High, CVSS 7.6
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · >= 4.1.1, <= 4.1.1 · CVE-2026-46367 · GHSA-9525-27vj-c8r8
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Micronaut has unbounded
formattersCacheinTimeConverterRegistrarthat Allows Memory Exhaustion viaAccept-LanguageHeaderMaven io.micronaut:micronaut-context · Upgrade to 4.10.22, 3.10.6 or 3.8.14 by release line · >= 4.3.0, < 4.10.22; >= 3.10.0, < 3.10.6; < 3.8.14 · CVE-2026-44241 · GHSA-8hjv-92q9-g4xj
- High, CVSS 8.8
Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain
Go github.com/mezo-org/mezod · Upgrade to 8.0.0 or later · <= 7.0.0 · GHSA-6447-269v-g68m
- Critical, CVSS 9.4
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
Packagist dedoc/scramble · Upgrade to 0.13.22 or later · >= 0.13.2, <= 0.13.21 · CVE-2026-44262 · GHSA-4rm2-28vj-fj39
- Critical, CVSS 9.9
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
PyPI wger · Upgrade to 2.6 or later · <= 2.5 · CVE-2026-43948 · GHSA-mhc8-p3jx-84mm · amended
- High, CVSS 7.4
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
PyPI wger · Upgrade to 2.6 or later · <= 2.5 · CVE-2026-86257 · GHSA-xq9m-hmp9-fw87 · amended
- High, CVSS 7.8
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
PyPI gitpython · Upgrade to 3.1.48 or later · <= 3.1.47 · CVE-2026-44243 · GHSA-7545-fcxq-7j24 · amended
- High, CVSS 7.5
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
npm basic-ftp · Upgrade to 5.3.1 or later · <= 5.3.0 · CVE-2026-44240 · GHSA-rpmf-866q-6p89 · amended
- High, CVSS 8.1
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
PyPI lemur · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-44304 · GHSA-3r34-vq8m-39gh · amended
- High, CVSS 7.5
Nokogiri CSS selector tokenizer has regular expression backtracking
RubyGems nokogiri · Upgrade to 1.19.3 or later · < 1.19.3 · CVE-2026-79770 · GHSA-c4rq-3m3g-8wgx
- High, CVSS 8.7
dssrf: every IPv6 category bypasses is_url_safe
npm dssrf · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2026-44232 · GHSA-8p33-q827-ghj5 · amended
- High, CVSS 8.7
phpseclib: guardrails needed on isPrime and randomPrime
Packagist phpseclib/phpseclib · Upgrade to 3.0.36, 2.0.47 or 1.0.23 by release line · >= 0.1.1, < 1.0.23; >= 2.0.0, < 2.0.47; >= 3.0.0, < 3.0.36 · CVE-2024-27354 · GHSA-2528-jw5q-ww88
- High, CVSS 7.1
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Packagist craftcms/cms · Upgrade to 5.9.18 or later · >= 5.0.0-RC1, < 5.9.18 · CVE-2026-44012 · GHSA-33m5-hqp9-97pw
- High, CVSS 8.6
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
Packagist craftcms/cms · Upgrade to 5.9.18 or 4.17.12 by release line · >= 4.0.0, < 4.17.12; >= 5.0.0, < 5.9.18 · CVE-2026-44011 · GHSA-qrgm-p9w5-rrfw
- High, CVSS 7.1
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
Packagist craftcms/cms · Upgrade to 5.9.18 or 4.17.12 by release line · >= 5.0.0, < 5.9.18; >= 4.0.0, < 4.17.12 · CVE-2026-44010 · GHSA-gj2p-p9m4-c8gw
- High, CVSS 7.7
DevSpace UI Server WebSocket CheckOrigin does not validate source
Go github.com/loft-sh/devspace · Upgrade to 6.3.21 or later · >= 6.3.20, <= 6.3.20 · CVE-2026-42283 · GHSA-hqwm-7x7x-8379
- High, CVSS 7.1
Auth.js SDK has Improper Permission Checking
npm auth0-js · Upgrade to 10.0.0 or later · >= 8.11.0, <= 9.32.0 · CVE-2026-42280 · GHSA-8qjv-jj2q-x832 · amended
- Critical, CVSS 9.0
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
Go github.com/0xJacky/nginx-ui · Upgrade to 2.3.8 or later · < 2.3.8 · CVE-2026-42238 · GHSA-4pvg-prr3-9cxr
- High, CVSS 8.1
Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
Go github.com/0xJacky/Nginx-UI · Upgrade to 2.3.8 or later · >= 2.0.0, <= 2.3.5 · CVE-2026-42221 · GHSA-h27v-ph7w-m9fp
- High, CVSS 8.7
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
PyPI mistune · Upgrade to 3.2.1 or later · >= 3.0.0a1, <= 3.2.0 · CVE-2026-33079 · GHSA-8mp2-v27r-99xp · amended
- Critical, CVSS 9.0
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
PyPI rucio · Upgrade to 40.1.1, 39.4.2, 38.5.5 or 35.8.5 by release line · >= 1.30.0, < 35.8.5; >= 36.0.0, < 38.5.5; >= 39.0.0, < 39.4.2; >= 40.0.0, < 40.1.1 · CVE-2026-29090 · GHSA-6j7p-qjhg-9947 · amended
- Critical, CVSS 9.4
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
PyPI rucio · Upgrade to 40.1.1, 39.4.2, 38.5.5 or 35.8.5 by release line · >= 1.27.0, < 35.8.5; >= 36.0.0, < 38.5.5; >= 39.0.0, < 39.4.2; >= 40.0.0, < 40.1.1 · CVE-2026-29080 · GHSA-vjr5-c9qv-hgm3 · amended
- High, CVSS 7.5
Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Maven org.apache.wicket:wicket-parent · Upgrade to 10.9.0; some affected versions have no fix yet · >= 8.0.0-M1, <= 8.17.0; >= 9.0.0-M1, <= 9.22.0; >= 10.0.0-M1, <= 10.8.0 · CVE-2026-43646 · GHSA-jvv4-8wxx-m5r6
- Critical, CVSS 9.1
Apache Wicket has a Session Fixation issue
Maven org.apache.wicket:wicket-auth-roles · Upgrade to 10.9.0; some affected versions have no fix yet · >= 8.0.0-M1, <= 8.17.0; >= 9.0.0-M1, <= 9.22.0; >= 10.0.0-M1, <= 10.8.0 · CVE-2026-40010 · GHSA-qpjw-p3jg-59j6
- Critical, CVSS 9.0
ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases
Maven com.arcadedb:arcadedb-server · Upgrade to 26.4.2 or later · >= 21.10.1, < 26.4.2 · CVE-2026-44221 · GHSA-fxc7-fm93-6q77
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.