High, CVSS 8.1
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96633 · GHSA-6vfx-w7q3-42gq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · >= 4.6.0, < 5.5.1 · CVE-2026-96631 · GHSA-79wv-8rh2-9vp2 · amended
- High, CVSS 8.2
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96632 · GHSA-rx7m-wxwq-vxr9 · amended
- High, CVSS 7.2
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96630 · GHSA-q5mp-gfjf-cf2j · amended
- Critical, CVSS 9.3
pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
GitHub Actions pypa/gh-action-pypi-publish · Upgrade to 1.14.3 or later · <= 1.14.2 · GHSA-5xjx-3w67-w9x9
- High, CVSS 7.5
AdminNeo: version-cache array injection causes persistent denial of service
Packagist adminneo-org/adminneo · Upgrade to 5.5.0 or later · >= 4.6.2, < 5.5.0 · CVE-2026-59978 · GHSA-jm85-8cpp-9cjc · amended
- High, CVSS 8.8
Parse Server 9.0.0 before 9.10.4 Unauthenticated Class Schema Deletion on MongoDB
Bitnami parse · Upgrade to 9.10.4 or 8.6.101 by release line · < 8.6.101; >= 9.0.0, < 9.10.4 · CVE-2026-116165 · GHSA-qmg9-m772-5rm7
- Critical, CVSS 9.1
Parse Server 9.0.0 before 9.10.5 Authentication Bypass via AuthAdapter Subclasses
Bitnami parse · Upgrade to 9.10.5 or 8.6.102 by release line · < 8.6.102; >= 9.0.0, < 9.10.5 · CVE-2026-116163 · GHSA-rq3w-5c6f-p7wr
- Critical, CVSS 9.4
Distrust compromised intermediate certificates in ssl module
Bitnami python-min +2 · Upgrade all 3 to 3.15.2, 3.14.10, 3.13.18 or 2 more by release line · < 3.11.18; >= 3.12.0, < 3.12.16; >= 3.13.0, < 3.13.18; >= 3.14.0, < 3.14.10; >= 3.15.0, < 3.15.2 · CVE-2026-115557 · amended
- High, CVSS 7.5
joserfc: Unbounded JWE General JSON
recipientsArray Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI joserfc · Upgrade to 1.7.5 or later · < 1.7.5 · CVE-2026-119283 · GHSA-jpxq-7h8p-2q76 · amended
- High, CVSS 7.3
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
npm @nx/gradle +1 · Upgrade all 2 to 23.1.2 or 22.7.9 by release line · >= 21.0.0, < 22.7.9; >= 23.0.0, < 23.1.2 · CVE-2026-119282 · GHSA-qm8w-vx34-5j9j · amended
- High, CVSS 7.5
nix-nar:Decoder::unpackwrites archive entries outside the destination directory (path traversal)crates.io nix-nar · Upgrade to 0.6.0 or later · >= 0.0.0-0, < 0.6.0
- High, CVSS 7.1
ocipkg: unpacking an OCI archive can write and delete files outside the local image store (path traversal)crates.io ocipkg · Upgrade to 0.4.1 or later · >= 0.0.0-0, < 0.4.1
A vendor fix does not resolve your finding until you verify it in your own systems.