Medium, CVSS 6.5
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.10.0, < 0.11.1 · CVE-2026-88000 · GHSA-3cgp-3cqx-j8w2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–24 of 24 matching · newest first
- Medium, CVSS 5.0
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.9.5, <= 0.11.0 · CVE-2026-88001 · GHSA-5x7x-4c3c-qf5w · amended
- Medium, CVSS 6.5
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.5.0, < 0.11.1 · CVE-2026-88002 · GHSA-jqhh-cjmq-vmv6 · amended
- High, CVSS 8.5
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Go github.com/identrail/identrail · Upgrade to 1.0.2 or later · < 1.0.2 · CVE-2026-59185 · GHSA-cp3j-m783-3ph5 · amended
- High, CVSS 8.3
@openhop/server: Path Traversal in Flow ID File Operations
npm @openhop/server · Upgrade to 0.3.6 or later · <= 0.3.5 · CVE-2026-59179 · GHSA-g72f-jw3w-mgh7 · amended
- High, CVSS 8.8
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
PyPI esphome-device-builder · Upgrade to 1.0.10 or later · < 1.0.10 · CVE-2026-59177 · GHSA-vv4j-m4vr-f3g6 · amended
- High, CVSS 7.8
functype-mcp-server: MCP
set_functype_versionPackage Alias RCE via Unsanitized pnpm install + Dynamic Importnpm functype-mcp-server · Upgrade to 1.4.4 or later · < 1.4.4 · CVE-2026-59176 · GHSA-wcjj-9m6g-2fr2 · amended
- High, CVSS 7.8
Joker linter executed project-local .jokerd/linter.* files during linting
Go github.com/candid82/joker · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2026-59172 · GHSA-m835-3cm9-rggg · amended
- High, CVSS 8.8
Komari: Management Interface CSRF
Go github.com/komari-monitor/komari · Upgrade to 0.0.0-20260609084633-98122fa4d110 (pre-release) or later · < 0.0.0-20260609084633-98122fa4d110 · GHSA-hxjg-93wc-h8p8 · amended
- High, CVSS 8.8
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
npm @yeger/turbo-graph · Upgrade to 2.8.12 or later · <= 2.8.8 · CVE-2026-59160 · GHSA-2r5q-h53f-9rp3 · amended
- High, CVSS 7.5
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
npm nuxt-ollama · Upgrade to 1.3.1 or later · >= 1.2.26, < 1.3.1 · CVE-2026-59158 · GHSA-fxg7-897c-57mp · amended
- Medium, CVSS 6.5
webhookd: Unrestricted HTTP Header to Shell Variable Injection
Go github.com/ncarlier/webhookd · Upgrade to 1.22.0 or later · < 1.22.0 · CVE-2026-59157 · GHSA-v25g-mvwr-f5fp · amended
- High, CVSS 7.7
GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool
Maven org.geonetwork-opensource:gn-web-app · Upgrade to 4.4.12 or 4.2.17 by release line · >= 4.4.0, <= 4.4.11; >= 4.0.0, <= 4.2.16 · CVE-2026-55864 · GHSA-5hx7-j24v-rffj · amended
- High, CVSS 8.2
smol-toml: Denial of Service via malformed TOML documents
npm smol-toml · Upgrade to 1.7.1 or later · <= 1.7.0 · CVE-2026-85730 · GHSA-7w5x-hrqm-74c2 · amended
- Medium, CVSS 6.2
weasyprint Has Server-Side Request Forgery (SSRF)
PyPI weasyprint · Upgrade to 70.0 or later · < 70.0 · CVE-2026-55073 · GHSA-jf6q-chmf-3h3v · amended
- Medium, CVSS 5.3
SQLAdmin: Unvalidated sortBy parameter in
ModelViewbypassescolumn_sortable_listPyPI sqladmin · Upgrade to 0.27.1 or later · < 0.27.1 · CVE-2026-54529 · GHSA-ccg5-9c8w-xh6v · amended
- Medium, CVSS 6.8
containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
Go github.com/containerd/containerd · Upgrade to 1.7.35 or later · < 1.7.35 · +1 more package · CVE-2026-53495 · GHSA-7jxh-36q5-gcqv · amended
- Medium, CVSS 5.3
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
PyPI githacker · Upgrade to 1.1.8 or later · <= 1.1.7 · CVE-2026-50024 · GHSA-hr3m-4qwq-3mgc · amended
- Medium, CVSS 4.8
decidim-elections: Election question titles allow stored script execution
RubyGems decidim-elections · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-44282 · GHSA-9mvp-w4rr-5c6x · amended
- Medium, CVSS 6.8
gix-sec safe.directory protections absent for elevated administrators
crates.io gix-sec · Upgrade to 0.13.3 or later · <= 0.13.2 · CVE-2025-24890 · GHSA-7rhf-42qf-vrvc · amended
- Medium, CVSS 5.9
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.server.iisintegration · Upgrade to 11.0.0-rc.1 (pre-release), 10.0.12, 9.0.20 or 8.0.31 by release line · >= 11.0.0-preview.1, < 11.0.0-rc.1; >= 8.0.0, <= 8.0.30; >= 9.0.0, <= 9.0.19; >= 10.0.0, <= 10.0.11 · CVE-2026-69304 · GHSA-8cp2-47hg-mfgh · amended
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.diasymreader.native · Upgrade to 18.9.0-beta1.26405.2 (pre-release) or later · >= 17.10.0-beta1.24272.1, < 18.9.0-beta1.26405.2 · CVE-2026-69522 · GHSA-2j8r-3c22-8565 · amended
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability
NuGet microsoft.diasymreader.native · Upgrade to 18.9.0-beta1.26405.2 (pre-release) or later · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 · CVE-2026-69439 · GHSA-527h-q9f6-p7qx · amended
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.diasymreader.native · Upgrade to 18.9.0-beta1.26405.2 (pre-release) or later · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 · CVE-2026-71328 · GHSA-63gh-g2x5-x69v · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.