Low, CVSS 3.1
Fleet: ORDER BY column injection on activity list endpoints
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.89.0 or later · < 4.89.0 · CVE-2026-101046 · GHSA-rxhg-vcww-2mpw · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2626–2650 of 30,921 matching · newest first
- Medium, CVSS 5.3
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.87.0 or later · < 4.87.0 · CVE-2026-101047 · GHSA-q9c5-pp7m-fm2g · amended
- High, CVSS 8.4
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
Packagist winter/wn-system-module · Upgrade to 1.2.13 or later · >= 1.2.7, < 1.2.13 · CVE-2026-79774 · GHSA-8cfw-pcwh-v63w · amended
- Medium, CVSS 4.9
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Packagist winter/wn-system-module · Upgrade to 1.2.13 or later · < 1.2.13 · CVE-2026-79773 · GHSA-2223-f22x-24cq · amended
- High, CVSS 7.5
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63202 · GHSA-4899-mpch-38p3 · amended
- Medium, CVSS 4.9
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-63179 · GHSA-58fp-mcx6-7qf9 · amended
- High, CVSS 8.7
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61827 · GHSA-hmq9-67w8-j5pw · amended
- High, CVSS 7.5
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63124 · GHSA-8cfx-wx3q-mh5q · amended
- Medium, CVSS 5.3
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61799 · GHSA-pgrf-4654-3gq8 · amended
- High, CVSS 8.1
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Maven io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61798 · GHSA-2mc4-j865-9q4r · amended
- Medium, CVSS 4.3
django CMS: Missing authorization in
render_object_structurediscloses non-PageContent placeholder structure to low-privileged staffPyPI django-cms · Upgrade to 5.0.9 or later · < 5.0.9 · CVE-2026-61663 · GHSA-8qj2-c6q4-f399
- Medium, CVSS 6.5
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
PyPI django-cms · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-63003 · GHSA-6x92-6vx4-5fwr
- Medium, CVSS 4.4
django CMS: Stored XSS in edit-mode plugin exception rendering
PyPI django-cms · Upgrade to 5.0.9 or later · >= 5.0.8, < 5.0.9 · CVE-2026-75526 · GHSA-hvq6-2r72-p2x7
- Medium, CVSS 6.5
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
Packagist backpack/crud · Upgrade to 7.0.47 or 6.8.15 by release line · >= 7.0.0, < 7.0.47; >= 6.0.0, < 6.8.15 · CVE-2026-57570 · GHSA-42vx-43vc-x6pr · amended
- Medium, CVSS 4.3
Wagtail: Improper restriction handling on Pages admin API
PyPI wagtail · Upgrade to 8.0rc2 (pre-release), 7.4.3, 7.3.4 or 7.0.9 by release line · < 7.0.9; >= 7.1, < 7.3.4; >= 7.4, < 7.4.3; >= 8.0rc1, <= 8.0rc1 · CVE-2026-55468 · GHSA-3vrh-m9w7-v94f
- Unrated
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
npm @nocobase/server · Upgrade to 2.1.5 or later · < 2.1.5 · GHSA-ghvf-qf6h-g8x5
- Medium, CVSS 6.5
django CMS: Structure endpoint bypasses page-view permission
PyPI django-cms · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-54624 · GHSA-vgxm-h9gx-h9w7
- Medium, CVSS 6.5
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
PyPI django-cms · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-54622 · GHSA-4xfr-4p46-gc6p
- Medium, CVSS 5.4
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-54256 · GHSA-3277-h8g9-qj5f · amended
- High, CVSS 8.7
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
Maven io.netty.incubator:netty-incubator-codec-ohttp · Upgrade to 0.0.23.Final or later · < 0.0.23.Final · CVE-2026-54251 · GHSA-vmr9-j6wf-pmh2 · amended
- High, CVSS 7.6
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Go github.com/fleetdm/fleet +1 · Upgrade all 2 to 4.86.2 or later · < 4.86.2 · CVE-2026-54245 · GHSA-7q96-f8xw-jv5j · amended
- High, CVSS 8.1
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Packagist backpack/crud · Upgrade to 7.0.36, 6.8.13, 5.6.2 or 4.1.72 by release line · >= 4.1.0, < 4.1.72; >= 5.0.0, < 5.6.2; >= 6.0.0, < 6.8.13; >= 7.0.0, < 7.0.36 · CVE-2026-54182 · GHSA-mrc5-3mm3-45c5 · amended
- Medium, CVSS 5.4
Laravel Backpack CRUD: Stored XSS in the color column — the
@if($column['escaped'])branches are invertedPackagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54181 · GHSA-mmg4-322v-6jvc · amended
- High, CVSS 7.6
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Packagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54180 · GHSA-vgmv-8xjc-6rch · amended
- Medium, CVSS 4.4
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a
data:imageprefix — SVG-with-script lands on the public diskPackagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54179 · GHSA-8hw4-7qjr-3wxg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.