High, CVSS 8.3
RestrictedPython guard hooks can be shadowed via positional-only arguments
PyPI restrictedpython · Upgrade to 8.3 or later · <= 8.2 · CVE-2026-55830 · GHSA-ffg3-p8fm-mjx2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 89 matching · newest first
- Medium, CVSS 5.9
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Maven org.mariadb:r2dbc-mariadb · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-55860 · GHSA-c857-9x2m-cvh2 · amended
- Medium, CVSS 5.9
org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
Maven org.mariadb:r2dbc-mariadb · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-55859 · GHSA-5rqc-86vf-g8r2 · amended
- Medium, CVSS 5.9
org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.9, 3.4.3, 3.3.5 or 2.7.14 by release line · < 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9 · CVE-2026-55858 · GHSA-xvr9-35cr-46v9 · amended
- Medium, CVSS 5.9
org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.9, 3.4.3, 3.3.5 or 2.7.14 by release line · < 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9 · CVE-2026-55857 · GHSA-qxvw-fvwx-5cp7 · amended
- Medium, CVSS 5.9
MariaDB has cleartext password disclosure to a MITM on the initial-handshake
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.9, 3.4.3, 3.3.5 or 2.7.14 by release line · < 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9 · CVE-2026-55856 · GHSA-g9jj-cgmh-9f38 · amended
- High, CVSS 7.0
Snipe-IT has an Improper Privilege Management issue
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-55843 · GHSA-j5g3-42wp-gqm3
- High, CVSS 8.6
MapFish Print has XXE that allows reading arbitrary files of certain types
Maven org.mapfish:print.print-servlet · Upgrade to 3.28.30 or later · >= 3.0.0, < 3.28.30 · +2 more packages · CVE-2026-55848 · GHSA-5v29-34h8-v68r · amended
- Low, CVSS 3.7
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
Go github.com/free5gc/ausf · Upgrade to 1.4.5 or later · < 1.4.5 · CVE-2026-55785 · GHSA-fp46-6vfw-gc9c · amended
- Medium, CVSS 5.4
silverstripe/versioned has XSS in archive admin restore
Packagist silverstripe/versioned · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2026-55779 · GHSA-m4g4-86qc-v8w7 · amended
- High, CVSS 7.7
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260612000715-b44cf51fe931 (pre-release) or later · < 0.0.0-20260612000715-b44cf51fe931 · CVE-2026-55874 · GHSA-56wq-x3wv-3ff4 · amended
- Medium, CVSS 4.3
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260614205536-b13463880c1f (pre-release) or later · >= 0.0.0-20260128085517-09bb90e8dc16, < 0.0.0-20260614205536-b13463880c1f · CVE-2026-55873 · GHSA-hgpf-8634-g44c · amended
- Medium, CVSS 5.3
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
Maven org.graylog2:graylog2-server · Upgrade to 7.1.2, 7.0.7 or 6.3.12 by release line · >= 6.2.0, < 6.3.12; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.2 · CVE-2026-55867 · GHSA-j769-9gv9-65gr · amended
- High, CVSS 7.5
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
Maven org.graylog2:graylog2-server · Upgrade to 7.1.2, 7.0.7 or 6.3.12 by release line · < 6.3.12; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.2 · CVE-2026-55841 · GHSA-gqr6-r77p-c2pj · amended
- High, CVSS 8.7
klever-go: SFT add-quantity
int64overflow bypasses a finite per-nonce MaxSupplyGo github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-55764 · GHSA-mrpp-v6pg-p54x · amended
- Medium, CVSS 5.9
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
npm mariadb · Upgrade to 3.5.3, 3.4.6, 3.3.3 or 3.2.4 by release line · < 3.2.4; >= 3.3.0, < 3.3.3; >= 3.4.0, < 3.4.6; >= 3.5.0, < 3.5.3 · CVE-2026-55854 · GHSA-42r5-vhpq-m858
- Medium, CVSS 6.9
arc has unauthenticated cluster node admission when
cluster.shared_secretis unsetGo github.com/basekick-labs/arc · Upgrade to 0.0.0-20260615160325-38402ad2ebdd (pre-release) or later · < 0.0.0-20260615160325-38402ad2ebdd · CVE-2026-55678 · GHSA-p378-jp5r-gpgw · amended
- High, CVSS 7.1
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
Go github.com/portainer/portainer · Upgrade to 2.43.0 or 2.39.4 by release line · >= 2.39.0, < 2.39.4; >= 2.40.0, < 2.43.0 · CVE-2026-55761 · GHSA-x626-fcwx-f5pc · amended
- High, CVSS 8.7
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
Go github.com/klever-io/klever-go · Upgrade to 1.7.19-rc4 (pre-release) or later · <= 1.7.19-rc2 · CVE-2026-55763 · GHSA-v358-wf77-39xv · amended
- Unrated
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
Packagist privatebin/privatebin · Upgrade to 2.0.5 or later · <= 2.0.4 · CVE-2026-55891 · GHSA-xrjc-c68j-hp7w · amended
- Medium, CVSS 4.3
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Packagist privatebin/privatebin · Upgrade to 2.0.5 or later · <= 2.0.4 · CVE-2026-55696 · GHSA-f2xf-7x3g-4272 · amended
- Medium, CVSS 6.9
AIIR verification and policy gates could report success without enforcing the control (fail-open)
PyPI aiir · Upgrade to 1.7.0 or later · < 1.7.0 · GHSA-73p9-6hrp-8qhr
- High, CVSS 7.5
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
Go github.com/guno1928/alos-http · Upgrade to 0.0.0-20260617230736-314b6783e196 (pre-release) or later · < 0.0.0-20260617230736-314b6783e196 · CVE-2026-55484 · GHSA-hr6j-w4mw-g9mj · amended
- Critical, CVSS 9.9
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · <= 12.3.9; >= 2026.1.0, <= 2026.1.5 · CVE-2026-55634 · GHSA-9x44-4gxf-8c25 · amended
- Critical, CVSS 9.3
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · >= 2026.1.0, <= 2026.1.5; <= 12.3.9 · CVE-2026-55220 · GHSA-w23p-wrp7-ch38 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.