Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 0.13.0, < 2.7.0 · CVE-2026-111921 · GHSA-fmmf-xq98-g327 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 60 matching · newest first
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 0.13.0, < 2.7.0 · CVE-2026-111921 · GHSA-fmmf-xq98-g327 · amended
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 2.6.0, < 2.7.0 · CVE-2026-111920 · GHSA-pjr3-86v4-5p7w · amended
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 1.0.0-rc0, < 2.7.0 · CVE-2026-111918 · GHSA-fprf-r6rv-xg99 · amended
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 2.3.0, < 2.7.0 · CVE-2026-111917 · GHSA-4hv6-xc92-j86g · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260901043436-8c9b9a1aff21 (pre-release) or later · >= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21 · CVE-2026-107805 · GHSA-j3hg-9rp3-5hw9 · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260904075558-e30e331303fc (pre-release) or later · >= 1.9.10-0.20251005005631-6de168c9454, < 1.9.10-0.20260904075558-e30e331303fc · CVE-2026-107804 · GHSA-9h23-53f4-q947 · amended
npm @tinacms/cli · Upgrade to 3.0.0 or later · <= 2.7.0 · CVE-2026-108259 · GHSA-pwhx-cvv3-qj5c · amended
npm tinacms · Upgrade to 3.14.0 or later · <= 3.13.0 · +1 more package · CVE-2026-108261 · GHSA-x34j-47hf-4xg7 · amended
tina-markdown writes rich-text link URLs into href without scheme validation, allowing stored XSSnpm @tinacms/web-components · Upgrade to 0.2.1 or later · <= 0.2.0 · CVE-2026-108260 · GHSA-c42q-qvc3-j6vg · amended
PyPI shiny · Upgrade to 1.6.4 or later · >= 1.4.0, <= 1.6.3 · CVE-2026-108258 · GHSA-47c3-hpmg-7j6p · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · GHSA-8wvg-r2j4-3737 · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · GHSA-3hc7-r24j-rpwc · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · GHSA-g38j-7v97-x298 · amended
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107842 · GHSA-x2rp-9qf7-2fmq · amended
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.1.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107843 · GHSA-mfxh-vp55-7gc6 · amended
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107848 · GHSA-9ff2-p842-45wq · amended
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.1.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107844 · GHSA-mrvp-7wmx-5m4h · amended
Packagist contao/comments-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107845 · GHSA-628f-v4f6-p37r · amended
Packagist contao/core-bundle · Upgrade to 5.7.12 or later · >= 5.7.1, < 5.7.12 · CVE-2026-107850 · GHSA-q6wp-fr43-gm9v · amended
Packagist contao/core-bundle · Upgrade to 5.7.12 or later · >= 5.7.0, < 5.7.12 · CVE-2026-107851 · GHSA-5974-gfqc-wrcm · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · >= 2.5.0, < 2.6.0 · CVE-2026-91970 · GHSA-wq92-8x3r-fm38 · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · >= 2.5.0, <= 2.5.0 · CVE-2026-91969 · GHSA-pqf9-h8g4-8gmh · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · >= 2.5.0, <= 2.5.0 · CVE-2026-91968 · GHSA-xxc3-xpmc-vmvr · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91979 · GHSA-w7jp-mf2v-8342 · amended
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91981 · GHSA-vfxw-3x8p-2vjr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.