High, CVSS 7.3
Wagtail: Reflected XSS in dynamic image URL generator view
PyPI wagtail · Upgrade to 7.4.2 or 7.3.3 by release line · >= 7.3, < 7.3.3; >= 7.4, < 7.4.2 · CVE-2026-54263 · GHSA-23m2-mghx-vqmf · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 86 matching · newest first
- Medium, CVSS 4.3
Wagtail: Pages translations can be created without page permissions when using simple_translation
PyPI wagtail · Upgrade to 7.4.2, 7.3.3 or 7.0.8 by release line · < 7.0.8; >= 7.1, < 7.3.3; >= 7.4, < 7.4.2 · CVE-2026-54262 · GHSA-8634-mr4j-r72c · amended
- Medium, CVSS 6.5
Wagtail: Improper permission handling in image preview
PyPI wagtail · Upgrade to 7.4.2, 7.3.3 or 7.0.8 by release line · < 7.0.8; >= 7.1, < 7.3.3; >= 7.4, < 7.4.2 · CVE-2026-54261 · GHSA-r6p4-grq7-xm4m · amended
- Medium, CVSS 4.3
Wagtail: Denial of service via unbounded filter specs in the image preview
PyPI wagtail · Upgrade to 7.4.2, 7.3.3 or 7.0.8 by release line · < 7.0.8; >= 7.1, < 7.3.3; >= 7.4, < 7.4.2 · CVE-2026-54260 · GHSA-f2p5-j6fg-5cxf · amended
- Medium, CVSS 4.3
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
PyPI wagtail · Upgrade to 7.4.2, 7.3.3 or 7.0.8 by release line · < 7.0.8; >= 7.1, < 7.3.3; >= 7.4, < 7.4.2 · CVE-2026-54259 · GHSA-h54r-xq46-qwqm · amended
- Medium, CVSS 6.5
OpenClaw MCP SSE redirects could forward Authorization headers
npm openclaw · Upgrade to 2026.6.5 or later · < 2026.6.5 · CVE-2026-62208 · GHSA-9c3v-684m-579c · amended
- High, CVSS 8.1
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
npm @apify/actors-mcp-server · Upgrade to 0.10.11 or later · < 0.10.11 · CVE-2026-50143 · GHSA-6gr2-qh89-hxwm · amended
- Medium, CVSS 5.9
goshs: Share-link ?token=… redemption races past download limit
Go goshs.de/goshs/v2 · Upgrade to 2.1.0 or later · <= 2.0.9 · CVE-2026-50139 · GHSA-j48m-h7xq-2xpj
- Critical, CVSS 9.6
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
npm ghost · Upgrade to 6.37.0 or later · >= 4.0.0, <= 6.36.0 · CVE-2026-53943 · GHSA-62q6-4hv4-vjrw · amended
- High, CVSS 8.1
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
Go goshs.de/goshs/v2 · Upgrade to 2.1.0 or later · <= 2.0.9 · CVE-2026-50138 · GHSA-3whc-qvhv-xqjp
- Medium, CVSS 6.9
ORAS Go forwards registry credentials across registry redirects
Go oras.land/oras-go/v2 · Upgrade to 2.6.1 or later · < 2.6.1 · GHSA-vh4v-2xq2-g5cg
- High, CVSS 8.2
OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms
Maven com.ongres.scram:scram-common +1 · Upgrade all 2 to 3.3 or later · <= 3.2 · CVE-2026-53712 · GHSA-p9jg-fcr6-3mhf
- High, CVSS 7.1
oras-gotar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionGo oras.land/oras-go/v2 · Upgrade to 2.6.2 or later · <= 2.6.1 · CVE-2026-50163 · GHSA-fxhp-mv3v-67qp
- Medium, CVSS 6.9
oras-go has file store write outside workingDir via symlink traversal
Go oras.land/oras-go/v2 · Upgrade to 2.6.1 or later · < 2.6.1 · CVE-2026-50162 · GHSA-8xwf-rjm4-xvhv
- High, CVSS 8.7
Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks
PyPI gradio · Upgrade to 6.16.0 or later · < 6.16.0 · CVE-2026-49119 · GHSA-j36p-7w88-g82j · amended
- High, CVSS 7.5
oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
Go oras.land/oras-go/v2 · Upgrade to 2.6.1 or later · < 2.6.1 · CVE-2026-50151 · GHSA-jxpm-75mh-9fp7
- High, CVSS 7.3
Keycloak has privilege escalation via improper scope mapping enforcement
Maven org.keycloak:keycloak-services · Upgrade to 26.6.4 or later · < 26.6.4 · CVE-2026-9795 · GHSA-32h4-44jj-c5vx
- Critical, CVSS 9.4
Rancher has Privilege Escalation from Project Owner to Host
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6, 2.12.10 or 0.0.0-20260513182521-2800aaac25b5 (pre-release) by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; < 0.0.0-20260513182521-2800aaac25b5 · CVE-2026-41052 · GHSA-vx8h-4prv-g744
- Medium, CVSS 5.3
Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)
Go github.com/axllent/mailpit · Upgrade to 1.30.1 or later · <= 1.30.0 · CVE-2026-48824 · GHSA-28pq-6qxg-wg5r
- Medium, CVSS 4.8
@hey-api/openapi-ts's
buildClientParamstemplate: prototype chain substitution via unknown$ ___proto__keynpm @hey-api/openapi-ts · Upgrade to 0.97.3 or later · < 0.97.3 · CVE-2026-48819 · GHSA-hhx9-57xq-r5rw · amended
- High, CVSS 8.8
Rancher has over-inclusive team membership expansion in GitHub App authentication provider
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6 or 0.0.0-20260519172014-d0c047bbc6d2 (pre-release) by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; < 0.0.0-20260519172014-d0c047bbc6d2 · CVE-2026-41053 · GHSA-4j6x-2764-m8gh
- Critical, CVSS 9.9
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated
valuesFromreferences in Helm DeployerGo github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44935 · GHSA-xr65-5cpm-g36x
- Medium, CVSS 5.0
Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44936 · GHSA-hx4v-cxpf-vh8m
- Critical, CVSS 9.4
Rancher vulnerable to command injection through unsanitized YAML parameter
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6, 2.12.10 or 3 more by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; >= 2.11.0, < 2.11.14; >= 2.10.0, < 2.10.12; < 0.0.0-20260617231817-2aa77eb283e7 · CVE-2026-44939 · GHSA-mhc6-2gfq-xx62
- High, CVSS 7.5
Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44937 · GHSA-jmf4-m7j9-g72r
A vendor fix does not resolve your finding until you verify it in your own systems.