High, CVSS 8.1
Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.24.6, < 2.4.0 · CVE-2026-55065 · GHSA-gg93-x632-9ccv · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–89 of 89 matching · newest first
- Medium, CVSS 4.3
Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 2.3.0, < 2.4.0 · CVE-2026-55064 · GHSA-44v6-7fxq-vgf4 · amended
- Medium, CVSS 5.3
Vikunja has a project duplication bypasses write-permission check on the target parent project
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.21.0, <= 2.3.0 · CVE-2026-54766 · GHSA-f27p-pw2p-9pr4 · amended
- High, CVSS 7.5
datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
crates.io datadog-opentelemetry · Upgrade to 0.3.3 or later · >= 0.1.0, < 0.3.3 · CVE-2026-54788 · GHSA-gpwf-4h98-v82q · amended
- Medium, CVSS 4.3
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Go github.com/pocket-id/pocket-id/backend · Upgrade to 2.9.0 or later · >= 2.6.0, <= 2.8.0 · CVE-2026-55834 · GHSA-2wvm-8mvp-22qv · amended
- Critical, CVSS 9.6
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)
Go github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-54755 · GHSA-cgc5-v3f2-8m2v · amended
- Critical, CVSS 9.6
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
Go github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-54754 · GHSA-p7gw-2pcp-5pf8 · amended
- High, CVSS 7.8
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
PyPI compliance-trestle · Upgrade to 4.1.0 or 3.12.4 by release line · <= 3.12.3; >= 4.0.0, < 4.1.0 · CVE-2026-54757 · GHSA-jw39-3688-r4rx
- High, CVSS 8.5
KubeVela Terraform remote loader DoS via unbounded file read
Go github.com/oam-dev/kubevela · Upgrade to 1.11.0-alpha.4 (pre-release), 1.10.9 or 1.9.14 by release line · < 1.9.14; >= 1.10.0-alpha.1, < 1.10.9; >= 1.11.0-alpha.1, < 1.11.0-alpha.4 · CVE-2026-55108 · GHSA-fmgp-q6jx-gg3x · amended
- Medium, CVSS 6.5
gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)
crates.io gix-packetline · Upgrade to 0.21.5 or later · <= 0.21.4 · CVE-2026-82250 · GHSA-2vh6-hw4j-32ww · amended
- Medium, CVSS 6.4
Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.2 or later · >= 0.40.0, < 0.91.2 · CVE-2026-54746 · GHSA-8x7x-83cf-c3pg · amended
- High, CVSS 8.7
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Packagist phalcon/cphalcon · Upgrade to 5.15.0 or later · <= 5.14.2 · CVE-2026-57584 · GHSA-x7rj-f32v-7jjg · amended
- High, CVSS 8.2
Phalcon: Non-constant-time HMAC verification in
Encryption\Crypt::decrypt(timing side-channel)Packagist phalcon/cphalcon · Upgrade to 5.14.1 or later · <= 5.14.0 · CVE-2026-54736 · GHSA-8jqh-95g6-7jpj · amended
- Unrated
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Go golang.org/x/crypto · Upgrade to 0.55.0 or later · < 0.55.0 · CVE-2026-56854
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.