High, CVSS 7.5
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48151 · GHSA-qhv3-wjg8-6fx6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.0
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48150 · GHSA-6xp4-cf37-ppjh · amended
- High, CVSS 7.2
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
Maven org.geoserver.web:gs-web-sec-core +1 · Upgrade all 2 to 2.27.3 or 2.26.4 by release line · >= 2.27.0, <= 2.27.2; <= 2.26.3 · CVE-2025-52465 · GHSA-7qmg-grcp-qf25
- High, CVSS 7.7
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48146 · GHSA-g6qx-g4pr-92v7 · amended
- High, CVSS 8.9
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
Go github.com/google/go-attestation · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-12681 · GHSA-9r4w-jg96-92mv
- High, CVSS 8.5
Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
Go github.com/jpillora/chisel · Upgrade to 1.11.5 or later · <= 1.11.4 · CVE-2026-48113 · GHSA-24fp-5v3p-rvpw
- Critical, CVSS 9.8
Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
Maven org.apache.cxf:cxf-rt-transports-jms · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.1.0, < 4.1.7; < 3.6.12 · CVE-2026-50632 · GHSA-93g8-qqv3-mrx8
- High, CVSS 7.5
Apache cxf-core: No restriction on attachment headers per message
Maven org.apache.cxf:cxf-core · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12 · CVE-2026-50645 · GHSA-ghvc-7hp8-2g2v
- Critical, CVSS 9.8
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Maven org.apache.cxf:cxf-integration-jca · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50633 · GHSA-qp3f-rvj8-46c8
- Critical, CVSS 9.1
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50627 · GHSA-9mrv-8pvf-hf4m
- Critical, CVSS 9.8
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50628 · GHSA-g5v7-jchf-7jrr
- High, CVSS 8.2
Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50629 · GHSA-f8p7-h97q-7vx7
- Critical, CVSS 9.8
Apache CXF has Improper Restriction of XML External Entity Reference
Maven org.apache.cxf:cxf-core · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12 · CVE-2026-49875 · GHSA-xw5h-cmh3-8j6j · amended
- High, CVSS 7.4
Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50631 · GHSA-83r6-96m8-r52p
- High, CVSS 8.5
SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek
Bitnami sqlite · Upgrade to 3.53.2 or later · < 3.53.2 · CVE-2026-11822
- High, CVSS 8.2
MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0.214-rc.1, < 3.1.7 · CVE-2026-48109 · GHSA-hv8m-jj95-wg3x
- High, CVSS 7.2
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
Maven org.geoserver.extension:gs-db2 · Upgrade to 2.27.0 or later · < 2.27.0 · CVE-2025-27511 · GHSA-g628-r368-6vh7
- High, CVSS 7.5
Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds
crates.io russh · Upgrade to 0.61.0 or later · >= 0.34.0, < 0.61.0 · CVE-2026-48110 · GHSA-4r3c-5hpg-58qr
- High, CVSS 7.1
WsgiDAV encoded dot segments can escape filesystem share roots
PyPI wsgidav · Upgrade to 4.3.4 or later · <= 4.3.3 · CVE-2026-48099 · GHSA-wxq4-cc2q-338q · amended
- High, CVSS 7.1
DevGuard has improper authorization on public assets
Go github.com/l3montree-dev/devguard · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-48089 · GHSA-6p54-fw2f-q7gf
- High, CVSS 8.7
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-48059 · GHSA-h2qv-fj59-j46j
- High, CVSS 8.8
Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
Go github.com/basekick-labs/arc · Upgrade to 0.0.0-20260520170331-32a4091fb949 (pre-release) or later · < 0.0.0-20260520170331-32a4091fb949 · CVE-2026-48050 · GHSA-j93g-rp6m-j32m
- High, CVSS 8.1
Keras archive extraction utilities allow path traversal and arbitrary file writes
PyPI keras · Upgrade to 3.14.0 or later · < 3.14.0 · CVE-2026-11816 · GHSA-hqp4-2352-xf5r · amended
- Critical, CVSS 9.1
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
PyPI meta-ads-mcp · Upgrade to 1.0.109 or later · <= 1.0.108 · CVE-2026-48039 · GHSA-9gw6-46qc-99vr · amended
- High, CVSS 7.5
@grpc/grpc-js: A malformed request can cause a server crash
npm @grpc/grpc-js · Upgrade to 1.14.4, 1.13.5, 1.12.7 or 3 more by release line · < 1.9.16; >= 1.10.0, < 1.10.12; >= 1.11.0, < 1.11.4; >= 1.12.0, < 1.12.7; >= 1.13.0, < 1.13.5; >= 1.14.0, < 1.14.4 · CVE-2026-48068 · GHSA-5375-pq7m-f5r2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.