSA-529h-vh3j-85hq
- High, CVSS 7.1
Cortex has Untrusted Project Bootstrap Code Execution via
CLAUDE_PROJECT_DIRPyPI neuro-cortex-memory · Upgrade to 3.18.0 or later · <= 3.17.0 · CVE-2026-49986 · GHSA-gvpp-v77h-5w8g · amended
- High, CVSS 7.5
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Maven org.apache.httpcomponents.core5:httpcore5-h2 · Upgrade to 5.5-beta2 (pre-release) or 5.4.3 by release line · < 5.4.3; >= 5.5-alpha1, < 5.5-beta2 · CVE-2026-54428 · GHSA-v3jc-474w-2wm6
- High, CVSS 7.5
Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service
Maven org.apache.httpcomponents.core5:httpcore5 · Upgrade to 5.5-beta2 (pre-release) or 5.4.3 by release line · < 5.4.3; >= 5.5-alpha1, < 5.5-beta2 · CVE-2026-54399 · GHSA-hf6x-8p5f-cgmf
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.