High, CVSS 8.3
RestrictedPython guard hooks can be shadowed via positional-only arguments
PyPI restrictedpython · Upgrade to 8.3 or later · <= 8.2 · CVE-2026-55830 · GHSA-ffg3-p8fm-mjx2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.0
Snipe-IT has an Improper Privilege Management issue
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-55843 · GHSA-j5g3-42wp-gqm3
- High, CVSS 8.6
MapFish Print has XXE that allows reading arbitrary files of certain types
Maven org.mapfish:print.print-servlet · Upgrade to 3.28.30 or later · >= 3.0.0, < 3.28.30 · +2 more packages · CVE-2026-55848 · GHSA-5v29-34h8-v68r · amended
- High, CVSS 7.7
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260612000715-b44cf51fe931 (pre-release) or later · < 0.0.0-20260612000715-b44cf51fe931 · CVE-2026-55874 · GHSA-56wq-x3wv-3ff4 · amended
- High, CVSS 7.5
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
Maven org.graylog2:graylog2-server · Upgrade to 7.1.2, 7.0.7 or 6.3.12 by release line · < 6.3.12; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.2 · CVE-2026-55841 · GHSA-gqr6-r77p-c2pj · amended
- High, CVSS 8.7
klever-go: SFT add-quantity
int64overflow bypasses a finite per-nonce MaxSupplyGo github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-55764 · GHSA-mrpp-v6pg-p54x · amended
- High, CVSS 7.1
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
Go github.com/portainer/portainer · Upgrade to 2.43.0 or 2.39.4 by release line · >= 2.39.0, < 2.39.4; >= 2.40.0, < 2.43.0 · CVE-2026-55761 · GHSA-x626-fcwx-f5pc · amended
- High, CVSS 8.7
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
Go github.com/klever-io/klever-go · Upgrade to 1.7.19-rc4 (pre-release) or later · <= 1.7.19-rc2 · CVE-2026-55763 · GHSA-v358-wf77-39xv · amended
- High, CVSS 7.5
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
Go github.com/guno1928/alos-http · Upgrade to 0.0.0-20260617230736-314b6783e196 (pre-release) or later · < 0.0.0-20260617230736-314b6783e196 · CVE-2026-55484 · GHSA-hr6j-w4mw-g9mj · amended
- Critical, CVSS 9.9
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · <= 12.3.9; >= 2026.1.0, <= 2026.1.5 · CVE-2026-55634 · GHSA-9x44-4gxf-8c25 · amended
- Critical, CVSS 9.3
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · >= 2026.1.0, <= 2026.1.5; <= 12.3.9 · CVE-2026-55220 · GHSA-w23p-wrp7-ch38 · amended
- High, CVSS 7.1
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or later · < 2026.1.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55212 · GHSA-f97c-ph8j-8vff
- High, CVSS 7.7
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or 2025.4.6 by release line · < 2025.4.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55208 · GHSA-79cw-hfcc-7mw9 · amended
- High, CVSS 8.8
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or 2025.4.6 by release line · < 2025.4.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55207 · GHSA-h854-c3m3-mh5v · amended
- High, CVSS 7.5
MariaDB's connector leaks the cleartext password to an MitM despite
ssl: truenpm mariadb · Upgrade to 3.5.3, 3.4.6, 3.3.3 or 3.2.4 by release line · < 3.2.4; >= 3.3.0, < 3.3.3; >= 3.4.0, < 3.4.6; >= 3.5.0, < 3.5.3 · CVE-2026-55215 · GHSA-cqhc-2h57-wpxf
- Critical, CVSS 9.1
plone.app.event vulnerable to denial of service via iCalendar import
PyPI plone-app-event · Upgrade to 6.0.1 or 5.2.4 by release line · < 5.2.4; >= 6.0.0a1, < 6.0.1 · CVE-2026-55247 · GHSA-r82h-mqw3-fc56 · amended
- High, CVSS 8.1
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
PyPI weblate · Upgrade to 2026.7 or later · < 2026.7 · CVE-2026-55228 · GHSA-2q2q-jr9g-v9rf
- High, CVSS 7.1
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
PyPI protego · Upgrade to 0.6.2 or later · <= 0.6.1 · CVE-2026-55520 · GHSA-wjmf-p669-5m5p
- Critical, CVSS 9.1
plone.app.portlets vulnerable to denial of service via RSS feed portlet
PyPI plone-app-portlets · Upgrade to 7.0.2, 6.0.4 or 5.0.8 by release line · >= 7.0.0, <= 7.0.1; >= 6.0.0, < 6.0.4; < 5.0.8 · CVE-2026-55248 · GHSA-x5g3-w747-2h8q · amended
- High, CVSS 7.1
PowSyBl Core has Command Injection in LocalCommandExecutor-s
Maven com.powsybl:powsybl-computation-local · Upgrade to 7.2.2 or later · <= 7.2.1 · CVE-2026-55673 · GHSA-jqvf-j3ww-r8c7 · amended
- High, CVSS 7.5
Spinnaker: Improper yaml processing on kustomize bake operations
Maven io.spinnaker.rosco:rosco-manifests · Upgrade to 2026.1.1, 2026.0.3, 2025.4.4 or 2025.3.4 by release line · < 2025.3.4; >= 2025.4.0, < 2025.4.4; >= 2026.0.0, < 2026.0.3; >= 2026.1.0, < 2026.1.1 · CVE-2026-55175 · GHSA-p68j-q7hf-3qcp
- High, CVSS 8.2
9router: Unauthenticated
/v1proxy access viaHost-header spoofing → open AI relay + SSRFnpm 9router · Upgrade to 0.5.2 or later · < 0.5.2 · CVE-2026-55641 · GHSA-86m2-fcxq-5q7c
- High, CVSS 8.6
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass
npm 9router · Upgrade to 0.5.2 or later · < 0.5.2 · CVE-2026-55638 · GHSA-8gmq-j984-vp4r
- High, CVSS 7.5
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Packagist phpsysinfo/phpsysinfo · Upgrade to 3.4.6 or later · <= 3.4.5 · CVE-2026-55584 · GHSA-786w-p5pm-cvgh · amended
- High, CVSS 8.7
Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
Go github.com/maximhq/bifrost/core · Upgrade to 1.5.17 or later · < 1.5.17 · CVE-2026-55245 · GHSA-w98g-5w9p-p3rc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.