Medium, CVSS 5.3
Snipe-IT has missing object-level authorization in Kits API
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55478 · GHSA-crv3-j83j-f3r6
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 89 matching · newest first
- Medium, CVSS 5.3
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-55476 · GHSA-53jc-27pc-x8r8
- Medium, CVSS 5.7
Snipe-IT's import created_by can be overwritten
Packagist snipe/snipe-it · Upgrade to 8.6.1 or later · <= 8.6.0 · CVE-2026-55475 · GHSA-5wx7-xq8j-v4qm
- High, CVSS 7.1
Snipe-IT vulnerable to directory traversal in displaySig
Packagist snipe/snipe-it · Upgrade to 8.5.0 or later · < 8.5.0 · CVE-2026-55474 · GHSA-c6f4-wj38-m3g3
- Medium, CVSS 4.3
Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55472 · GHSA-8w8c-8mx9-52cw
- Unrated
Snipe-IT has a path traversal vulnerability via CSV import
imagefieldPackagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55469 · GHSA-xr9m-gphc-9p63
- Medium, CVSS 6.2
Snipe-IT vulnerable to stored XSS via inline-served attachment
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55466 · GHSA-jhph-5q74-pmfx
- Medium, CVSS 4.8
Snipe-IT vulnerable to stored XSS via Markdown custom field
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55464 · GHSA-r52f-r9v5-66xr
- Medium, CVSS 4.3
Snipe-IT has an authorization bypass on print inventory page
Packagist snipe/snipe-it · Upgrade to 8.6.1 or later · <= 8.6.0 · CVE-2026-55462 · GHSA-fc33-6w3q-538h
- Medium, CVSS 6.1
Snipe-IT has an Open Redirect After User Edit
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55461 · GHSA-wg2f-x2c2-c4rp
- High, CVSS 7.1
Snipe-IT has an authorization bypass on bulk editing users
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55460 · GHSA-vgx7-c78r-69w9
- Medium, CVSS 4.8
Snipe-IT has CSV formula injection in Activity Report export
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-55452 · GHSA-whrx-mmgr-gpcf
- Medium, CVSS 4.3
Yamcs has DOM XSS in Extension Routing
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55566 · GHSA-9272-wg2r-7xmx · amended
- Critical, CVSS 9.9
Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL
LIKEpattern compiled by Janino (LikeExpression)Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55565 · GHSA-c64q-hj4j-375f · amended
- Critical, CVSS 9.8
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55559 · GHSA-73mf-m39p-wpm9 · amended
- High, CVSS 7.5
Yamcs has Unauthenticated Directory Traversal
Maven org.yamcs:yamcs-core · Upgrade to 5.12.0 or later · < 5.12.0 · CVE-2026-55552 · GHSA-9jg3-g3wh-w9pj
- Medium, CVSS 6.5
Yamcs has Reflected XSS in the URL of the Authorize Endpoint
Maven org.yamcs:yamcs-core · Upgrade to 5.9.4 or later · < 5.9.4 · CVE-2026-55549 · GHSA-rxpg-wjf8-qv9c · amended
- Medium, CVSS 4.3
Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55548 · GHSA-8xjq-pr36-ccgf · amended
- Medium, CVSS 4.3
Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55547 · GHSA-cvw4-55pp-3hfq · amended
- Medium, CVSS 6.5
Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · <= 5.12.7; >= 5.13.0, <= 5.13.1 · CVE-2026-55545 · GHSA-fwww-cp23-7f5g · amended
- High, CVSS 8.8
Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55521 · GHSA-962x-ccwf-8x6p · amended
- Critical, CVSS 9.1
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs
executeSqlMaven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55511 · GHSA-3g44-3m7x-cgg2 · amended
- Critical, CVSS 9.3
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
Go github.com/free5gc/free5gc · Upgrade to 4.2.2 or later · < 4.2.2 · CVE-2026-55068 · GHSA-x8mj-6p3q-g5pp · amended
- Medium, CVSS 5.0
Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via
project_view_idmass-assignmentGo code.vikunja.io/api · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-55067 · GHSA-569v-q83c-3j3g · amended
- High, CVSS 7.1
Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-55066 · GHSA-5pg6-m483-7vrg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.