Critical, CVSS 9.3
Home Assistant: XSS in Statistics Graph Card
PyPI homeassistant · Upgrade to 2026.7.0 or later · < 2026.7.0 · CVE-2026-91130 · GHSA-wx4m-69m9-gx3m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 76 matching · newest first
- Medium, CVSS 4.3
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
Go github.com/hatchet-dev/hatchet · Upgrade to 0.106.1 or later · < 0.106.1 · CVE-2026-88978 · GHSA-992g-9cr3-vm5x · amended
- Low, CVSS 3.1
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
Go github.com/hatchet-dev/hatchet · Upgrade to 0.95.3 or later · < 0.95.3 · CVE-2026-84298 · GHSA-9q4h-f4x5-ffq8 · amended
- High, CVSS 7.1
Spree: Broken Access Control in
PATCH /api/v3/store/carts/:id/associate(IDOR)RubyGems spree_api · Upgrade to 5.5.4 or 5.4.4 by release line · >= 5.4.0, < 5.4.4; >= 5.5.0, < 5.5.4 · CVE-2026-94462 · GHSA-4825-p4xm-pcf2 · amended
- Medium, CVSS 6.1
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
PyPI lightrag-hku · Upgrade to 1.5.5 or later · <= 1.5.4 · CVE-2026-86062 · GHSA-xpjq-3w4w-w5wr · amended
- High, CVSS 7.1
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
PyPI lightrag-hku · Upgrade to 1.5.5 or later · < 1.5.5 · CVE-2026-85740 · GHSA-vv3m-f8x4-7377 · amended
- Critical, CVSS 9.1
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
PyPI lightrag-hku · Upgrade to 1.5.5 or later · < 1.5.5 · CVE-2026-85734 · GHSA-frch-4w6v-q5xx · amended
- Medium, CVSS 5.9
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function
PyPI lightrag-hku · Upgrade to 1.5.5 or later · <= 1.5.4 · CVE-2026-85725 · GHSA-c759-cx9p-mrwq · amended
- Medium, CVSS 5.3
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
PyPI lightrag-hku · Upgrade to 1.5.5 or later · <= 1.5.4 · CVE-2026-85709 · GHSA-hrmj-7rvj-4hg8 · amended
- Medium, CVSS 6.4
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
PyPI nautobot · Upgrade to 3.1.8 or later · >= 3.0.0, < 3.1.8 · CVE-2026-83805 · GHSA-q4c5-2j6f-r476 · amended
- Medium, CVSS 5.4
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
PyPI nautobot · Upgrade to 3.1.8 or 2.4.37 by release line · < 2.4.37; >= 3.0.0, < 3.1.8 · CVE-2026-83801 · GHSA-56v6-2fhr-wxgq · amended
- Medium, CVSS 5.3
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
PyPI autobahn +1 · Upgrade all 2 to 26.7.1 or later · < 26.7.1 · CVE-2026-77528 · GHSA-hxp9-w8x3-p566 · amended
- Medium, CVSS 5.3
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
Go github.com/tinyauthapp/tinyauth +1 · Upgrade all 2 to 1.0.1-0.20260715123057-dade1e2c8f27 (pre-release) or later · < 1.0.1-0.20260715123057-dade1e2c8f27 · CVE-2026-77561 · GHSA-9xhm-w3wj-xhqh · amended
- High, CVSS 8.1
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
Go github.com/tinyauthapp/tinyauth · Upgrade to 1.0.1-0.20260720133915-80bc87188ec3 (pre-release) or later · < 1.0.1-0.20260720133915-80bc87188ec3 · CVE-2026-77560 · GHSA-328g-jx67-v94g · amended
- Medium, CVSS 6.9
Tinyauth: User enumeration attack by timing oracle
Go github.com/tinyauthapp/tinyauth · Upgrade to 1.0.1-0.20260714134959-c22925c2fba9 (pre-release) or later · < 1.0.1-0.20260714134959-c22925c2fba9 · CVE-2026-77582 · GHSA-456h-ww26-f758 · amended
- High, CVSS 8.8
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.12.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62371 · GHSA-5jpj-293f-rhvj · amended
- Medium, CVSS 6.5
KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.0.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62370 · GHSA-gfw4-49f9-cp25 · amended
- High, CVSS 8.1
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.16.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62369 · GHSA-9vm9-pqxx-x83v · amended
- Medium, CVSS 6.0
OpenBao Skips Stricter Deny Policy for LIST operations
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260713133043-f58d848c139e (pre-release); some affected versions have no fix yet · < 0.0.0-20260713133043-f58d848c139e; >= 0.1.0, <= 1.1.5 · CVE-2026-63131 · GHSA-xp3c-3jw3-4vcr · amended
- Critical, CVSS 9.1
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260713141742-763625a20721 (pre-release); some affected versions have no fix yet · < 0.0.0-20260713141742-763625a20721; >= 0.1.0, <= 1.1.5 · CVE-2026-63132 · GHSA-34fc-gh42-pj53 · amended
- High, CVSS 7.5
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260710001938-2d4ebafec5c5 (pre-release); some affected versions have no fix yet · < 0.0.0-20260710001938-2d4ebafec5c5; >= 0.1.0, <= 1.1.5 · CVE-2026-71543 · GHSA-59w7-v8rr-pr4p · amended
- Low, CVSS 2.4
OpenBao Agent Writes Secrets to Stdout
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260714163218-90272575e5f5 (pre-release); some affected versions have no fix yet · < 0.0.0-20260714163218-90272575e5f5; >= 0.1.0, <= 1.1.5 · CVE-2026-77285 · GHSA-444v-8vxr-p36h · amended
- High, CVSS 8.8
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.21.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62182 · GHSA-m3c6-2p7h-cfr3 · amended
- High, CVSS 7.1
Unleash: Missing await on permission check + cross-project IDOR in admin API
npm unleash-server · Upgrade to 8.0.3 or later · < 8.0.3 · CVE-2026-77426 · GHSA-72h8-wp98-7hch · amended
- Medium, CVSS 4.3
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
npm unleash-server · Upgrade to 8.0.3 or later · < 8.0.3 · CVE-2026-77425 · GHSA-5ffh-6f9q-5hhr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.