Medium, CVSS 6.5
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Go github.com/axllent/mailpit · Upgrade to 1.30.6 or later · >= 1.29.0, <= 1.30.5 · CVE-2026-67448 · GHSA-8r62-w5wh-fc5m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 63 matching · newest first
- Medium, CVSS 5.3
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
Go github.com/axllent/mailpit · Upgrade to 1.30.5 or later · >= 1.30.0, < 1.30.5 · CVE-2026-67447 · GHSA-r553-m4fv-5v97 · amended
- Medium, CVSS 6.9
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
npm gettext-converter · Upgrade to 1.3.3 or later · < 1.3.3 · CVE-2026-55451 · GHSA-f4jp-rw7w-ccwg
- Medium, CVSS 6.5
Wagtail: Improper restriction handling on Page translation API endpoint
PyPI wagtail · Upgrade to 8.0rc2 (pre-release), 7.4.3, 7.3.4 or 7.0.9 by release line · < 7.0.9; >= 7.1rc1, < 7.3.4; >= 7.4rc1, < 7.4.3; >= 8.0rc1, < 8.0rc2 · CVE-2026-125106 · GHSA-jm5p-837g-rv8g · amended
- Medium, CVSS 6.5
Wagtail: Improper permission handling when copying snippets
PyPI wagtail · Upgrade to 8.0rc2 (pre-release), 7.4.3, 7.3.4 or 7.0.9 by release line · < 7.0.9; >= 7.1, < 7.3.4; >= 7.4, < 7.4.3; >= 8.0rc1, < 8.0rc2 · CVE-2026-123819 · GHSA-x5cx-w6p2-mxf2 · amended
- Medium, CVSS 5.3
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
PyPI wagtail · Upgrade to 8.0rc2 (pre-release), 7.4.3, 7.3.4 or 7.0.9 by release line · < 7.0.9; >= 7.1, < 7.3.4; >= 7.4, < 7.4.3; >= 8.0rc1, < 8.0rc2 · CVE-2026-123820 · GHSA-c2xx-cjmh-9q8f · amended
- Low, CVSS 3.7
Wagtail: Identification of documents by SHA1 hash
PyPI wagtail · Upgrade to 8.0rc2 (pre-release), 7.4.3, 7.3.4 or 7.0.9 by release line · < 7.0.9; >= 7.1, < 7.3.4; >= 7.4, < 7.4.3; >= 8.0rc1, < 8.0rc2 · CVE-2026-125105 · GHSA-92hv-j533-69wc · amended
- Medium, CVSS 4.5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · >= 1.0.420, < 1.2.14 · CVE-2026-125340 · GHSA-hq84-x37p-j6q5 · amended
- Medium, CVSS 6.1
Winter: CSRF through AJAX handler names reachable as backend page actions
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · >= 1.0.319, < 1.2.14 · CVE-2026-125339 · GHSA-p2ch-c2c3-4xm5 · amended
- Medium, CVSS 4.5
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · < 1.2.14 · CVE-2026-125338 · GHSA-5cwr-5jxg-pcf6 · amended
- High, CVSS 8.3
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · < 1.2.14 · CVE-2026-125337 · GHSA-fm29-4mq3-phg6 · amended
- Medium, CVSS 4.3
Winter: My Account preview exposes another backend user's profile by record ID
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · >= 1.2.13, < 1.2.14 · CVE-2026-126061 · GHSA-mpmw-f6h6-3g26 · amended
- Low, CVSS 2.0
Winter: Stored XSS through Backend List widget image columns
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · >= 1.1.0, < 1.2.14 · CVE-2026-125341 · GHSA-7mpf-4465-7fc2 · amended
- Low, CVSS 3.1
Fleet: ORDER BY column injection on activity list endpoints
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.89.0 or later · < 4.89.0 · CVE-2026-101046 · GHSA-rxhg-vcww-2mpw · amended
- Medium, CVSS 5.3
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.87.0 or later · < 4.87.0 · CVE-2026-101047 · GHSA-q9c5-pp7m-fm2g · amended
- High, CVSS 8.4
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
Packagist winter/wn-system-module · Upgrade to 1.2.13 or later · >= 1.2.7, < 1.2.13 · CVE-2026-79774 · GHSA-8cfw-pcwh-v63w · amended
- Medium, CVSS 4.9
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Packagist winter/wn-system-module · Upgrade to 1.2.13 or later · < 1.2.13 · CVE-2026-79773 · GHSA-2223-f22x-24cq · amended
- High, CVSS 7.5
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63202 · GHSA-4899-mpch-38p3 · amended
- Medium, CVSS 4.9
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-63179 · GHSA-58fp-mcx6-7qf9 · amended
- High, CVSS 8.7
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61827 · GHSA-hmq9-67w8-j5pw · amended
- High, CVSS 7.5
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63124 · GHSA-8cfx-wx3q-mh5q · amended
- Medium, CVSS 5.3
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61799 · GHSA-pgrf-4654-3gq8 · amended
- High, CVSS 8.1
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Maven io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61798 · GHSA-2mc4-j865-9q4r · amended
- Medium, CVSS 4.3
django CMS: Missing authorization in
render_object_structurediscloses non-PageContent placeholder structure to low-privileged staffPyPI django-cms · Upgrade to 5.0.9 or later · < 5.0.9 · CVE-2026-61663 · GHSA-8qj2-c6q4-f399
- Medium, CVSS 6.5
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
PyPI django-cms · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-63003 · GHSA-6x92-6vx4-5fwr
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.