Critical, CVSS 9.3
Cognee allows non-superusers to overwrite global LLM configuration
PyPI cognee · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-58473 · GHSA-49f7-whx5-4256 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 951 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4001–4025 of 30,927 matching · newest first
- High, CVSS 8.3
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
npm @better-auth/scim · Upgrade to 1.7.0-beta.4 (pre-release) or later · >= 1.5.0, < 1.7.0-beta.4 · CVE-2026-67331 · GHSA-j8v8-g9cx-5qf4 · amended
- Low, CVSS 3.8
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
npm @better-auth/scim +1 · Upgrade all 2 to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-67334 · GHSA-2vg6-77g8-24mp · amended
- High, CVSS 7.6
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
npm @better-auth/oauth-provider +1 · Upgrade all 2 to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-53518 · GHSA-7w99-5wm4-3g79 · amended
- Critical, CVSS 9.6
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
npm @better-auth/sso · Upgrade to 1.6.11 or later · >= 0.1.0, < 1.6.11 · CVE-2026-53513 · GHSA-5rr4-8452-hf4v · amended
- High, CVSS 7.6
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
npm better-auth · Upgrade to 1.6.0 or later · >= 1.4.8-beta.7, < 1.6.0 · +1 more package · CVE-2026-53517 · GHSA-392p-2q2v-4372 · amended
- High, CVSS 8.7
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-67336 · GHSA-9h47-pqcx-hjr4 · amended
- High, CVSS 7.7
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
npm better-auth · Upgrade to 1.7.0-beta.4 (pre-release) or 1.6.13 by release line · < 1.6.13; >= 1.7.0-beta.0, < 1.7.0-beta.4 · CVE-2026-67333 · GHSA-86j7-9j95-vpqj · amended
- High, CVSS 8.3
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53516 · GHSA-g38m-r43w-p2q7 · amended
- High, CVSS 7.7
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53514 · GHSA-fmh4-wcc4-5jm3 · amended
- Medium, CVSS 6.4
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
npm @better-auth/oauth-provider · Upgrade to 1.7.0-beta.4 (pre-release) or later · >= 1.4.8, < 1.7.0-beta.4 · CVE-2026-67332 · GHSA-p2fr-6hmx-4528 · amended
- Critical, CVSS 9.1
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
npm better-auth · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-53512 · GHSA-pw9m-5jxm-xr6h · amended
- Low, CVSS 2.3
netfoil: Attacker controlled data written to logs
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.3.0 or later · < 0.3.0 · GHSA-7856-g3gv-9wq8
- Low, CVSS 1.2
netfoil has a resource leak in LRU cache
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.3.0 or later · < 0.3.0 · GHSA-3g4q-2f67-2gvh
- Medium, CVSS 5.9
netfoil has a domain name filter bypass via multiple questions
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.3.0 or later · < 0.3.0 · GHSA-59qp-cfj3-rp64
- High, CVSS 7.0
uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)
crates.io uucore · Upgrade to 0.6.0 or later · < 0.6.0 · GHSA-fqf6-gxhh-2xhw
- Medium, CVSS 5.7
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.106 or later · < 0.4.106 · CVE-2026-53509 · GHSA-g84h-j7jj-x32p · amended
- High, CVSS 7.3
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
PyPI open-webui · Upgrade to 0.6.44 or later · <= 0.6.43 · CVE-2026-26193 · GHSA-vjm7-m4xh-7wrc · amended
- High, CVSS 7.3
Open WebUI vulnerable to Stored XSS via iFrame in citations model
PyPI open-webui · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-26192 · GHSA-xc8p-9rr6-97r2 · amended
- High, CVSS 7.4
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
PyPI open-webui · Upgrade to 0.6.6 or later · < 0.6.6 · CVE-2025-46719 · GHSA-9f4f-jv96-8766 · amended
- Medium, CVSS 6.4
Open WebUI allows limited stored XSS vila uploaded html file
PyPI open-webui · Upgrade to 0.6.6 or later · < 0.6.6 · CVE-2025-46571 · GHSA-8gh5-qqh8-hq3x · amended
- Medium, CVSS 6.5
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
RubyGems altcha · Upgrade to 1.0.0 or later · < 1.0.0 · +5 more packages · CVE-2025-68113 · GHSA-6gvq-jcmp-8959 · amended
- High, CVSS 8.1
ExecuTorch vulnerable to Heap-based Buffer Overflow attack
PyPI executorch · Upgrade to 0.7.0 or later · <= 0.6.0 · +1 more package · CVE-2025-30402 · GHSA-h952-963h-rv99 · amended
- Medium, CVSS 5.3
Django: DomainNameValidator permits newline characters that may enable HTTP header injection
PyPI django · Upgrade to 6.0.7 or 5.2.16 by release line · < 5.2.16; >= 6.0.0, < 6.0.7 · CVE-2026-53878 · GHSA-8qcx-xf44-272x · amended
- Medium, CVSS 6.3
Django: GDALRaster may over-read heap memory when constructed from bytes
PyPI django · Upgrade to 6.0.7 or 5.2.16 by release line · < 5.2.16; >= 6.0.0, < 6.0.7 · CVE-2026-53877 · GHSA-crhf-3pfg-w68w · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.