High, CVSS 7.7
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
Go github.com/zhenorzz/goploy · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-53553 · GHSA-4g5x-hcwm-82jw · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.6
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
Go github.com/zhenorzz/goploy · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-53552 · GHSA-26rh-24rg-j3vv · amended
- High, CVSS 8.7
ratex-parser panics on
\verbwith a multibyte delimiter (UTF-8 byte-boundary slice)crates.io ratex-parser · Upgrade to 0.1.11 or later · < 0.1.11 · CVE-2026-53530 · GHSA-4hgp-59h5-gvrj
- Critical, CVSS 9.3
Cognee allows non-superusers to overwrite global LLM configuration
PyPI cognee · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-58473 · GHSA-49f7-whx5-4256 · amended
- High, CVSS 8.3
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
npm @better-auth/scim · Upgrade to 1.7.0-beta.4 (pre-release) or later · >= 1.5.0, < 1.7.0-beta.4 · CVE-2026-67331 · GHSA-j8v8-g9cx-5qf4 · amended
- High, CVSS 7.6
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
npm @better-auth/oauth-provider +1 · Upgrade all 2 to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-53518 · GHSA-7w99-5wm4-3g79 · amended
- Critical, CVSS 9.6
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
npm @better-auth/sso · Upgrade to 1.6.11 or later · >= 0.1.0, < 1.6.11 · CVE-2026-53513 · GHSA-5rr4-8452-hf4v · amended
- High, CVSS 7.6
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
npm better-auth · Upgrade to 1.6.0 or later · >= 1.4.8-beta.7, < 1.6.0 · +1 more package · CVE-2026-53517 · GHSA-392p-2q2v-4372 · amended
- High, CVSS 8.7
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-67336 · GHSA-9h47-pqcx-hjr4 · amended
- High, CVSS 7.7
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
npm better-auth · Upgrade to 1.7.0-beta.4 (pre-release) or 1.6.13 by release line · < 1.6.13; >= 1.7.0-beta.0, < 1.7.0-beta.4 · CVE-2026-67333 · GHSA-86j7-9j95-vpqj · amended
- High, CVSS 8.3
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53516 · GHSA-g38m-r43w-p2q7 · amended
- High, CVSS 7.7
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53514 · GHSA-fmh4-wcc4-5jm3 · amended
- Critical, CVSS 9.1
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53512 · GHSA-pw9m-5jxm-xr6h · amended
- High, CVSS 7.0
uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)
crates.io uucore · Upgrade to 0.6.0 or later · < 0.6.0 · GHSA-fqf6-gxhh-2xhw
- High, CVSS 7.3
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
PyPI open-webui · Upgrade to 0.6.44 or later · <= 0.6.43 · CVE-2026-26193 · GHSA-vjm7-m4xh-7wrc · amended
- High, CVSS 7.3
Open WebUI vulnerable to Stored XSS via iFrame in citations model
PyPI open-webui · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-26192 · GHSA-xc8p-9rr6-97r2 · amended
- High, CVSS 7.4
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
PyPI open-webui · Upgrade to 0.6.6 or later · < 0.6.6 · CVE-2025-46719 · GHSA-9f4f-jv96-8766 · amended
- High, CVSS 8.1
ExecuTorch vulnerable to Heap-based Buffer Overflow attack
PyPI executorch · Upgrade to 0.7.0 or later · <= 0.6.0 · +1 more package · CVE-2025-30402 · GHSA-h952-963h-rv99 · amended
- High, CVSS 8.2
XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 18.2.0 or 17.10.5 by release line · < 17.10.5; >= 18.0.0-rc-1, < 18.2.0 · CVE-2026-34151 · GHSA-qj4x-9g63-25g6
- High, CVSS 7.7
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
Go github.com/QuantumNous/new-api · Upgrade to 0.12.0-alpha.1 (pre-release) or later · < 0.12.0-alpha.1 · CVE-2026-33655 · GHSA-6qcr-qxgr-m7fv
- Critical, CVSS 9.3
EGroupware has a Remote Code Execution Vulnerability
Packagist egroupware/egroupware · Upgrade to 26.2.20260224 or 23.1.20260224 by release line · >= 26.0.20251208, < 26.2.20260224; < 23.1.20260224 · CVE-2026-27823 · GHSA-h9qx-v5xp-ph8p
- Critical, CVSS 9.8
Apache Airflow allows code execution through unsafe serialized DAG deserialization
PyPI apache-airflow · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-33264 · GHSA-2943-9672-r45w · amended
A vendor fix does not resolve your finding until you verify it in your own systems.