High, CVSS 8.7
Mistune: Potential DoS via quadratic-time parsing in parse_link_text
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-49851 · GHSA-qcq2-496w-v96p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 39 matching · newest first
- Medium, CVSS 5.9
GoBGP confederation validation panics on empty AS_PATH attribute
Go github.com/osrg/gobgp/v4 · Upgrade to 4.7.0 or later · <= 4.6.0 · CVE-2026-49838 · GHSA-frrj-87jh-2772
- Medium, CVSS 5.9
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
Go github.com/osrg/gobgp/v4 · Upgrade to 4.6.0 or later · <= 4.5.0 · CVE-2026-49837 · GHSA-gjrg-jjr3-56cm
- Medium, CVSS 4.6
psd-tools vulnerable to arbitrary file write via smart-object filename
PyPI psd-tools · Upgrade to 1.17.1 or later · <= 1.17.0 · CVE-2026-49836 · GHSA-2rmg-vrx8-9j2f · amended
- Medium, CVSS 5.9
sigstore-go has a multi-log threshold bypass via single compromised log
Go github.com/sigstore/sigstore-go · Upgrade to 1.2.0 or later · <= 1.1.4 · CVE-2026-49834 · GHSA-9vcr-p3rj-q5q6
- Medium, CVSS 5.4
Rattler vulnerable to package cache path traversal via conda package build string
PyPI py-rattler · Upgrade to 0.24.0 or later · <= 0.23.2 · +1 more package · CVE-2026-53956 · GHSA-h672-p7h7-97v9 · amended
- Medium, CVSS 5.1
OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect
Go github.com/openrundev/openrun · Upgrade to 0.17.7 or later · < 0.17.7 · CVE-2026-55252 · GHSA-h5g6-xmh4-hc37
- Medium, CVSS 6.9
pypdf: Possible infinite loop when processing threads/articles in writer
PyPI pypdf · Upgrade to 6.13.1 or later · < 6.13.1 · CVE-2026-54651 · GHSA-g9xf-7f8q-9mcj · amended
- Medium, CVSS 6.3
Sylius: IDOR on Shop Payment Request API endpoints
Packagist sylius/sylius · Upgrade to 2.2.6, 2.1.15 or 2.0.18 by release line · >= 2.0.0, < 2.0.18; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.6 · CVE-2026-53639 · GHSA-mr9r-h354-966r
- Medium, CVSS 4.3
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Packagist sylius/sylius · Upgrade to 2.2.6, 2.1.15 or 2.0.18 by release line · >= 2.0.0, < 2.0.18; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.6 · CVE-2026-53638 · GHSA-6955-hrm5-c4qp
- Medium, CVSS 6.5
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Packagist sylius/sylius · Upgrade to 2.2.6, 2.1.15 or 2.0.18 by release line · >= 2.0.0, < 2.0.18; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.6 · CVE-2026-53637 · GHSA-5597-7rmh-97q5
- Critical, CVSS 9.8
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52778 · GHSA-px5m-h76g-p7p8
- Critical, CVSS 9.4
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52777 · GHSA-9369-69wj-7m2f
- High, CVSS 8.8
YesWiki has Authenticated SQL Injection via ReactionManager
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52775 · GHSA-4pf7-cc4r-g63h
- Medium, CVSS 6.1
YesWiki Vulnerable to Reflected XSS via Unescaped
idParameter in Bazar Widget HTML AttributesPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52774 · GHSA-r5xw-gcgw-hwp5
- Medium, CVSS 6.1
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision
timeParameter inhandlers/page/show.phpPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · >= 4.1.0, < 4.6.6 · CVE-2026-52773 · GHSA-35f3-pg38-486f
- Medium, CVSS 5.5
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52772 · GHSA-xc7j-3g8q-9vh4
- High, CVSS 8.3
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (
ApiController::deletePage)Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · >= 4.2.0, < 4.6.6 · CVE-2026-52771 · GHSA-8f2v-2qhj-gfwg
- High, CVSS 7.5
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric
query/queriesfiltersPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52770 · GHSA-qg78-vmvc-fhjw
- High, CVSS 8.3
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub
Signature.keyIdPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · >= 4.6.2, < 4.6.6 · CVE-2026-52769 · GHSA-vw42-752g-5mrp
- High, CVSS 8.2
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via
!openssl_verify(...)acceptingint(-1)Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · >= 4.6.2, < 4.6.6 · CVE-2026-52767 · GHSA-mv28-wj57-f57g
- Critical, CVSS 9.1
YesWiki vulnerable to unauthenticated arbitrary page deletion via
{{erasespamedcomments}}actionPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52766 · GHSA-6x7x-gcmf-7r8x
- Medium, CVSS 6.5
YesWiki: SQL injection via the
recentchangesactionperiodargument leads to arbitrary DB readPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52763 · GHSA-89v6-j5x6-cmj3
- High, CVSS 7.1
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52762 · GHSA-65p8-9433-jpcp
- Medium, CVSS 6.5
Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
RubyGems avo · Upgrade to 3.32.0 or later · >= 2.28.0, < 3.32.0 · CVE-2026-53769 · GHSA-pqpw-cvm4-8mv9
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.