Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.8.0, < 0.11.1 · CVE-2026-88006 · GHSA-wvm9-9g5j-623f · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 57 matching · newest first
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.8.0, < 0.11.1 · CVE-2026-88006 · GHSA-wvm9-9g5j-623f · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.72.0, < 1.75.1 · CVE-2026-88014 · GHSA-66hp-wgxq-6f5q · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.49.0, <= 1.75.0 · CVE-2026-88013 · GHSA-486v-q2wf-fp2r · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · <= 1.75.0 · CVE-2026-88016 · GHSA-f8g7-2xjc-7mfh · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · <= 1.75.0 · CVE-2026-88015 · GHSA-p6m2-r3w9-mpxw · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · < 1.75.1 · CVE-2026-88018 · GHSA-xwwr-4h3p-r22c · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.70.0, < 1.75.1 · CVE-2026-88044 · GHSA-p569-5gjg-9cmj · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.64.0, <= 1.75.0 · CVE-2026-88017 · GHSA-c476-6w5q-jw77 · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · < 1.75.1 · CVE-2026-88046 · GHSA-38xv-hf3p-h7mq · amended
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.75.0, <= 1.75.0 · CVE-2026-88045 · GHSA-2p48-j3qc-rx9f · amended
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.9.0, <= 0.11.0 · CVE-2026-87011 · GHSA-3g9q-v48f-hh9w · amended
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.9.0, < 0.11.1 · CVE-2026-87012 · GHSA-v39v-59xw-j98g · amended
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.10.0, <= 0.11.0 · CVE-2026-87013 · GHSA-8r35-5x5r-hv74 · amended
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.9.0, < 0.11.1 · CVE-2026-87014 · GHSA-wjwr-xfp9-r66p · amended
overrideAccess Omissionnpm @jhb.software/payload-alt-text-plugin · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-59965 · GHSA-4qpv-39hg-f7fx · amended
npm @argos-ci/core · Upgrade to 6.2.1 or later · <= 6.2.0 · CVE-2026-59960 · GHSA-4x45-gxvp-6283 · amended
crates.io mistralrs-server-core · Upgrade to 0.8.18 or later · <= 0.8.4 · GHSA-m3wp-48jr-vr4g · amended
crates.io mistralrs-server-core · Upgrade to 0.8.18 or later · <= 0.8.17 · GHSA-wfgq-w7cq-qj7j · amended
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.6.27, < 0.11.1 · CVE-2026-87015 · GHSA-p78m-89r6-pgf7 · amended
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.6.41, < 0.11.1 · CVE-2026-87016 · GHSA-wpmr-8h3q-fwj7 · amended
npm n8n · Upgrade to 2.38.1 or 2.37.7 by release line · >= 2.38.0, < 2.38.1; < 2.37.7 · CVE-2026-86073 · GHSA-cw9w-vv67-hf73 · amended
npm n8n · Upgrade to 2.38.2 or 2.37.7 by release line · >= 2.38.0, < 2.38.2; < 2.37.7 · CVE-2026-86074 · GHSA-q5wm-mgqx-fv2f · amended
npm n8n · Upgrade to 2.38.2, 2.37.7 or 1.123.76 by release line · < 1.123.76; >= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7 · CVE-2026-86995 · GHSA-qgpw-8g46-w95v · amended
npm n8n · Upgrade to 2.38.2 or 2.37.7 by release line · >= 2.38.0, < 2.38.2; < 2.37.7 · CVE-2026-86085 · GHSA-cqr2-h44g-v75v · amended
npm n8n · Upgrade to 2.38.2, 2.37.7 or 1.123.76 by release line · < 1.123.76; >= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7 · CVE-2026-86993 · GHSA-pq6c-vh67-xpm3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.