Medium, CVSS 5.5
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
PyPI linuxfabrik-lib · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-73974 · GHSA-rh9c-rqvg-f7pr
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 81 matching · newest first
- High, CVSS 7.1
moby/go-archive: Crafted tar archive can write outside the extraction directory
Go github.com/moby/go-archive · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-17106 · GHSA-hfg8-hc9c-6c3h · amended
- High, CVSS 8.1
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Packagist librenms/librenms · Upgrade to 26.7.0 or later · < 26.7.0 · CVE-2026-84189 · GHSA-7gww-x7fh-jf9j · amended
- Medium, CVSS 4.8
LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users
Packagist librenms/librenms · Upgrade to 26.7.0 or later · < 26.7.0 · CVE-2026-84188 · GHSA-7cj5-v4pp-v632 · amended
- Medium, CVSS 6.4
LibreNMS Vulnerable to Remote Code Execution via AboutController
Packagist librenms/librenms · Upgrade to 26.5.0 or later · < 26.5.0 · CVE-2026-84190 · GHSA-jf24-8g2h-2wg7 · amended
- High, CVSS 7.3
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
PyPI lemur · Upgrade to 1.9.3 or later · <= 1.9.2 · CVE-2026-71417 · GHSA-pxmc-2ffp-8j67
- Medium, CVSS 4.3
Lemur: Missing authorization check on POST /certificates/ /export for plugins with requires_key = False
PyPI lemur · Upgrade to 1.9.3 or later · < 1.9.3 · CVE-2026-71322 · GHSA-4h97-p9wq-chqj
- Medium, CVSS 6.5
Lemur: Sub-CA creation never checks
AuthorityPermissionon the parent authorityPyPI lemur · Upgrade to 1.9.3 or later · <= 1.9.2 · CVE-2026-71317 · GHSA-g7p5-89mh-248h
- High, CVSS 8.1
Lemur: Unchecked
replaces[]lets any user silence notifications and hijack auto-rotation for arbitrary certificatesPyPI lemur · Upgrade to 1.9.3 or later · >= 0.5.0, <= 1.9.2 · CVE-2026-71308 · GHSA-cfh6-pv5c-38jv
- High, CVSS 7.7
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
PyPI lemur · Upgrade to 1.9.3 or later · < 1.9.3 · CVE-2026-71307 · GHSA-6c8m-q6g9-vrw3
- High, CVSS 7.7
Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace
acme_urlwith internal IP, bypassing allowlistPyPI lemur · Upgrade to 1.9.3 or later · <= 1.9.2 · CVE-2026-71303 · GHSA-v5rc-cpwc-cfpr
- Medium, CVSS 6.3
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
PyPI lemur · Upgrade to 1.9.3 or later · < 1.9.3 · CVE-2026-70667 · GHSA-f3qq-49m6-rw8f
- High, CVSS 7.4
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
PyPI lemur · Upgrade to 1.9.3 or later · <= 1.9.2 · CVE-2026-70666 · GHSA-xpmj-wjcp-6pww
- Critical, CVSS 9.0
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
Packagist froxlor/froxlor · Upgrade to 2.3.8 or later · < 2.3.8 · CVE-2026-62988 · GHSA-7788-ghfq-c6mh · amended
- Medium, CVSS 6.5
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
Packagist froxlor/froxlor · Upgrade to 2.3.8 or later · <= 2.3.7 · CVE-2026-55593 · GHSA-xpr4-8vp6-c87j · amended
- Medium, CVSS 5.4
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
Packagist froxlor/froxlor · Upgrade to 2.3.8 or later · <= 2.3.7 · CVE-2026-54543 · GHSA-5rw4-4665-cvwf · amended
- High, CVSS 7.2
Froxlor: Second-Order SQL Injection via
Admins.addipaddressParameter Allows Full Database ExfiltrationPackagist froxlor/froxlor · Upgrade to 2.3.8 or later · < 2.3.8 · CVE-2026-54348 · GHSA-w27m-rmmf-g5w4 · amended
- High, CVSS 8.7
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
Packagist froxlor/froxlor · Upgrade to 2.3.8 or later · <= 2.3.7 · CVE-2026-54347 · GHSA-43gm-9rr3-cx7g · amended
- Medium, CVSS 6.5
devpi-server may leak database contents
PyPI devpi-server · Upgrade to 6.20.2 or later · < 6.20.2 · CVE-2026-54723 · GHSA-m5pq-69xg-vcq3
- High, CVSS 8.7
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Packagist mineadmin/mineadmin · Upgrade to 3.2.0-alpha.2 (pre-release) or later · < 3.2.0-alpha.2 · CVE-2026-55224 · GHSA-59xm-4m8c-g3xj · amended
- High, CVSS 7.8
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
PyPI monai · Upgrade to 1.6.0 or later · < 1.6.0 · GHSA-wg9g-w2j2-8pgr
- High, CVSS 8.6
MONAI vulnerable to OS command injection
PyPI monai · Upgrade to 1.6.0 or later · < 1.6.0 · GHSA-rghg-q7wp-9767
- High, CVSS 7.8
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
PyPI monai · Upgrade to 1.6.0 or later · < 1.6.0 · GHSA-qxq5-qhx6-94qw
- Medium, CVSS 6.9
Triton VM Soundness Vulnerability due to Missing Constraint
crates.io triton-vm · Upgrade to 4.0.0 or later · >= 0.42.0-alpha.4, < 4.0.0 · GHSA-vjf8-9fx6-mv6x · amended
- Critical, CVSS 9.8
jmespath.php has CompilerRuntime code injection via unescaped function names
Packagist mtdowling/jmespath.php · Upgrade to 2.9.1 or later · < 2.9.1 · CVE-2026-54133 · GHSA-pcw8-m77r-2528 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.