High, CVSS 7.5
OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
Bitnami openbao · Upgrade to 2.6.3 or later · >= 2.3.0, < 2.6.3 · CVE-2026-115365 · GHSA-mjch-vcw3-hhmf
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
326–350 of 30,910 matching · newest first
- Low, CVSS 2.1
OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
Bitnami openbao · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2026-115364 · GHSA-8gmq-wv9h-fcwp
- Low, CVSS 2.1
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
Bitnami openbao · Upgrade to 2.7.1 or 2.6.4 by release line · >= 2.2.0, < 2.6.4; >= 2.7.0, < 2.7.1 · CVE-2026-115363 · GHSA-3237-j65r-m5rp
- Low, CVSS 2.1
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass
Bitnami openbao · Upgrade to 2.7.1 or 2.6.4 by release line · < 2.6.4; >= 2.7.0, < 2.7.1 · CVE-2026-115362 · GHSA-7m59-mp95-w6ph
- Unrated
OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
Bitnami openbao · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2026-115361 · GHSA-hr5j-3j78-4vh2
- Medium, CVSS 5.3
OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
Bitnami openbao · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2026-115360 · GHSA-2cjw-94fw-wqjx
- Medium, CVSS 6.3
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
Bitnami openbao · Upgrade to 2.7.1 or 2.6.4 by release line · < 2.6.4; >= 2.7.0, < 2.7.1 · CVE-2026-115359 · GHSA-5v22-543h-wg96
- Low, CVSS 2.0
OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters
Bitnami openbao · Upgrade to 2.7.1 or 2.6.3 by release line · < 2.6.3; >= 2.7.0, < 2.7.1 · CVE-2026-115358 · GHSA-8xxq-mq9m-xmhw
- Low, CVSS 2.1
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
Bitnami openbao · Upgrade to 2.7.1 or 2.6.4 by release line · < 2.6.4; >= 2.7.0, < 2.7.1 · CVE-2026-115357 · GHSA-q74w-hv5x-6hxf
- Medium, CVSS 5.3
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
Bitnami openbao · Upgrade to 2.7.1 or 2.6.4 by release line · < 2.6.4; >= 2.7.0, < 2.7.1 · CVE-2026-115356 · GHSA-gf3j-hm38-jhh5
- Unrated
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Bitnami grafana · Upgrade to 13.2.4, 13.1.8, 13.0.11 or 12.4.13 by release line · >= 11.6.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4 · CVE-2026-92539
- High, CVSS 8.1
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-90800
- Low, CVSS 1.3
Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-90799
- Low, CVSS 0.6
Apache CouchDB: Replicator follows redirects indefinitely
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-90798
- High, CVSS 7.7
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-90797
- Critical, CVSS 9.3
Apache CouchDB: Admin credentials leading to code execution as operating system user
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-86471
- Medium, CVSS 6.0
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-107755
- Unrated
Argo CD: A Kustomize Helm config home can run commands in the repo-server
Bitnami argo-cd · Upgrade to 3.5.4, 3.4.10 or 3.3.15 by release line · >= 2.1.0, < 3.3.15; >= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.4 · CVE-2026-113709
- Unrated
Argo CD: A Kustomize remote ref can run commands in the repo-server
Bitnami argo-cd · Upgrade to 3.5.4, 3.4.10 or 3.3.15 by release line · >= 2.7.0, < 3.3.15; >= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.4 · CVE-2026-113708
- Unrated
Argo CD: A Jsonnet import can read files from the repo-server
Bitnami argo-cd · Upgrade to 3.5.4, 3.4.10 or 3.3.1 by release line · >= 0.9.0, < 3.3.1; >= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.4 · CVE-2026-113672
- Medium, CVSS 5.3
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
PyPI tornado · Upgrade to 6.6 or later · < 6.6 · CVE-2026-115927 · GHSA-r4j5-9xpp-3985 · amended
- Low, CVSS 2.1
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
PyPI tornado · Upgrade to 6.6 or later · < 6.6 · CVE-2026-116578 · GHSA-pw9p-v7r6-gx4p · amended
- Medium, CVSS 5.3
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
PyPI tornado · Upgrade to 6.6 or later · < 6.6 · CVE-2026-116577 · GHSA-pcg2-g6cj-q92c · amended
- Medium, CVSS 5.3
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
RubyGems crass · Upgrade to 1.0.8 or later · < 1.0.8 · CVE-2026-116695 · GHSA-pq4g-8rxf-4g29 · amended
- High, CVSS 7.8
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
npm systeminformation · Upgrade to 5.33.16 or later · < 5.33.16 · CVE-2026-116576 · GHSA-3f7j-7jwc-fxfj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.