Medium, CVSS 5.5
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Packagist pterodactyl/panel · Upgrade to 1.12.3 or later · < 1.12.3 · GHSA-j7f5-gfqm-pcx3
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4501–4525 of 30,958 matching · newest first
- Medium, CVSS 5.0
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
Go github.com/pterodactyl/wings · Upgrade to 1.12.2 or later · >= 1.11.9, < 1.12.2 · GHSA-rhq6-9rgh-v45c
- High, CVSS 8.7
Flawfinder output manipulation via untrusted filenames and source text
PyPI flawfinder · Upgrade to 2.0.20 or later · < 2.0.20 · CVE-2026-48813 · GHSA-4c3c-r6p8-c863 · amended
- High, CVSS 7.5
python-socketio: Binary attachment accumulation can cause denial of service
PyPI python-socketio · Upgrade to 5.16.2 or later · <= 5.16.1 · CVE-2026-48804 · GHSA-5w7q-77mv-v69f · amended
- High, CVSS 7.5
python-engineio has unbound thread allocation that can cause denial of service
PyPI python-engineio · Upgrade to 4.13.2 or later · <= 4.13.1 · CVE-2026-48802 · GHSA-cgwc-pv48-fhj5 · amended
- Unrated
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
PyPI semantic-router · Upgrade to 0.1.15 or later · >= 0.1.8, < 0.1.15 · GHSA-98x5-vq43-vc5p · amended
- High, CVSS 7.5
python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
PyPI python-engineio · Upgrade to 4.13.2 or later · <= 4.13.1 · CVE-2026-48809 · GHSA-m9gh-vj53-gvh9 · amended
- High, CVSS 8.7
LinkifyIt#match scan loop has quadratic algorithmic complexity
npm linkify-it · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-48801 · GHSA-22p9-wv53-3rq4 · amended
- Medium, CVSS 5.5
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Go github.com/tursodatabase/turso-cli · Upgrade to 1.0.26 or later · <= 1.0.25 · CVE-2026-48790 · GHSA-57f6-pvx8-hwj6
- Medium, CVSS 5.2
nono-py's policy JSON accepts unknown security fields
PyPI nono-py · Upgrade to 0.10.1 or later · <= 0.10.0 · GHSA-m8j6-rc5x-wv36 · amended
- Medium, CVSS 5.2
nono-py vulnerable to authorization bypass / policy confusion
PyPI nono-py · Upgrade to 0.11.0 or later · <= 0.10.1 · GHSA-9j7f-3r4p-pwh6 · amended
- Critical, CVSS 9.3
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
npm @mcptoolshop/backpropagate +1 · Upgrade all 2 to 1.2.0 or later · >= 1.1.0, < 1.2.0 · CVE-2026-48797 · GHSA-f65r-h4g3-3h9h · amended
- Medium, CVSS 6.4
nono-py has proxy-only network fallback bypass on older Linux kernels
PyPI nono-py · Upgrade to 0.10.1 or later · >= 0.9.0, < 0.10.1 · GHSA-72w7-mf9g-733p · amended
- Medium, CVSS 4.3
Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.85.0 or later · < 4.85.0 · CVE-2026-41262 · GHSA-gm7f-v959-fr2g
- High, CVSS 7.5
Hysteria: http large header with sniff cause server DoS
Go github.com/apernet/hysteria · Upgrade to 2.9.2 or later · < 2.9.2 · GHSA-jqc5-2p7q-fqfc
- High, CVSS 7.5
Hysteria vulnerable to server crash when max_datagram_frame_size very small
Go github.com/apernet/hysteria · Upgrade to 2.9.2 or later · < 2.9.2 · GHSA-qh5x-rfwf-rvfv
- High, CVSS 7.4
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
Go github.com/apernet/hysteria/core/v2 · Upgrade to 2.9.2 or later · >= 2.0.0, <= 2.9.1 · GHSA-vgrc-hq28-p3xp
- Medium, CVSS 6.9
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
npm @cyclonedx/cdxgen · Upgrade to 12.4.3 or later · < 12.4.3 · GHSA-5vwr-qchf-q4pf · amended
- High, CVSS 8.2
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Go github.com/umputun/remark42 · Upgrade to 1.16.0 or later · >= 1.6.0, < 1.16.0 · CVE-2026-48788 · GHSA-4c8j-mgm4-qqvp
- Medium, CVSS 4.8
Apptainer has incorrect path matching for 'limit container paths' directive
Go github.com/apptainer/apptainer · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-48785 · GHSA-cr2j-534f-mf3g
- Medium, CVSS 6.8
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
PyPI pydantic-ai +1 · Upgrade all 2 to 2.0.0b3 (pre-release) or 1.102.0 by release line · >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3 · CVE-2026-48782 · GHSA-cg7w-rg45-pc59 · amended
- Critical, CVSS 9.9
Incus has an arbitrary file write on its client due to trusted image hash
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48769 · GHSA-f6m5-xw2g-xc4x · amended
- Medium, CVSS 5.4
@sigstore/core has DSSE payloadType type-binding failure
npm @sigstore/core · Upgrade to 3.2.1 or later · <= 3.2.0 · CVE-2026-48758 · GHSA-jfc7-64v2-mr8c · amended
- Low, CVSS 2.1
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-48756 · GHSA-xhqx-mgh3-3h7q
- Critical, CVSS 9.9
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48755 · GHSA-v6mj-8pf4-hhw4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.