Medium, CVSS 4.4
django CMS: Stored XSS in edit-mode plugin exception rendering
PyPI django-cms · Upgrade to 5.0.9 or later · >= 5.0.8, < 5.0.9 · CVE-2026-75526 · GHSA-hvq6-2r72-p2x7
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 63 matching · newest first
- Medium, CVSS 6.5
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
Packagist backpack/crud · Upgrade to 7.0.47 or 6.8.15 by release line · >= 7.0.0, < 7.0.47; >= 6.0.0, < 6.8.15 · CVE-2026-57570 · GHSA-42vx-43vc-x6pr · amended
- Medium, CVSS 4.3
Wagtail: Improper restriction handling on Pages admin API
PyPI wagtail · Upgrade to 8.0rc2 (pre-release), 7.4.3, 7.3.4 or 7.0.9 by release line · < 7.0.9; >= 7.1, < 7.3.4; >= 7.4, < 7.4.3; >= 8.0rc1, <= 8.0rc1 · CVE-2026-55468 · GHSA-3vrh-m9w7-v94f
- Unrated
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
npm @nocobase/server · Upgrade to 2.1.5 or later · < 2.1.5 · GHSA-ghvf-qf6h-g8x5
- Medium, CVSS 6.5
django CMS: Structure endpoint bypasses page-view permission
PyPI django-cms · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-54624 · GHSA-vgxm-h9gx-h9w7
- Medium, CVSS 6.5
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
PyPI django-cms · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-54622 · GHSA-4xfr-4p46-gc6p
- Medium, CVSS 5.4
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-54256 · GHSA-3277-h8g9-qj5f · amended
- High, CVSS 8.7
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
Maven io.netty.incubator:netty-incubator-codec-ohttp · Upgrade to 0.0.23.Final or later · < 0.0.23.Final · CVE-2026-54251 · GHSA-vmr9-j6wf-pmh2 · amended
- High, CVSS 7.6
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Go github.com/fleetdm/fleet +1 · Upgrade all 2 to 4.86.2 or later · < 4.86.2 · CVE-2026-54245 · GHSA-7q96-f8xw-jv5j · amended
- High, CVSS 8.1
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Packagist backpack/crud · Upgrade to 7.0.36, 6.8.13, 5.6.2 or 4.1.72 by release line · >= 4.1.0, < 4.1.72; >= 5.0.0, < 5.6.2; >= 6.0.0, < 6.8.13; >= 7.0.0, < 7.0.36 · CVE-2026-54182 · GHSA-mrc5-3mm3-45c5 · amended
- Medium, CVSS 5.4
Laravel Backpack CRUD: Stored XSS in the color column — the
@if($column['escaped'])branches are invertedPackagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54181 · GHSA-mmg4-322v-6jvc · amended
- High, CVSS 7.6
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Packagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54180 · GHSA-vgmv-8xjc-6rch · amended
- Medium, CVSS 4.4
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a
data:imageprefix — SVG-with-script lands on the public diskPackagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54179 · GHSA-8hw4-7qjr-3wxg · amended
- High, CVSS 8.1
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_ [] in HasUploadFields::uploadMultipleFilesToDisk
Packagist backpack/crud · Partial vendor fix · >= 5.0.0; >= 6.0.0, < 6.8.12; >= 7.0.0, < 7.0.35 · CVE-2026-54178 · GHSA-8xjm-wqrp-2f25
- Medium, CVSS 6.6
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of
shell.phpreach the webserverPackagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54177 · GHSA-8q2w-pv9p-mjvc · amended
- Medium, CVSS 6.5
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
Packagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54176 · GHSA-9fw9-8c49-qch8 · amended
- High, CVSS 7.6
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
Packagist backpack/crud · Upgrade to 7.0.34 or 6.8.11 by release line · < 6.8.11; >= 7.0.0-alpha.1, < 7.0.34 · CVE-2026-54175 · GHSA-xpv2-hrfc-hw62 · amended
- Critical, CVSS 9.3
Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication
npm @whyour/qinglong · Upgrade to 2.20.1 or later · < 2.20.1 · CVE-2026-55445 · GHSA-v667-gc2r-2xm7 · amended
- Medium, CVSS 6.5
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Go github.com/openshift-pipelines/pipelines-as-code · Upgrade to 0.48.0, 0.42.1, 0.39.6 or 0.37.8 by release line · < 0.37.8; >= 0.38.0, < 0.39.6; >= 0.40.0, < 0.42.1; >= 0.43.0, < 0.48.0 · CVE-2026-54168 · GHSA-6f2p-296r-cc28 · amended
- High, CVSS 8.2
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Go github.com/openshift-pipelines/pipelines-as-code · Upgrade to 0.48.0, 0.42.1, 0.39.6 or 0.37.8 by release line · >= 0.43.0, < 0.48.0; >= 0.40.0, < 0.42.1; >= 0.38.0, < 0.39.6; < 0.37.8 · CVE-2026-54167 · GHSA-f5f4-3hh4-f54m · amended
- Low, CVSS 2.6
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers
Go github.com/opentofu/opentofu · Upgrade to 1.12.2 or 1.11.9 by release line · >= 1.12.0-beta1, < 1.12.2; < 1.11.9 · GHSA-22w5-2fxg-vrwx · amended
- Medium, CVSS 4.7
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI
Go github.com/alexandre-daubois/ember · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-54162 · GHSA-x3g7-qrwc-f6c5 · amended
- High, CVSS 7.5
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
npm node-opcua · Upgrade to 2.166.0 or later · < 2.166.0 · CVE-2026-54156 · GHSA-6wvw-vrw4-363w
- Medium, CVSS 6.9
next-video: Unauthenticated arbitrary file read via /api/video request handler
npm next-video · Upgrade to 2.8.1 or later · <= 2.8.0 · CVE-2026-54150 · GHSA-2p39-2jf3-fv2q · amended
- Medium, CVSS 6.9
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
PyPI zoo-kcl · Upgrade to 0.3.153 or later · < 0.3.153 · +1 more package · GHSA-mc9m-6fm9-pghc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.