High, CVSS 8.3
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · < 1.2.14 · CVE-2026-125337 · GHSA-fm29-4mq3-phg6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.4
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
Packagist winter/wn-system-module · Upgrade to 1.2.13 or later · >= 1.2.7, < 1.2.13 · CVE-2026-79774 · GHSA-8cfw-pcwh-v63w · amended
- High, CVSS 7.5
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63202 · GHSA-4899-mpch-38p3 · amended
- High, CVSS 8.7
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61827 · GHSA-hmq9-67w8-j5pw · amended
- High, CVSS 7.5
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63124 · GHSA-8cfx-wx3q-mh5q · amended
- High, CVSS 8.1
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Maven io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61798 · GHSA-2mc4-j865-9q4r · amended
- High, CVSS 8.7
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
Maven io.netty.incubator:netty-incubator-codec-ohttp · Upgrade to 0.0.23.Final or later · < 0.0.23.Final · CVE-2026-54251 · GHSA-vmr9-j6wf-pmh2 · amended
- High, CVSS 7.6
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Go github.com/fleetdm/fleet +1 · Upgrade all 2 to 4.86.2 or later · < 4.86.2 · CVE-2026-54245 · GHSA-7q96-f8xw-jv5j · amended
- High, CVSS 8.1
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Packagist backpack/crud · Upgrade to 7.0.36, 6.8.13, 5.6.2 or 4.1.72 by release line · >= 4.1.0, < 4.1.72; >= 5.0.0, < 5.6.2; >= 6.0.0, < 6.8.13; >= 7.0.0, < 7.0.36 · CVE-2026-54182 · GHSA-mrc5-3mm3-45c5 · amended
- High, CVSS 7.6
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Packagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54180 · GHSA-vgmv-8xjc-6rch · amended
- High, CVSS 8.1
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_ [] in HasUploadFields::uploadMultipleFilesToDisk
Packagist backpack/crud · Partial vendor fix · >= 5.0.0; >= 6.0.0, < 6.8.12; >= 7.0.0, < 7.0.35 · CVE-2026-54178 · GHSA-8xjm-wqrp-2f25
- High, CVSS 7.6
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
Packagist backpack/crud · Upgrade to 7.0.34 or 6.8.11 by release line · < 6.8.11; >= 7.0.0-alpha.1, < 7.0.34 · CVE-2026-54175 · GHSA-xpv2-hrfc-hw62 · amended
- Critical, CVSS 9.3
Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication
npm @whyour/qinglong · Upgrade to 2.20.1 or later · < 2.20.1 · CVE-2026-55445 · GHSA-v667-gc2r-2xm7 · amended
- High, CVSS 8.2
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Go github.com/openshift-pipelines/pipelines-as-code · Upgrade to 0.48.0, 0.42.1, 0.39.6 or 0.37.8 by release line · >= 0.43.0, < 0.48.0; >= 0.40.0, < 0.42.1; >= 0.38.0, < 0.39.6; < 0.37.8 · CVE-2026-54167 · GHSA-f5f4-3hh4-f54m · amended
- High, CVSS 7.5
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
npm node-opcua · Upgrade to 2.166.0 or later · < 2.166.0 · CVE-2026-54156 · GHSA-6wvw-vrw4-363w
- High, CVSS 8.7
jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations
Maven org.jsoup:jsoup · Upgrade to 1.23.2 or later · < 1.23.2 · CVE-2026-75140 · GHSA-65r4-943x-97jj · amended
- High, CVSS 7.7
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
PyPI langgraph-store-mongodb · Upgrade to 0.4.0 or later · < 0.4.0 · +1 more package · CVE-2026-55253 · GHSA-533j-2v4q-mw5h
- High, CVSS 7.5
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
Go github.com/vouch/vouch-proxy · Upgrade to 0.48.0 or later · <= 0.47.2 · CVE-2026-55149 · GHSA-qqff-5854-px68 · amended
- High, CVSS 8.8
Filesystem sandbox escape when paths or symlinks contain trailing slashes
crates.io wasmtime · Upgrade to 47.0.4, 46.0.3, 36.0.14 or 24.0.13 by release line · >= 0.0.0-0, < 24.0.13; >= 25.0.0, < 36.0.14; >= 37.0.0, < 46.0.3; >= 47.0.0, < 47.0.4 · CVE-2026-115392 · GHSA-vqjp-4c8c-hfgg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.