High, CVSS 7.5
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-24451 · GHSA-wrf9-r3h7-7x5v · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.1
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale
officialApproval FlagGo code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58439 · GHSA-w5pg-649r-p6gg · amended
- Critical, CVSS 9.6
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · >= 1.22.0, < 1.26.2 · CVE-2026-58426 · GHSA-hg5r-vq93-9fv6 · amended
- High, CVSS 7.5
Gitea: Unauthorized Access to Labels of Private Organizations
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-25038 · GHSA-v73x-hx65-6pf4 · amended
- High, CVSS 7.5
Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
Go code.gitea.io/gitea · Upgrade to 1.26.4 or later · <= 1.26.2 · CVE-2026-58421 · GHSA-v96j-25gv-g2w9 · amended
- High, CVSS 8.8
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
Go github.com/ollama/ollama · Upgrade to 0.17.1 or later · < 0.17.1 · CVE-2026-7482 · GHSA-x8qc-fggm-mpqg · amended
- High, CVSS 8.7
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Go github.com/aquasecurity/trivy · Upgrade to 0.71.0 or later · < 0.71.0 · CVE-2026-54448 · GHSA-q3fv-x8vg-qqm4 · amended
- High, CVSS 7.5
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.0 or later · < 2.11.0 · CVE-2026-54063 · GHSA-h69g-9hx6-f3v4 · amended
- High, CVSS 8.8
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
Go google.golang.org/grpc · Upgrade to 1.82.1 or later · < 1.82.1 · GHSA-hrxh-6v49-42gf · amended
- High, CVSS 7.5
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability
PyPI thrift · Upgrade to 0.24.0 or later · < 0.24.0 · CVE-2026-41608 · GHSA-6pjx-3pjc-mrj8
- High, CVSS 8.7
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
PyPI thrift +3 · Upgrade all 4 to 0.24.0 or later · < 0.24.0 · CVE-2026-43871 · GHSA-8wv5-x4w7-5gww · amended
A vendor fix does not resolve your finding until you verify it in your own systems.