High, CVSS 7.7
Weblate: Arbitrary File Read via Symlink
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-34242 · GHSA-hv99-mxm5-q397 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.0
Weblate: Remote code execution during backup restoration
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-33435 · GHSA-558g-h753-6m33 · amended
- Critical, CVSS 10.0
goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files
Packagist goodoneuz/pay-uz · Upgrade to 3.0.0 or later · <= 2.2.24 · CVE-2026-31843 · GHSA-m5wg-cjgh-223j
- High, CVSS 7.5
SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information
Maven org.apache.skywalking:server-core · Upgrade to 10.4.0 or later · >= 9.7.0, < 10.4.0 · CVE-2026-30778 · GHSA-27h3-crw2-q36w
- Critical, CVSS 9.8
MsQuic has a Remote Elevation of Privilege Vulnerability
NuGet microsoft.native.quic.msquic.schannel +1 · Upgrade all 2 to 2.5.7 or 2.4.18 by release line · >= 2.5.0-ci.532574, < 2.5.7; < 2.4.18 · CVE-2026-32179 · GHSA-gvvw-8j96-8g5r
- Critical, CVSS 9.1
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
npm @fastify/express · Upgrade to 4.0.5 or later · <= 4.0.4 · CVE-2026-33808 · GHSA-6hw5-45gm-fj88 · amended
- Critical, CVSS 9.1
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
npm @fastify/express · Upgrade to 4.0.5 or later · <= 4.0.4 · CVE-2026-33807 · GHSA-hrwm-hgmj-7p9c · amended
- Critical, CVSS 9.0
Fastify's connection header abuse enables stripping of proxy-added headers
npm @fastify/http-proxy · Upgrade to 11.4.4 or later · <= 11.4.3 · +1 more package · CVE-2026-33805 · GHSA-gwhp-pf74-vj37 · amended
- High, CVSS 8.4
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
npm vite-plus · Upgrade to 0.1.17 or later · <= 0.1.16 · CVE-2026-41211 · GHSA-33r3-4whc-44c2 · amended
- Critical, CVSS 9.9
Froxlor has Local File Inclusion via path traversal in API
def_languageparameter leads to Remote Code ExecutionPackagist froxlor/froxlor · Upgrade to 2.3.6 or later · <= 2.3.5 · CVE-2026-41228 · GHSA-w59f-67xm-rxx7
- Critical, CVSS 9.1
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
Packagist froxlor/froxlor · Upgrade to 2.3.6 or later · <= 2.3.5 · CVE-2026-41229 · GHSA-gc9w-cc93-rjv8
- High, CVSS 8.5
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
Packagist froxlor/froxlor · Upgrade to 2.3.6 or later · < 2.3.6 · CVE-2026-41230 · GHSA-47hf-23pw-3m8c
- High, CVSS 7.5
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron
Packagist froxlor/froxlor · Upgrade to 2.3.6 or later · < 2.3.6 · CVE-2026-41231 · GHSA-75h4-c557-j89r
- Critical, CVSS 9.1
Pyroscope Exposes Storage Secret
Go github.com/grafana/pyroscope · Upgrade to 1.16.1 or 1.15.2 by release line · < 1.15.2; >= 1.16.0, < 1.16.1 · CVE-2025-41118 · GHSA-m9hq-h476-h2g8
- Critical, CVSS 9.0
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
Maven org.thymeleaf:thymeleaf +2 · Upgrade all 3 to 3.1.4.RELEASE or later · <= 3.1.3.RELEASE · CVE-2026-40478 · GHSA-xjw8-8c5c-9r79
- Critical, CVSS 9.0
Improper restriction of the scope of accessible objects in Thymeleaf expressions
Maven org.thymeleaf:thymeleaf +2 · Upgrade all 3 to 3.1.4.RELEASE or later · <= 3.1.3.RELEASE · CVE-2026-40477 · GHSA-r4v4-5mwr-2fwr
- High, CVSS 7.6
OpenRemote has XXE in Velbus Asset Import
Maven io.openremote:openremote-manager · Upgrade to 1.22.0 or later · <= 1.21.0 · CVE-2026-40882 · GHSA-g24f-mgc3-jwwc
- High, CVSS 7.3
thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics
crates.io thin-vec · Upgrade to 0.2.16 or later · < 0.2.16 · CVE-2026-6654 · GHSA-xphw-cqx3-667j
- High, CVSS 7.5
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
npm fastify · Upgrade to 5.3.2 or 4.29.1 by release line · >= 5.0.0, < 5.3.2; >= 4.29.0, < 4.29.1 · CVE-2025-32442 · GHSA-247c-9743-5963 · amended
- High, CVSS 8.2
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex
Go github.com/oauth2-proxy/oauth2-proxy/v7 · Upgrade to 7.15.2 or later · >= 7.5.0, < 7.15.2 · CVE-2026-41059 · GHSA-pxq7-h93f-9jrg
- Critical, CVSS 9.1
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
Go github.com/oauth2-proxy/oauth2-proxy/v7 · Upgrade to 7.15.2 or later · >= 7.5.0, < 7.15.2 · CVE-2026-40575 · GHSA-7x63-xv5r-3p2x
- Critical, CVSS 9.8
Upsonic: remote code execution vulnerability in its MCP server/task creation functionality
PyPI upsonic · Upgrade to 0.72.0 or later · < 0.72.0 · CVE-2026-30625 · GHSA-cw73-5f7h-m4gv · amended
- High, CVSS 7.4
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Maven org.eclipse.jetty:jetty-http · Upgrade to 12.1.7, 12.0.33, 11.0.29 or 2 more by release line · >= 12.1.0, <= 12.1.6; >= 12.0.0, <= 12.0.32; >= 10.0.0, <= 10.0.27; >= 9.4.0, <= 9.4.59; >= 11.0.0, <= 11.0.28 · CVE-2026-2332 · GHSA-355h-qmc2-wpwf
- High, CVSS 7.3
Kiota: Code Generation Literal Injection
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.31.1 or 1.29.1 by release line · >= 1.30.0, < 1.31.1; < 1.29.1 · CVE-2026-41134 · GHSA-2hx3-vp6r-mg3f
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.6, 9.0.15 or 8.0.3 by release line · >= 10.0.0, <= 10.0.5; >= 9.0.0, <= 9.0.14; >= 8.0.0, <= 8.0.2 · CVE-2026-26171 · GHSA-w3x6-4m5h-cxqf
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.