High, CVSS 8.8
Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.33.0 or later · <= 8.32.0 · CVE-2026-44829 · GHSA-hwc4-gmrw-5222
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.0
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
npm axios · Upgrade to 1.15.2 or 0.31.1 by release line · >= 1.0.0, < 1.15.2; >= 0.19.0, < 0.31.1 · CVE-2026-44495 · GHSA-3g43-6gmg-66jw · amended
- High, CVSS 8.7
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in
config.proxynpm axios · Upgrade to 1.16.0 or later · >= 1.0.0, < 1.16.0 · CVE-2026-44494 · GHSA-35jp-ww65-95wh · amended
- High, CVSS 8.6
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · <= 0.31.1; >= 1.15.0, < 1.16.0 · CVE-2026-44492 · GHSA-pjwm-pj3p-43mv · amended
- High, CVSS 8.6
Froxlor has an incomplete fix for CVE-2026-30932
Packagist froxlor/froxlor · Upgrade to 2.3.7 or later · <= 2.3.6 · CVE-2026-41237 · GHSA-j6fm-9rfm-j5hx
- High, CVSS 8.8
Froxlor has privilege escalation in SSH key synchronization via symlinked
authorized_keyspathPackagist froxlor/froxlor · Upgrade to 2.3.7 or later · >= 2.3.6, <= 2.3.6 · CVE-2026-41236 · GHSA-mq5v-pxpm-8jw2
- High, CVSS 8.6
Froxlor has an authorization bypass in FTP shell assignment via missing server-side
available_shellsenforcementPackagist froxlor/froxlor · Upgrade to 2.3.7 or later · >= 2.3.6, <= 2.3.6 · CVE-2026-41235 · GHSA-gcv3-5v9q-fmhh
- High, CVSS 7.4
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via
gh attestation,gh release verify, andgh release verify-assetcommandsGo github.com/cli/cli/v2 · Upgrade to 2.93.0 or later · <= 2.92.0 · CVE-2026-48501 · GHSA-8xvp-7hj6-mcj9
- High, CVSS 8.7
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.1 or later · <= 26.0.0 · CVE-2026-48527 · GHSA-g2g8-95qg-v35h · amended
- High, CVSS 7.7
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.4 or later · <= 1.19.3 · CVE-2026-47179 · GHSA-c3px-h233-h6fq
- High, CVSS 7.7
Dulwich Vulnerable to Command Injection via Merge Driver Path
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.24.0, < 1.2.5 · CVE-2026-42563 · GHSA-9277-mp7x-85jf · amended
- High, CVSS 8.8
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.10.0, < 1.2.5 · CVE-2026-42305 · GHSA-897w-fcg9-f6xj · amended
- High, CVSS 7.0
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; <= 11.5.16; >= 2026.1.0, < 2026.1.3 · CVE-2026-5394 · GHSA-r2f4-ff2p-xc64
- High, CVSS 7.8
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · <= 3.12.1; >= 4.0.0, < 4.0.3 · CVE-2026-46439 · GHSA-gg2g-p7xc-qqmm · amended
- High, CVSS 7.2
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calicoctl/v3 · Upgrade to 3.31.6 or later · < 3.31.6 · CVE-2026-6720 · GHSA-3m4q-ggcj-j6m4
- Critical, CVSS 9.8
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
Go github.com/casdoor/casdoor · Upgrade to 2.387.0 or later · < 2.387.0 · CVE-2026-9094 · GHSA-c9w5-qp6m-m395
- High, CVSS 7.2
OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd
PyPI pycti · Upgrade to 6.9.7 or later · < 6.9.7 · CVE-2026-44730 · GHSA-q537-qhj4-wcjx · amended
- High, CVSS 8.4
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, < 4.0.3; <= 3.12.1 · CVE-2026-46345 · GHSA-4q5v-7g7x-j79w · amended
- High, CVSS 7.1
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-45808 · GHSA-v8v8-cm84-m686
- High, CVSS 8.5
Apache Ignite REST API Has a Relative Path Traversal Vulnerability
Maven org.apache.ignite:ignite-core · Upgrade to 2.18.0 or later · >= 2.0.0, < 2.18.0 · CVE-2025-48977 · GHSA-v45h-mqf4-6939
- Critical, CVSS 9.4
MCP Toolbox for Databases vulnerable to DNS rebinding attacks
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2026-9739 · GHSA-7pf3-8xx7-rvhf
- High, CVSS 7.1
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, <= 4.0.2; < 3.12.2 · CVE-2026-45725 · GHSA-g3vg-vx23-3858 · amended
- High, CVSS 7.5
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0, <= 1.3.0 · CVE-2026-47717 · GHSA-q3w6-q3hc-c5x6 · amended
- High, CVSS 8.4
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
Go github.com/kata-containers/kata-containers · Upgrade to 0.0.0-20260519062212-ffa59ce3aa78 (pre-release) or later · < 0.0.0-20260519062212-ffa59ce3aa78 · CVE-2026-47243 · GHSA-2gv2-cffp-j227
- Critical, CVSS 9.1
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Maven org.yamcs:yamcs-core · Upgrade to 5.12.7 or later · < 5.12.7 · CVE-2026-46621 · GHSA-2g95-6x5q-xjwj
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.