High, CVSS 8.1
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96633 · GHSA-6vfx-w7q3-42gq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–74 of 74 matching · newest first
- High, CVSS 8.2
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · >= 4.6.0, < 5.5.1 · CVE-2026-96631 · GHSA-79wv-8rh2-9vp2 · amended
- High, CVSS 8.2
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96632 · GHSA-rx7m-wxwq-vxr9 · amended
- High, CVSS 7.2
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96630 · GHSA-q5mp-gfjf-cf2j · amended
- Medium, CVSS 6.8
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96629 · GHSA-wm25-49w3-5qrg · amended
- Medium, CVSS 4.8
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571
Maven gov.nsa.emissary:emissary · Upgrade to 8.51.0 or later · < 8.51.0 · CVE-2026-54442 · GHSA-c6q7-wqw2-h65w · amended
- Critical, CVSS 9.3
pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
GitHub Actions pypa/gh-action-pypi-publish · Upgrade to 1.14.3 or later · <= 1.14.2 · GHSA-5xjx-3w67-w9x9
- High, CVSS 7.5
AdminNeo: version-cache array injection causes persistent denial of service
Packagist adminneo-org/adminneo · Upgrade to 5.5.0 or later · >= 4.6.2, < 5.5.0 · CVE-2026-59978 · GHSA-jm85-8cpp-9cjc · amended
- High, CVSS 8.8
Parse Server 9.0.0 before 9.10.4 Unauthenticated Class Schema Deletion on MongoDB
Bitnami parse · Upgrade to 9.10.4 or 8.6.101 by release line · < 8.6.101; >= 9.0.0, < 9.10.4 · CVE-2026-116165 · GHSA-qmg9-m772-5rm7
- Medium, CVSS 6.3
Parse Server 9.0.0 before 9.10.4 Reserved Field Name Injection via Object Writes
Bitnami parse · Upgrade to 9.10.4 or 8.6.100 by release line · < 8.6.100; >= 9.0.0, < 9.10.4 · CVE-2026-116164 · GHSA-gwrq-q25v-g8mr
- Critical, CVSS 9.1
Parse Server 9.0.0 before 9.10.5 Authentication Bypass via AuthAdapter Subclasses
Bitnami parse · Upgrade to 9.10.5 or 8.6.102 by release line · < 8.6.102; >= 9.0.0, < 9.10.5 · CVE-2026-116163 · GHSA-rq3w-5c6f-p7wr
- Low, CVSS 2.1
Parse Server 9.0.0 before 9.10.5 Privilege Escalation via SMS MFA Login
Bitnami parse · Upgrade to 9.10.5 or 8.6.104 by release line · < 8.6.104; >= 9.0.0, < 9.10.5 · CVE-2026-116162 · GHSA-9rh6-r4ph-367v
- Medium, CVSS 6.0
Parse Server 9.0.0 before 9.10.5 LiveQuery Information Disclosure via $or Subscriptions
Bitnami parse · Upgrade to 9.10.5 or 8.6.103 by release line · < 8.6.103; >= 9.0.0, < 9.10.5 · CVE-2026-116161 · GHSA-349r-988w-x3jp
- Critical, CVSS 9.4
Distrust compromised intermediate certificates in ssl module
Bitnami python-min +2 · Upgrade all 3 to 3.15.2, 3.14.10, 3.13.18 or 2 more by release line · < 3.11.18; >= 3.12.0, < 3.12.16; >= 3.13.0, < 3.13.18; >= 3.14.0, < 3.14.10; >= 3.15.0, < 3.15.2 · CVE-2026-115557 · amended
- Medium, CVSS 6.9
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
PyPI joserfc · Upgrade to 1.7.6 or later · < 1.7.6 · CVE-2026-119284 · GHSA-9pg5-8c7x-5hfx · amended
- High, CVSS 7.5
joserfc: Unbounded JWE General JSON
recipientsArray Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI joserfc · Upgrade to 1.7.5 or later · < 1.7.5 · CVE-2026-119283 · GHSA-jpxq-7h8p-2q76 · amended
- Medium, CVSS 5.9
charmbracelet/soft-serve: Race in
SetPrivateleaves a private repository readable by unauthenticated usersGo github.com/charmbracelet/soft-serve · Upgrade to 0.12.3 or later · >= 0.6.0, < 0.12.3 · GHSA-f3fj-9625-rv3m · amended
- Medium, CVSS 5.3
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
Go github.com/charmbracelet/soft-serve · Upgrade to 0.12.3 or later · >= 0.5.0, < 0.12.3 · GHSA-fgxm-5hvv-x4vh · amended
- High, CVSS 7.3
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
npm @nx/gradle +1 · Upgrade all 2 to 23.1.2 or 22.7.9 by release line · >= 21.0.0, < 22.7.9; >= 23.0.0, < 23.1.2 · CVE-2026-119282 · GHSA-qm8w-vx34-5j9j · amended
- Medium, CVSS 6.8
libsqlite3-sysvia C SQLite CVE-2026-119375crates.io libsqlite3-sys · Upgrade to 0.39.0 or later · >= 0.6.0, < 0.39.0 · CVE-2026-119375 · GHSA-72w2-rjgg-q729
- High, CVSS 7.5
nix-nar:Decoder::unpackwrites archive entries outside the destination directory (path traversal)crates.io nix-nar · Upgrade to 0.6.0 or later · >= 0.0.0-0, < 0.6.0
- Unrated
BLAKE2b produces wrong tag when using
reset()with a different-length keycrates.io orion · Upgrade to 0.18.1 or 0.17.16 by release line · >= 0.0.0-0, < 0.17.16; >= 0.18.0-0, < 0.18.1 · GHSA-xcc6-f2jq-43x6
- High, CVSS 7.1
ocipkg: unpacking an OCI archive can write and delete files outside the local image store (path traversal)crates.io ocipkg · Upgrade to 0.4.1 or later · >= 0.0.0-0, < 0.4.1
- Unrated
LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time
crates.io orion · Upgrade to 0.18.1 or 0.17.16 by release line · >= 0.0.0-0, < 0.17.16; >= 0.18.0-0, < 0.18.1 · GHSA-r7wm-4vf2-h44w
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.