Medium, CVSS 5.9
Weblate SSRF: outbound URL guard misses some private ranges
PyPI weblate · Upgrade to 2026.6 or later · >= 5.15, < 2026.6 · CVE-2026-50127 · GHSA-vmfc-9982-2m45 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 50 matching · newest first
- Medium, CVSS 6.0
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
Go github.com/oasdiff/oasdiff · Upgrade to 1.18.1 or later · >= 1.13.2, <= 1.18.0 · CVE-2026-53508 · GHSA-2jcc-mxv7-p3f9
- Medium, CVSS 5.9
KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping
Go github.com/kedacore/keda/v2 · Upgrade to 2.20.0 or later · < 2.20.0 · CVE-2026-53572 · GHSA-6w3m-4hhp-775q
- High, CVSS 7.7
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
Go github.com/zhenorzz/goploy · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-53553 · GHSA-4g5x-hcwm-82jw · amended
- Critical, CVSS 9.6
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
Go github.com/zhenorzz/goploy · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-53552 · GHSA-26rh-24rg-j3vv · amended
- Medium, CVSS 6.5
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
PyPI ha-mcp · Upgrade to 7.10.0 or later · < 7.10.0 · GHSA-q855-8rh5-jfgq · amended
- Low, CVSS 3.7
rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path
crates.io rama · Upgrade to 0.3.0-rc.1 (pre-release) or later · < 0.3.0-rc.1 · GHSA-cwv4-h3j5-w3cf
- Medium, CVSS 6.9
aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address
PyPI aiosmtplib · Upgrade to 5.1.1 or later · <= 5.1.0 · CVE-2026-53533 · GHSA-v3q9-hj7j-63hq · amended
- Medium, CVSS 4.3
Kite has an authenticated cluster RBAC bypass in /api/v1/overview
Go github.com/zxh326/kite · Upgrade to 0.12.3 or later · <= 0.12.2 · CVE-2026-53487 · GHSA-gvhc-wv3v-7pf8
- Low, CVSS 2.9
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
Packagist web-auth/webauthn-lib · Upgrade to 5.3.5 or later · >= 4.9.0, < 5.3.5 · GHSA-gq4g-fpc9-vjfq
- Medium, CVSS 6.9
ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)
crates.io ratex-parser · Upgrade to 0.1.11 or later · < 0.1.11 · CVE-2026-53531 · GHSA-4w5h-hx6r-28q7
- High, CVSS 8.7
ratex-parser panics on
\verbwith a multibyte delimiter (UTF-8 byte-boundary slice)crates.io ratex-parser · Upgrade to 0.1.11 or later · < 0.1.11 · CVE-2026-53530 · GHSA-4hgp-59h5-gvrj
- Critical, CVSS 9.3
Cognee allows non-superusers to overwrite global LLM configuration
PyPI cognee · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-58473 · GHSA-49f7-whx5-4256 · amended
- High, CVSS 8.3
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
npm @better-auth/scim · Upgrade to 1.7.0-beta.4 (pre-release) or later · >= 1.5.0, < 1.7.0-beta.4 · CVE-2026-67331 · GHSA-j8v8-g9cx-5qf4 · amended
- Low, CVSS 3.8
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
npm @better-auth/scim +1 · Upgrade all 2 to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-67334 · GHSA-2vg6-77g8-24mp · amended
- High, CVSS 7.6
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
npm @better-auth/oauth-provider +1 · Upgrade all 2 to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-53518 · GHSA-7w99-5wm4-3g79 · amended
- Critical, CVSS 9.6
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
npm @better-auth/sso · Upgrade to 1.6.11 or later · >= 0.1.0, < 1.6.11 · CVE-2026-53513 · GHSA-5rr4-8452-hf4v · amended
- High, CVSS 7.6
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
npm better-auth · Upgrade to 1.6.0 or later · >= 1.4.8-beta.7, < 1.6.0 · +1 more package · CVE-2026-53517 · GHSA-392p-2q2v-4372 · amended
- High, CVSS 8.7
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-67336 · GHSA-9h47-pqcx-hjr4 · amended
- High, CVSS 7.7
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
npm better-auth · Upgrade to 1.7.0-beta.4 (pre-release) or 1.6.13 by release line · < 1.6.13; >= 1.7.0-beta.0, < 1.7.0-beta.4 · CVE-2026-67333 · GHSA-86j7-9j95-vpqj · amended
- High, CVSS 8.3
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53516 · GHSA-g38m-r43w-p2q7 · amended
- High, CVSS 7.7
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53514 · GHSA-fmh4-wcc4-5jm3 · amended
- Medium, CVSS 6.4
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
npm @better-auth/oauth-provider · Upgrade to 1.7.0-beta.4 (pre-release) or later · >= 1.4.8, < 1.7.0-beta.4 · CVE-2026-67332 · GHSA-p2fr-6hmx-4528 · amended
- Critical, CVSS 9.1
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53512 · GHSA-pw9m-5jxm-xr6h · amended
- Low, CVSS 2.3
netfoil: Attacker controlled data written to logs
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.3.0 or later · < 0.3.0 · GHSA-7856-g3gv-9wq8
A vendor fix does not resolve your finding until you verify it in your own systems.