Critical, CVSS 9.1
Gitea repository creation accepts insufficiently validated fields
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-22547 · GHSA-922f-hfwp-p56f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 78 matching · newest first
- High, CVSS 7.5
Gitea primary email ownership bypass allows cross-user email changes
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-27657 · GHSA-4c8f-3m6h-m56r · amended
- Medium, CVSS 5.3
Gitea release asset dumps permit path traversal through crafted names
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-28705 · GHSA-7jvx-g65v-r899 · amended
- High, CVSS 7.5
Gitea organization permission APIs expose hidden membership and private organization data
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-25712 · GHSA-37w2-86g3-h4qh · amended
- Critical, CVSS 9.1
Gitea template repository generation follows unsafe filesystem paths
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-25718 · GHSA-h697-89cp-24q8 · amended
- High, CVSS 7.5
Gitea pull request branch permission checks allow unauthorized updates and rebases
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-24690 · GHSA-47rq-xp99-92mx · amended
- Medium, CVSS 6.5
Grafana Tempo vulnerable to an out-of-memory crash
Go github.com/grafana/tempo · Upgrade to 1.5.1-0.20260303204923-b13f74291d48 (pre-release) or later · < 1.5.1-0.20260303204923-b13f74291d48 · CVE-2026-27878 · GHSA-6xff-cpcq-vpw2 · amended
- High, CVSS 7.5
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.4.2, < 2.4.5; >= 3.1.3, < 3.1.6; >= 4.0.1, < 4.1.3 · CVE-2026-75931 · GHSA-5jgf-p345-68v8
- High, CVSS 7.5
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.3.1, < 2.4.5; >= 3.0.0, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-75975 · GHSA-f65p-4m7j-42xc
- High, CVSS 7.5
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.4.1, < 2.4.5; >= 3.1.2, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-75899 · GHSA-fph4-wmhf-6fwf
- High, CVSS 7.5
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.3.1, < 2.4.5; >= 3.0.0, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-76172 · GHSA-jqff-g426-hqxp
- High, CVSS 8.7
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-62388 · GHSA-p3m8-78j2-g5p3 · amended
- Medium, CVSS 6.9
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-63311 · GHSA-3gqm-fcw5-w839 · amended
- High, CVSS 7.5
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
PyPI mistune · Upgrade to 3.3.3 or later · >= 3.3.0, < 3.3.3 · CVE-2026-76098 · GHSA-6m44-fpc8-c3rq
- Medium, CVSS 6.1
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
npm fastify · Upgrade to 5.12.1 or later · >= 5.8.3, < 5.12.1 · CVE-2026-16732 · GHSA-3m5p-2c4r-xxw2
- Medium, CVSS 5.4
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
npm fastify · Upgrade to 5.12.1 or later · < 5.12.1 · CVE-2026-18504 · GHSA-w2qp-rph6-63g4
- High, CVSS 7.1
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
npm apostrophe · Upgrade to 4.32.1 or later · < 4.32.1 · CVE-2026-71553 · GHSA-vmg4-6gfg-83qx · amended
- Medium, CVSS 5.4
Sulu: Stored XSS via media download inline-disposition override
Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · <= 2.6.24; >= 3.0.0-alpha1, < 3.0.8 · CVE-2026-82396 · GHSA-pp4x-ccxq-6r33 · amended
- Medium, CVSS 5.3
Sulu: Fix authorization bypass when creating preview links
Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · <= 2.6.24; >= 3.0.0-alpha1, < 3.0.8 · CVE-2026-82394 · GHSA-65cv-w493-7vhq · amended
- Medium, CVSS 5.3
Sulu: Media move/update authorization bypass (IDOR)
Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · <= 2.6.24; >= 3.0.0-alpha1, < 3.0.8 · CVE-2026-82395 · GHSA-h6cx-gjxx-v25c · amended
- Medium, CVSS 6.5
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
npm @apostrophecms/import-export · Upgrade to 3.6.2 or later · < 3.6.2 · CVE-2026-63667 · GHSA-79qf-vqgc-7xx3 · amended
- Medium, CVSS 6.9
Kirby: Access to image files outside of the site root via path traversal in the media handling
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · < 4.9.5; >= 5.0.0, < 5.5.2 · CVE-2026-75592 · GHSA-6j4c-mgqr-qv76 · amended
- High, CVSS 7.1
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
npm orval · Upgrade to 8.22.0 or later · < 8.22.0 · CVE-2026-62680 · GHSA-cxq5-97v7-87j8
- Critical, CVSS 9.3
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72716 · GHSA-p4cg-3328-rvfg · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71866 · GHSA-6mr6-jvcr-2f25 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.