High, CVSS 8.1
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
PyPI open-webui · Upgrade to 0.9.0 or later · <= 0.8.12 · CVE-2026-44553 · GHSA-45m8-cpm2-3v65 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Open WebUI has an LDAP Empty Password Authentication Bypass
PyPI open-webui · Upgrade to 0.9.0 or later · <= 0.8.12 · CVE-2026-44551 · GHSA-2r4p-jpmg-48f4 · amended
- High, CVSS 7.6
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
npm @mikro-orm/sql · Upgrade to 7.0.14 or later · <= 7.0.13 · +1 more package · CVE-2026-44680 · GHSA-cfw5-68c4-ffqp · amended
- High, CVSS 7.5
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
npm fast-uri · Upgrade to 3.1.2 or 2.4.1 by release line · >= 3.0.0, <= 3.1.1; <= 2.4.0 · CVE-2026-6322 · GHSA-v39h-62p7-jpjc · amended
- High, CVSS 8.7
Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
crates.io zebrad · Upgrade to 4.4.0 or later · < 4.4.0 · CVE-2026-44499 · GHSA-h9hm-m2xj-4rq9
- High, CVSS 7.3
open-webui Vulnerable to Stored XSS via Model Description
npm open-webui +1 · Upgrade all 2 to 0.9.0 or later · <= 0.8.12 · CVE-2026-44721 · GHSA-gf5m-wcrh-7928 · amended
- Critical, CVSS 9.4
Electerm users can run dangrous code through link or command line
npm electerm · Upgrade to 3.8.8 or later · >= 3.0.6, < 3.8.8 · CVE-2026-43944 · GHSA-mpm8-cx2p-626q · amended
- High, CVSS 8.8
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
npm electerm · Upgrade to 3.7.9 or later · <= 3.7.8 · CVE-2026-43943 · GHSA-q4p8-8j9m-8hxj · amended
- Critical, CVSS 9.8
Electerm runWidget has a path traversal that leads to arbitrary code execution
npm electerm · Upgrade to 3.7.16 or later · < 3.7.16 · CVE-2026-43940 · GHSA-f77v-9vpc-6pjm · amended
- Critical, CVSS 9.3
Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output
crates.io zebra-script · Upgrade to 6.0.1 or later · < 6.0.1 · +1 more package · GHSA-pvmv-cwg8-v6c8
- High, CVSS 7.5
phpseclib guardrails needed on OID length
Packagist phpseclib/phpseclib · Upgrade to 3.0.36, 2.0.47 or 1.0.23 by release line · >= 2.0.0, <= 2.0.46; >= 3.0.0, <= 3.0.35; >= 0.1.1, <= 1.0.22 · CVE-2024-27355 · GHSA-f2qx-66wf-wvvx
- High, CVSS 7.5
bitcoinj has a ScriptExecution P2PKH/P2WPKH Verification Bypass
Maven org.bitcoinj:bitcoinj-core · Upgrade to 0.17.1 or later · >= 0.15, < 0.17.1 · CVE-2026-44714 · GHSA-hfcf-v2f8-x9pc
- High, CVSS 7.5
fast-uri vulnerable to path traversal via percent-encoded dot segments
npm fast-uri · Upgrade to 3.1.1 or 2.4.1 by release line · >= 3.0.0, <= 3.1.0; <= 2.4.0 · CVE-2026-6321 · GHSA-q3j6-qgpj-74h6 · amended
- High, CVSS 7.5
@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
npm @fastify/accepts-serializer · Upgrade to 6.0.4 or later · <= 6.0.3 · CVE-2026-7768 · GHSA-qxhc-wx3p-2wmg · amended
- High, CVSS 7.5
ZITADEL has LDAP Filter Injection in Login Flow
Go github.com/zitadel/zitadel · Upgrade to 4.15.0 or 3.4.10 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.14.0; >= 2.71.11, <= 2.71.19; >= 3.1.0, <= 3.4.9 · CVE-2026-44671 · GHSA-rxvx-hhpj-q6px
- High, CVSS 8.3
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
npm n8n-mcp · Upgrade to 2.50.1 or later · < 2.50.1 · GHSA-8g7g-hmwm-6rv2 · amended
- High, CVSS 7.2
n8n-mcp webhook and API client paths has an authenticated SSRF
npm n8n-mcp · Upgrade to 2.50.2 or later · >= 2.18.7, < 2.50.2 · CVE-2026-44694 · GHSA-cmrh-wvq6-wm9r · amended
- Critical, CVSS 9.3
PrestaShop has a stored XSS executable in customer service view
Packagist prestashop/prestashop · Upgrade to 9.1.1 or 8.2.6 by release line · < 8.2.6; >= 9.0.0, < 9.1.1 · CVE-2026-44212 · GHSA-w9f3-qc75-qgx9
- Critical, CVSS 9.4
SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260512140701-d7b77d945e0d (pre-release) or later · <= 0.0.0-20260421031503-96dfe0bea474 · CVE-2026-44670 · GHSA-2h64-c999-c9r6
- High, CVSS 8.3
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
PyPI gmaps-mcp · Upgrade to 0.1.3 or later · <= 0.1.2 · GHSA-52cq-7v8r-62c6 · amended
- High, CVSS 8.7
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
npm fast-xml-builder · Upgrade to 1.1.7 or later · <= 1.1.6 · CVE-2026-44665 · GHSA-5wm8-gmm8-39j9 · amended
- Critical, CVSS 9.8
vm2 has Sandbox Breakout Through Null Proto Exception
npm vm2 · Upgrade to 3.11.2 or later · < 3.11.2 · CVE-2026-44009 · GHSA-9vg3-4rfj-wgcm · amended
- Critical, CVSS 9.8
vm2 has sandbox breakout via
neutralizeArraySpeciesBatchnpm vm2 · Upgrade to 3.11.2 or later · < 3.11.2 · CVE-2026-44008 · GHSA-9qj6-qjgg-37qq · amended
- High, CVSS 7.5
Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
Maven org.apache.nifi:nifi-other-graph-services-nar · Upgrade to 2.9.0 or later · >= 2.0.0-M1, <= 2.8.0 · CVE-2026-39816 · GHSA-2j9m-25xv-mp6r
- High, CVSS 7.5
PYSEC-2026-37
PyPI dash-uploader · Upgrade to 0.7.0a1 (pre-release) or later · >= 0.1.0, < 0.7.0a1 · CVE-2026-38361
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.