Critical, CVSS 9.3
Home Assistant: XSS in Statistics Graph Card
PyPI homeassistant · Upgrade to 2026.7.0 or later · < 2026.7.0 · CVE-2026-91130 · GHSA-wx4m-69m9-gx3m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Spree: Broken Access Control in
PATCH /api/v3/store/carts/:id/associate(IDOR)RubyGems spree_api · Upgrade to 5.5.4 or 5.4.4 by release line · >= 5.4.0, < 5.4.4; >= 5.5.0, < 5.5.4 · CVE-2026-94462 · GHSA-4825-p4xm-pcf2 · amended
- High, CVSS 7.1
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
PyPI lightrag-hku · Upgrade to 1.5.5 or later · < 1.5.5 · CVE-2026-85740 · GHSA-vv3m-f8x4-7377 · amended
- Critical, CVSS 9.1
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
PyPI lightrag-hku · Upgrade to 1.5.5 or later · < 1.5.5 · CVE-2026-85734 · GHSA-frch-4w6v-q5xx · amended
- High, CVSS 8.1
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
Go github.com/tinyauthapp/tinyauth · Upgrade to 1.0.1-0.20260720133915-80bc87188ec3 (pre-release) or later · < 1.0.1-0.20260720133915-80bc87188ec3 · CVE-2026-77560 · GHSA-328g-jx67-v94g · amended
- High, CVSS 8.8
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.12.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62371 · GHSA-5jpj-293f-rhvj · amended
- High, CVSS 8.1
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.16.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62369 · GHSA-9vm9-pqxx-x83v · amended
- Critical, CVSS 9.1
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260713141742-763625a20721 (pre-release); some affected versions have no fix yet · < 0.0.0-20260713141742-763625a20721; >= 0.1.0, <= 1.1.5 · CVE-2026-63132 · GHSA-34fc-gh42-pj53 · amended
- High, CVSS 7.5
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260710001938-2d4ebafec5c5 (pre-release); some affected versions have no fix yet · < 0.0.0-20260710001938-2d4ebafec5c5; >= 0.1.0, <= 1.1.5 · CVE-2026-71543 · GHSA-59w7-v8rr-pr4p · amended
- High, CVSS 8.8
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.21.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62182 · GHSA-m3c6-2p7h-cfr3 · amended
- High, CVSS 7.1
Unleash: Missing await on permission check + cross-project IDOR in admin API
npm unleash-server · Upgrade to 8.0.3 or later · < 8.0.3 · CVE-2026-77426 · GHSA-72h8-wp98-7hch · amended
- High, CVSS 7.7
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77258 · GHSA-93xw-j965-9mx3 · amended
- Critical, CVSS 10.0
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77244 · GHSA-wrhw-j3f9-8vc6 · amended
- High, CVSS 8.8
MCP Atlassian: SSRF Protection Bypass
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77274 · GHSA-hgcf-4mq8-5266 · amended
- High, CVSS 8.3
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77271 · GHSA-6vmq-24h2-pj7j · amended
- High, CVSS 8.3
mcp-atlassian has an incomplete SSRF remediation
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77267 · GHSA-5wf4-jqxh-8gm3 · amended
- High, CVSS 8.6
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77262 · GHSA-p6hp-93wp-fh6p · amended
- High, CVSS 7.7
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77259 · GHSA-6cr4-ccf3-x7h4 · amended
- High, CVSS 7.1
MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77261 · GHSA-6529-c226-h328 · amended
- High, CVSS 8.3
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77260 · GHSA-f4p7-qx46-wc5j · amended
- High, CVSS 8.3
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77257 · GHSA-mrq8-fv7v-hhjg · amended
- High, CVSS 8.8
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77243 · GHSA-3r68-hf9h-887v · amended
- High, CVSS 8.6
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77255 · GHSA-2xj6-xx86-cwwc · amended
- High, CVSS 7.1
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77253 · GHSA-vc25-24vv-fxxm · amended
- High, CVSS 8.3
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77251 · GHSA-w66g-j6c4-hcfc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.