High, CVSS 8.0
laravel-backup-restore has an OS Command Injection during database restore
Packagist wnx/laravel-backup-restore · Upgrade to 1.9.4 or later · <= 1.9.3 · CVE-2026-53932 · GHSA-w9mx-xmg4-gc4r
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–39 of 39 matching · newest first
- Medium, CVSS 4.9
nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.3.7 or later · < 0.3.7 · CVE-2026-53602 · GHSA-339v-266x-79xr
- High, CVSS 8.6
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
Packagist craftcms/cms · Upgrade to 5.9.14 or later · >= 5.5.0, <= 5.9.13 · CVE-2026-56382 · GHSA-86vw-x4ww-x467
- Low, CVSS 2.0
Craft CMS has authenticated path traversal in
assets/icon, allowing local.svgfile readPackagist craftcms/cms · Upgrade to 5.9.13 or 4.17.7 by release line · >= 4.0.0-RC1, <= 4.17.6; >= 5.0.0-RC1, <= 5.9.12 · CVE-2026-56394 · GHSA-c43v-4cr8-6mvp
- High, CVSS 8.9
Ruby CSS Parser: SSRF and Local File Disclosure in
CssParser::Parser#read_remote_fileRubyGems css_parser · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2026-53727 · GHSA-9pmc-p236-855h
- High, CVSS 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +7 · Upgrade all 8 to 6.9.9 or 6.9.4.2 by release line · >= 6.9.5, < 6.9.9; < 6.9.4.2 · CVE-2026-49485 · GHSA-7cmj-v6x8-frvv
- Medium, CVSS 5.1
pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
PyPI pymonocypher · Upgrade to 4.0.2.8 or later · < 4.0.2.8 · CVE-2026-53720 · GHSA-8f95-v3jq-cj86 · amended
- High, CVSS 8.6
Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260601210719-67b7de04308a (pre-release) or later · < 0.0.0-20260601210719-67b7de04308a · CVE-2026-50553 · GHSA-rqrh-8wpv-x7hh
- Medium, CVSS 5.3
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260601210758-9c9b72740f22 (pre-release) or later · < 0.0.0-20260601210758-9c9b72740f22 · CVE-2026-50554 · GHSA-588f-fvcv-xhvf
- High, CVSS 7.5
Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
PyPI soupsieve · Upgrade to 2.8.4 or later · <= 2.8.3 · CVE-2026-49477 · GHSA-836r-79rf-4m37 · amended
- High, CVSS 7.5
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
PyPI soupsieve · Upgrade to 2.8.4 or later · <= 2.8.3 · CVE-2026-49476 · GHSA-2wc2-fm75-p42x · amended
- High, CVSS 7.7
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
PyPI phantom-audio · Upgrade to 1.3.1 or later · <= 1.3.0 · GHSA-52vm-mxx8-f227 · amended
- Medium, CVSS 6.8
Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers
Maven io.micronaut:micronaut-http-client · Upgrade to 5.0.1, 4.10.24 or 3.10.6 by release line · >= 1.2.8, < 3.10.6; >= 4.0.0-M1, < 4.10.24; >= 5.0.0-M1, < 5.0.1 · GHSA-q6gh-6v2r-hjv3
- High, CVSS 7.5
Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
Maven io.micronaut:micronaut-http-client · Upgrade to 5.0.1, 4.10.24 or 3.10.7 by release line · < 3.10.7; >= 4.0.0-M1, < 4.10.24; >= 5.0.0-M1, < 5.0.1 · GHSA-387m-935m-c4vw
A vendor fix does not resolve your finding until you verify it in your own systems.