Critical, CVSS 9.1
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
PyPI apache-airflow-providers-sftp · Upgrade to 5.8.1 or later · < 5.8.1 · CVE-2026-50203 · GHSA-qf38-jq28-3ccq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Apache DolphinScheduler: The
/v2experimental interface lacks permission checksMaven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32967 · GHSA-85g9-8j9g-p486
- Critical, CVSS 9.8
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32966 · GHSA-r989-cjhx-3v49
- High, CVSS 7.5
Multer vulnerable to Denial of Service via deeply nested field names
npm multer · Upgrade to 3.0.0-alpha.2 (pre-release) or 2.2.0 by release line · >= 1.0.0, < 2.2.0; >= 3.0.0-alpha.1, < 3.0.0-alpha.2 · CVE-2026-5079 · GHSA-72gw-mp4g-v24j · amended
- High, CVSS 8.7
Gitea: Stored XSS via glTF
extensionsRequiredin Gitea 3D File ViewerGo code.gitea.io/gitea · Upgrade to 1.26.0 or later · >= 1.25.0, < 1.26.0 · CVE-2026-28737 · GHSA-9cpj-qc93-vw8v
- High, CVSS 8.1
Gitea: Public-only tokens bypass private-resource restrictions on
/api/v1/userself routesGo code.gitea.io/gitea · Upgrade to 1.26.2 or later · >= 1.22.3, <= 1.26.1 · CVE-2026-24791 · GHSA-wrr5-99h5-gq57
- High, CVSS 8.1
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
Go code.gitea.io/gitea · Upgrade to 1.26.0 or later · < 1.26.0 · CVE-2026-22555 · GHSA-fhx7-m96w-mv29
- High, CVSS 7.7
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54018 · GHSA-jrfp-m64g-pcwv · amended
- High, CVSS 7.7
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54017 · GHSA-r2wg-2mcr-66rv · amended
- High, CVSS 7.1
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
npm openclaw · Upgrade to 2026.5.12 or later · < 2026.5.12 · CVE-2026-53840 · GHSA-rjxq-qqhf-8hwh · amended
- High, CVSS 7.6
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54013 · GHSA-v2qm-5wxj-qhj7 · amended
- High, CVSS 7.1
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54012 · GHSA-vjqm-6gcc-62cr · amended
- High, CVSS 8.7
Open WebUI: Stored XSS in Mermaid Markdown Preview
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54011 · GHSA-v8qj-hxv7-mgvv · amended
- High, CVSS 8.3
Open WebUI: Forged chat-file link allows cross-user file read and deletion
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54010 · GHSA-vrhc-3fr6-pc3c · amended
- High, CVSS 8.5
Open WebUI: Redirect-Bypass SSRF in OAuth
_process_picture_url(incomplete-fix sibling of CVE-2026-45401)PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54008 · GHSA-226f-f24g-524w · amended
- High, CVSS 7.1
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54007 · GHSA-3vv5-8xxp-4f55 · amended
- High, CVSS 8.9
Laravel Framework: CRLF injection in default email rule
Packagist laravel/framework · Upgrade to 13.10.0 or 12.60.0 by release line · >= 13.0.0, <= 13.9.0; < 12.60.0 · GHSA-5vg9-5847-vvmq
- High, CVSS 8.5
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · <= 1.26.1 · CVE-2026-26231 · GHSA-mm7c-rhg6-qr4r
- High, CVSS 8.1
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · <= 1.26.1 · CVE-2026-28699 · GHSA-9r5x-wg6m-x2rc
- High, CVSS 8.5
Gogs: Overwriting critical files results in a denial of service
Go gogs.io/gogs · Upgrade to 0.14.0 or later · <= 0.13.4 · CVE-2026-52797 · GHSA-pm6v-2h4w-4rp2
- Critical, CVSS 9.5
LiteLLM: Authentication Bypass via Host Header Injection
PyPI litellm · Upgrade to 1.84.0 or later · < 1.84.0 · CVE-2026-49468 · GHSA-4xpc-pv4p-pm3w · amended
- High, CVSS 8.1
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · <= 1.26.1 · CVE-2026-28744 · GHSA-cc8w-r4qh-3v65 · amended
- High, CVSS 7.1
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
npm n8n · Upgrade to 2.26.1, 2.25.7 or 1.123.55 by release line · < 1.123.55; >= 2.26.0, < 2.26.1; >= 2.0.0-rc.0, < 2.25.7 · CVE-2026-54304 · GHSA-rm2v-h48j-895m · amended
- High, CVSS 8.8
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
npm n8n · Upgrade to 2.26.2 or 2.25.7 by release line · >= 2.26.0, < 2.26.2; < 2.25.7 · CVE-2026-54309 · GHSA-qrx8-25qr-5r7v · amended
- High, CVSS 8.9
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
npm n8n · Upgrade to 2.26.2, 2.25.7 or 1.123.55 by release line · < 1.123.55; >= 2.26.0, < 2.26.2; >= 2.0.0-rc.0, < 2.25.7 · CVE-2026-54305 · GHSA-2j5h-858j-5mpf · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.