High, CVSS 7.1
Kirby: File upload permissions are not checked during processing of chunk data
Packagist getkirby/cms · Upgrade to 5.5.2 or later · >= 5.0.0, < 5.5.2 · CVE-2026-71415 · GHSA-67mx-6wf2-92xp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · <= 4.9.4; >= 5.0.0, < 5.5.2 · CVE-2026-75594 · GHSA-9vx2-j98c-p72w · amended
- High, CVSS 7.5
Socket.IO: Engine.IO WebTransport SID DoS
npm engine.io · Upgrade to 6.6.7 or later · >= 6.5.0, < 6.6.7 · CVE-2026-59724 · GHSA-gr94-w7qr-f4j3
- High, CVSS 8.6
elFinder: SSRF protection bypass via DNS rebinding in the
fsock_get_contents()fallbackPackagist studio-42/elfinder · Upgrade to 2.1.70 or later · <= 2.1.69 · CVE-2026-81889 · GHSA-8x3q-jpjh-qh5c · amended
- High, CVSS 7.3
zbus_polkit: authorization bypass via PID reusecrates.io zbus_polkit · Upgrade to 5.1.0 or later · >= 0.0.0-0, < 5.1.0 · CVE-2026-78422 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.