High, CVSS 8.8
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
PyPI piccolo-admin · Upgrade to 1.14.0 or later · <= 1.13.0 · CVE-2026-55485 · GHSA-2gh4-jmwq-rr8w
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
WsgiDAV MySQL provider has a blind SQL injection
PyPI wsgidav · Upgrade to 4.3.5 or later · <= 4.3.4 · CVE-2026-55509 · GHSA-p6gw-4frg-j7jw
- High, CVSS 7.7
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55516 · GHSA-575r-357h-fhch
- High, CVSS 7.1
Snipe-IT vulnerable to directory traversal in displaySig
Packagist snipe/snipe-it · Upgrade to 8.5.0 or later · < 8.5.0 · CVE-2026-55474 · GHSA-c6f4-wj38-m3g3
- High, CVSS 7.1
Snipe-IT has an authorization bypass on bulk editing users
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55460 · GHSA-vgx7-c78r-69w9
- Critical, CVSS 9.9
Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL
LIKEpattern compiled by Janino (LikeExpression)Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55565 · GHSA-c64q-hj4j-375f · amended
- Critical, CVSS 9.8
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55559 · GHSA-73mf-m39p-wpm9 · amended
- High, CVSS 7.5
Yamcs has Unauthenticated Directory Traversal
Maven org.yamcs:yamcs-core · Upgrade to 5.12.0 or later · < 5.12.0 · CVE-2026-55552 · GHSA-9jg3-g3wh-w9pj
- High, CVSS 8.8
Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55521 · GHSA-962x-ccwf-8x6p · amended
- Critical, CVSS 9.1
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs
executeSqlMaven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55511 · GHSA-3g44-3m7x-cgg2 · amended
- Critical, CVSS 9.3
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
Go github.com/free5gc/free5gc · Upgrade to 4.2.2 or later · < 4.2.2 · CVE-2026-55068 · GHSA-x8mj-6p3q-g5pp · amended
- High, CVSS 7.1
Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-55066 · GHSA-5pg6-m483-7vrg · amended
- High, CVSS 8.1
Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.24.6, < 2.4.0 · CVE-2026-55065 · GHSA-gg93-x632-9ccv · amended
- High, CVSS 7.5
datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
crates.io datadog-opentelemetry · Upgrade to 0.3.3 or later · >= 0.1.0, < 0.3.3 · CVE-2026-54788 · GHSA-gpwf-4h98-v82q · amended
- Critical, CVSS 9.6
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)
Go github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-54755 · GHSA-cgc5-v3f2-8m2v · amended
- Critical, CVSS 9.6
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
Go github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-54754 · GHSA-p7gw-2pcp-5pf8 · amended
- High, CVSS 7.8
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
PyPI compliance-trestle · Upgrade to 4.1.0 or 3.12.4 by release line · <= 3.12.3; >= 4.0.0, < 4.1.0 · CVE-2026-54757 · GHSA-jw39-3688-r4rx
- High, CVSS 8.5
KubeVela Terraform remote loader DoS via unbounded file read
Go github.com/oam-dev/kubevela · Upgrade to 1.11.0-alpha.4 (pre-release), 1.10.9 or 1.9.14 by release line · < 1.9.14; >= 1.10.0-alpha.1, < 1.10.9; >= 1.11.0-alpha.1, < 1.11.0-alpha.4 · CVE-2026-55108 · GHSA-fmgp-q6jx-gg3x · amended
- High, CVSS 8.7
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Packagist phalcon/cphalcon · Upgrade to 5.15.0 or later · <= 5.14.2 · CVE-2026-57584 · GHSA-x7rj-f32v-7jjg · amended
- High, CVSS 8.2
Phalcon: Non-constant-time HMAC verification in
Encryption\Crypt::decrypt(timing side-channel)Packagist phalcon/cphalcon · Upgrade to 5.14.1 or later · <= 5.14.0 · CVE-2026-54736 · GHSA-8jqh-95g6-7jpj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.