High, CVSS 7.5
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · >= 2.1.0, <= 2.28.1 · CVE-2026-40607 · GHSA-f633-865q-2mhh
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.6
MantisBT has a Content Security Policy bypass via attachments
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · <= 2.28.1 · CVE-2026-40597 · GHSA-9c3j-xm6v-j7j3
- High, CVSS 7.2
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · >= 2.11.0, <= 2.28.1 · CVE-2026-40596 · GHSA-j3v9-553h-x28j
- High, CVSS 7.4
Yii 2: Local file inclusion via view parameter name collision
Packagist yiisoft/yii2 · Upgrade to 2.0.55 or later · < 2.0.55 · CVE-2026-39850 · GHSA-5vpg-rj7q-qpw2
- High, CVSS 8.6
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · <= 2.28.1 · CVE-2026-34463 · GHSA-fvjf-68wh-rwp2
- High, CVSS 7.1
MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
PyPI mlflow · Upgrade to 3.9.0 or later · < 3.9.0 · CVE-2026-2393 · GHSA-65h7-c7c4-mghx · amended
- Critical, CVSS 9.4
pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7813 · GHSA-h2x2-q2mc-24gw · amended
- High, CVSS 7.3
pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7818 · GHSA-4rhg-h8f2-v4jm · amended
- High, CVSS 8.7
SQL injection vulnerability in pgAdmin 4 Maintenance Tool
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7815 · GHSA-hp84-p2gq-6fvr · amended
- High, CVSS 7.1
pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7817 · GHSA-p58c-q354-6c4f · amended
- High, CVSS 7.2
pgAdmin 4 File Manager has symbolic-link path traversal
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7819 · GHSA-hr4r-fwpv-c95j · amended
- High, CVSS 8.7
pgAdmin 4: OS command injection vulnerability in Import/Export query export
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7816 · GHSA-j74f-g7vx-fh4x · amended
- Critical, CVSS 9.1
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
Maven io.unitycatalog:unitycatalog-server · Upgrade to 0.4.1 or later · <= 0.4.0 · CVE-2026-27478 · GHSA-qqcj-rghw-829x
- Critical, CVSS 9.8
WebdriverIO BrowserStack Service has a Command Injection issue
npm @wdio/browserstack-service · Upgrade to 9.24.0 or later · <= 9.23.2 · CVE-2026-25244 · GHSA-5c46-x3qw-q7j7 · amended
- High, CVSS 7.5
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
npm next · Upgrade to 16.2.6 or 15.5.18 by release line · >= 15.2.0, < 15.5.18; >= 16.0.0, < 16.2.6 · CVE-2026-45109 · GHSA-26hh-7cqf-hhc6 · amended
- Critical, CVSS 9.3
Angular Expressions - Remote Code Execution using filters
npm angular-expressions · Upgrade to 1.5.2 or later · <= 1.5.1 · CVE-2026-44643 · GHSA-pw8r-6689-xvf4 · amended
- High, CVSS 7.7
Budibase vulnerable to SSRF via trivial
.tar.gzsubstring bypass in Plugin URL upload (/api/plugin)npm budibase · Upgrade to 3.35.10 or later · < 3.35.10 · CVE-2026-45061 · GHSA-xh5j-727m-w6gg · amended
- High, CVSS 7.5
Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding
Go github.com/xddxdd/bird-lg-go · Upgrade to 0.0.0-20260507060110-0ff87024cb9e (pre-release) or later · < 0.0.0-20260507060110-0ff87024cb9e · CVE-2026-45047 · GHSA-39qr-rc93-vhqm
- High, CVSS 7.5
LiteLLM has a sandbox escape in custom-code guardrail
PyPI litellm · Upgrade to 1.83.10 or later · >= 1.81.8, < 1.83.10 · CVE-2026-40217 · GHSA-wxxx-gvqv-xp7p · amended
- High, CVSS 8.5
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
npm @github/copilot · Upgrade to 1.0.43 or later · <= 1.0.42 · CVE-2026-45033 · GHSA-9ccr-r5hg-74gf · amended
- High, CVSS 8.7
Local Path Provisioner Vulnerable to HelperPod Template Injection
Go github.com/rancher/local-path-provisioner · Upgrade to 0.0.36 or later · < 0.0.36 · CVE-2026-44543 · GHSA-7fxv-8wr2-mfc4
- High, CVSS 8.8
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
Packagist studio-42/elfinder · Upgrade to 2.1.68 or later · <= 2.1.67 · CVE-2026-44521 · GHSA-c3gj-q88f-7hqj
- High, CVSS 7.6
Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Maven com.ritense.valtimo:web · Upgrade to 13.26.0 or 12.33.0 by release line · >= 12.4.0, < 12.33.0; >= 13.0.0, < 13.26.0 · CVE-2026-44516 · GHSA-3jh5-rr2q-xfv7
- High, CVSS 7.5
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function
npm @theecryptochad/merge-guard · Upgrade to 1.0.1 or later · < 1.0.1 · GHSA-mhwj-73qx-jqxm · amended
- High, CVSS 8.2
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)
npm @rvf/set-get · Upgrade to 7.0.2 or 6.0.4 by release line · >= 7.0.0, < 7.0.2; >= 6.0.0, < 6.0.4 · CVE-2026-44483 · GHSA-c567-44rc-m5hq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.