Low, CVSS 2.1
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-48754 · GHSA-4xg6-52mh-fpw8
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 953 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4526–4550 of 30,958 matching · newest first
- Critical, CVSS 9.9
Incus has an arbitrary file write via path traversal in S3 multipart upload
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-48753 · GHSA-ccjc-4qc3-jxqc
- Critical, CVSS 9.9
Incus has arbitrary file read+write on host via templates/ symlink in malicious image
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48752 · GHSA-vxp5-584q-c479 · amended
- Critical, CVSS 9.9
Incus has a restricted project bypass leading to arbitrary command execution
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48751 · GHSA-48q5-w887-33wv · amended
- Critical, CVSS 9.9
Incus has an arbitrary file write on host via
exec-outputsymlink in crafted imageGo github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48750 · GHSA-73hr-m85f-64v9 · amended
- Critical, CVSS 9.9
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48749 · GHSA-2q3f-q5pq-g8wv · amended
- Medium, CVSS 4.3
ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53463 · GHSA-p9rq-q46c-g4x6
- High, CVSS 8.7
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
Maven org.openidentityplatform.openam:openam-auth-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46623 · GHSA-gf57-4mp6-m85x · amended
- High, CVSS 8.7
OpenAM Authentication Bypass via MSISDN LDAP Injection
Maven org.openidentityplatform.openam:openam-auth-msisdn · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46619 · GHSA-xq73-fvmr-jvmm · amended
- Medium, CVSS 5.3
fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in
in_opentelemetryRubyGems fluent-plugin-opentelemetry · Upgrade to 0.5.3 or later · <= 0.5.2 · CVE-2026-44163 · GHSA-2jc5-xhx8-qj6h
- Low, CVSS 2.7
fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in
in_s3RubyGems fluent-plugin-s3 · Upgrade to 1.8.5 or later · >= 0.7.0, <= 1.8.4 · CVE-2026-44162 · GHSA-xv9w-7v6q-hpjh
- High, CVSS 7.2
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in
out_httpRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44161 · GHSA-72f5-rr8c-r6gr
- High, CVSS 7.5
Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in
in_httpandin_forwardRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44160 · GHSA-j9cw-hwqf-85w7
- High, CVSS 7.5
Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44025 · GHSA-pr7j-96cj-549h
- Critical, CVSS 9.8
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in
${tag}PlaceholderRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44024 · GHSA-44hj-4m45-frj3
- Medium, CVSS 5.9
ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53462 · GHSA-px7q-ggqj-hcf2
- Medium, CVSS 5.4
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
Go github.com/mattermost/mattermost/server/public · Upgrade to 0.1.22 or later · < 0.1.22 · CVE-2026-13426 · GHSA-72v2-v53v-4qmm · amended
- Medium, CVSS 6.7
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
Maven org.jetbrains.kotlin:kotlin-gradle-plugin · Upgrade to 2.4.20-Beta1 (pre-release) or later · < 2.4.20-Beta1 · CVE-2026-53914 · GHSA-r937-wjx7-w2jp
- High, CVSS 7.3
Apache Kerby has a bypass the Kerberos pre-authentication check
Maven org.apache.kerby:kerb-server · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-57915 · GHSA-262p-fj3f-xh7v · amended
- Critical, CVSS 9.1
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.6 or 1.3.6 by release line · >= 2.0.0, < 2.0.6; >= 1.0.0, < 1.3.6 · CVE-2025-55017 · GHSA-xrvj-h9w2-3q69 · amended
- Critical, CVSS 9.1
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.7 or 1.3.6 by release line · >= 1.0.0, < 1.3.6; >= 2.0.0, < 2.0.7 · CVE-2025-64152 · GHSA-h548-jhj8-q85h · amended
- Medium, CVSS 6.5
Apache Kerby vulnerable to denial of service
Maven org.apache.kerby:kerby-asn1 · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-57914 · GHSA-x6vc-x4v4-hjhr · amended
- High, CVSS 7.5
Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
PyPI apache-airflow-providers-ftp · Upgrade to 3.15.1 or later · < 3.15.1 · CVE-2026-49486 · GHSA-fgch-86x8-fv43 · amended
- Medium, CVSS 6.4
KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
Go kubevirt.io/kubevirt · Upgrade to 1.10.0-rc.0 (pre-release) or later · < 1.10.0-rc.0 · CVE-2026-13318 · GHSA-cgm6-wvp9-4g5h
- Medium, CVSS 6.5
Apicurio Registry is vulnerable to denial of service through XML entity expansion
Maven io.apicurio:apicurio-registry-schema-util-xml · Upgrade to 3.3.1 or 3.2.6 by release line · >= 3.3.0, < 3.3.1; < 3.2.6 · CVE-2026-12993 · GHSA-748j-wm96-4wh5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.