Low, CVSS 2.3
Django: cache middleware may expose private responses when unrelated request cookies are present
PyPI django · Upgrade to 6.0.7 or 5.2.16 by release line · < 5.2.16; >= 6.0.0, < 6.0.7 · CVE-2026-48588 · GHSA-3h9f-r86x-qvjx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 951 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4026–4050 of 30,927 matching · newest first
- Medium, CVSS 6.5
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose
Packagist egroupware/egroupware · Upgrade to 26.5.20260507 or 23.1.20260601 by release line · >= 26.0.20251208, < 26.5.20260507; < 23.1.20260601 · CVE-2026-45016 · GHSA-c8m7-r2jv-rw63
- Medium, CVSS 5.5
ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
PyPI onnx · Upgrade to 1.22.0 or later · >= 1.9.0, < 1.22.0 · CVE-2026-44512 · GHSA-hwpq-hmq9-wj77 · amended
- Medium, CVSS 5.3
New API is vulnerable to CSRF through user email binding
Go github.com/QuantumNous/new-api · Upgrade to 0.12.0-alpha.1 (pre-release) or later · < 0.12.0-alpha.1 · CVE-2026-44342 · GHSA-26v7-h57m-gh9m
- High, CVSS 8.2
XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 18.2.0 or 17.10.5 by release line · < 17.10.5; >= 18.0.0-rc-1, < 18.2.0 · CVE-2026-34151 · GHSA-qj4x-9g63-25g6
- High, CVSS 7.7
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
Go github.com/QuantumNous/new-api · Upgrade to 0.12.0-alpha.1 (pre-release) or later · < 0.12.0-alpha.1 · CVE-2026-33655 · GHSA-6qcr-qxgr-m7fv
- Critical, CVSS 9.3
EGroupware has a Remote Code Execution Vulnerability
Packagist egroupware/egroupware · Upgrade to 26.2.20260224 or 23.1.20260224 by release line · >= 26.0.20251208, < 26.2.20260224; < 23.1.20260224 · CVE-2026-27823 · GHSA-h9qx-v5xp-ph8p
- Medium, CVSS 6.5
apache-airflow DAG source authorization bypass exposes co-located DAG source
PyPI apache-airflow · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-49296 · GHSA-4fh7-7jx4-8f6c · amended
- Medium, CVSS 6.5
Apache Airflow exposes deferred trigger kwargs in task-instance API responses
PyPI apache-airflow · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-49487 · GHSA-22hf-vx2v-gjff · amended
- Critical, CVSS 9.8
Apache Airflow allows code execution through unsafe serialized DAG deserialization
PyPI apache-airflow · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-33264 · GHSA-2943-9672-r45w · amended
- Medium, CVSS 6.5
Apache Airflow exposes secrets backend credentials through the Config API
PyPI apache-airflow · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-48892 · GHSA-9933-5rrp-mfwx · amended
- Medium, CVSS 6.5
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
PyPI apache-airflow · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-48828 · GHSA-563f-2439-rmq4 · amended
- Medium, CVSS 4.3
Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph
PyPI apache-airflow · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-48891 · GHSA-3322-mjxh-9mp5 · amended
- Low, CVSS 3.3
cut: -s ignored in -z -d '' newline-delimiter mode
crates.io uu_cut · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-35381 · GHSA-pmfc-4wjj-gmhx
- Low, CVSS 3.4
mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
crates.io uu_mknod · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35361 · GHSA-r9hw-mj3w-phcq
- High, CVSS 7.1
mkfifo: permissions of an existing file are changed after FIFO creation fails
crates.io uu_mkfifo · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35341 · GHSA-pmf6-rcx4-v53v
- High, CVSS 8.3
Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write
Go github.com/coder/coder/v2 · Upgrade to 2.34.4, 2.33.10, 2.32.9 or 2.29.19 by release line · >= 2.34.0, < 2.34.4; >= 2.33.0, < 2.33.10; >= 2.30.0, < 2.32.9; >= 2.27.0, < 2.29.19 · GHSA-qrwj-vh9x-gw5v
- High, CVSS 7.2
OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
Maven io.openremote:openremote-manager · Upgrade to 1.26.0 or later · < 1.26.0 · CVE-2026-62238 · GHSA-cgfv-jrfp-2r7v · amended
- High, CVSS 7.3
9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
npm 9router · Upgrade to 0.4.77 or later · <= 0.4.71 · CVE-2026-55501 · GHSA-7cfm-pqrj-xgq7 · amended
- High, CVSS 8.7
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Packagist craftcms/cms · Upgrade to 5.10.0 or later · >= 5.9.0, < 5.10.0 · CVE-2026-55794 · GHSA-f74w-488g-8x5r
- Medium, CVSS 6.0
Craft CMS: Sensitive File Disclosure / Server-Side File Read
Packagist craftcms/cms · Upgrade to 5.10.0 or 4.18.0 by release line · >= 4.0.0-RC1, < 4.18.0; >= 5.0.0-RC1, < 5.10.0 · CVE-2026-55792 · GHSA-287w-mxq6-x2cp
- Critical, CVSS 9.3
Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
crates.io halo2_gadgets · Upgrade to 0.5.0 or later · < 0.5.0 · +3 more packages · CVE-2026-54496 · GHSA-ww9q-8r59-xv46
- Critical, CVSS 9.2
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
PyPI langroid · Upgrade to 0.65.5 or later · <= 0.65.4 · CVE-2026-55615 · GHSA-2pq5-3q89-j7cc · amended
- Medium, CVSS 5.8
Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55438 · GHSA-5wg6-jmq2-53pw
- High, CVSS 7.8
Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command
PyPI linuxfabrik-lib · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-55426 · GHSA-798h-hpph-m24j · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.