Medium, CVSS 5.3
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
Packagist kimai/kimai · Upgrade to 2.57.0 or later · <= 2.56.0 · CVE-2026-52820 · GHSA-vrr2-g9gh-c3jc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 28 matching · newest first
- Medium, CVSS 6.3
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
Packagist kimai/kimai · Upgrade to 2.57.0 or later · <= 2.56.0 · CVE-2026-52819 · GHSA-4m8q-55qv-9pwp
- Medium, CVSS 6.3
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-49992 · GHSA-pgcc-vfmc-7cw5
- Medium, CVSS 6.9
Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks
PyPI app-store-server-library · Upgrade to 3.1.2 or later · >= 0.2.0, <= 3.1.1 · GHSA-8f6j-263m-g72x · amended
- High, CVSS 7.5
json_repair: Circular JSON Schema
$refcauses unbounded CPU DoSPyPI json-repair · Upgrade to 0.60.1 or later · < 0.60.1 · GHSA-xf7x-x43h-rpqh · amended
- Critical, CVSS 9.3
FacturaScripts: Account takeover of any 2FA-enabled user
Packagist facturascripts/facturascripts · Upgrade to 2026.3 or later · <= 2026.2 · CVE-2026-47677 · GHSA-c67f-gmxw-mj93
- High, CVSS 8.7
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
Packagist plank/laravel-mediable · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-49970 · GHSA-xv8g-76mx-2rxc
- High, CVSS 8.5
DIRAC: SQL injection and lack of access control in PilotManager service
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · GHSA-7xw9-549r-8jrc · amended
- High, CVSS 8.1
DIRAC: Pilot code downloaded over unverified HTTPS connection
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6.20.1, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · CVE-2026-61668 · GHSA-vg99-gr89-qhw9 · amended
- Critical, CVSS 9.9
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · CVE-2026-61667 · GHSA-m4m7-4cw8-62j6 · amended
- High, CVSS 7.2
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
Packagist nukeviet/nukeviet · Upgrade to 4.6.00 or later · < 4.6.00 · CVE-2026-55372 · GHSA-4chg-4752-w88r
- High, CVSS 8.7
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
Packagist nukeviet/nukeviet · Upgrade to 4.6.00 or later · < 4.6.00 · CVE-2026-54065 · GHSA-c9xg-64p9-f2jj
- High, CVSS 8.7
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
Packagist nukeviet/nukeviet · Upgrade to 4.6.00 or later · < 4.6.00 · CVE-2026-54064 · GHSA-465g-4q99-5x86
- Critical, CVSS 9.9
DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · CVE-2026-45579 · GHSA-9jpv-c7p4-997x · amended
- Medium, CVSS 6.4
Decidim: Push subscriptions can be abused for server-side requests
RubyGems decidim-core · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45573 · GHSA-2g9c-vf8h-prxx
- Medium, CVSS 4.8
Decidim: HTML content blocks allow stored script execution
RubyGems decidim-core · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45572 · GHSA-533c-2vh9-4r86
- Medium, CVSS 6.0
Decidim: CSV census record endpoints improper authorization
RubyGems decidim-verifications · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45415 · GHSA-q79h-67vx-m9xg
- High, CVSS 8.5
Decidim: JWT-backed authentication can be replayed across organizations
RubyGems decidim · Upgrade to 0.32.0 or 0.31.5 by release line · < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45414 · GHSA-r3v7-5x4c-c69q
- High, CVSS 7.5
Decidim: Verification documents can be downloaded through reusable links
RubyGems decidim-verifications · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45378 · GHSA-3mvf-82qp-8qh5
- Medium, CVSS 6.5
Decidim: Private exports can be downloaded through reusable links
RubyGems decidim-core · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45377 · GHSA-767h-63j4-5226
- Medium, CVSS 6.8
Decidim: Admin user search allows SQL injection through similarity-based sorting
RubyGems decidim-admin · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45376 · GHSA-jvqq-cvh4-xm37
- Medium, CVSS 4.9
Decidim: Verification admins can access supplied IDs from other organizations
RubyGems decidim-verifications · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45330 · GHSA-86fh-w43w-338c
- Medium, CVSS 5.4
Decidim: Forms admin question editor lacks authorization
RubyGems decidim-demographics · Upgrade to 0.32.0 or 0.31.5 by release line · >= 0.31.0, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45086 · GHSA-vq6j-hj8w-7v39
- Medium, CVSS 6.1
GeoNode: Stored XSS to full account takeover
PyPI geonode · Upgrade to 4.2.3 or later · >= 3.2.1, < 4.2.3 · CVE-2024-27091 · GHSA-rwcv-whm8-fmxm · amended
- Medium, CVSS 6.8
Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()
PyPI jupyter-server · Upgrade to 2.18.2 or later · < 2.18.2 · CVE-2026-5422 · GHSA-gf7q-q4j7-hp7c
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.