Critical, CVSS 10.0
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
Go github.com/Tencent/WeKnora · Upgrade to 0.2.12 or later · <= 0.2.11 · CVE-2026-30860 · GHSA-8w32-6mrw-q5wv
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
WeKnora has Broken Access Control - Cross-Tenant Data Exposure
Go github.com/Tencent/WeKnora · Upgrade to 0.2.12 or later · <= 0.2.11 · CVE-2026-30859 · GHSA-2f4c-vrjq-rcgv
- High, CVSS 7.5
WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources
Go github.com/Tencent/WeKnora · Upgrade to 0.3.0 or later · <= 0.2.14 · CVE-2026-30858 · GHSA-h6gw-8f77-mmmp
- Critical, CVSS 9.8
WeKnora Vulnerable to Broken Access Control in Tenant Management
Go github.com/Tencent/WeKnora · Upgrade to 0.3.2 or later · <= 0.3.1 · CVE-2026-30855 · GHSA-ccj6-79j6-cq5q
- High, CVSS 8.1
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Go github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy · Upgrade to 2.11.2 or later · >= 2.10.0, < 2.11.2 · CVE-2026-30851 · GHSA-7r4p-vjf4-gxv4
- High, CVSS 7.7
Flowise Missing Authentication on NVIDIA NIM Endpoints
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30824 · GHSA-5f53-522j-j454 · amended
- High, CVSS 8.8
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30823 · GHSA-cwc3-p92j-g7qm · amended
- High, CVSS 7.7
Flowise Allows Mass Assignment in
/api/v1/leadsEndpointnpm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30822 · GHSA-mq4r-h2gh-qv7x · amended
- Critical, CVSS 9.1
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
Go github.com/charmbracelet/soft-serve · Upgrade to 0.11.4 or later · >= 0.6.0, < 0.11.4 · CVE-2026-30832 · GHSA-3fvx-xrxq-8jvv
- High, CVSS 8.2
Zarf's symlink targets in archives are not validated against destination directory
Go github.com/zarf-dev/zarf/src/pkg/archive · Upgrade to 0.73.1 or later · >= 0.54.0, < 0.73.1 · CVE-2026-29064 · GHSA-hcm4-6hpj-vghm
- High, CVSS 7.5
CoreDNS Loop Detection Denial of Service Vulnerability
Go github.com/coredns/coredns · Upgrade to 1.14.2 or later · < 1.14.2 · CVE-2026-26018 · GHSA-h75p-j8xm-m278
- High, CVSS 8.2
Flowise has Arbitrary File Upload via MIME Spoofing
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30821 · GHSA-j8g8-j7fc-43v6 · amended
- High, CVSS 8.7
Flowise has Authorization Bypass via Spoofed x-request-from Header
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30820 · GHSA-wvhq-wp8g-c7vq · amended
- High, CVSS 8.5
parse-server's endpoint
/loginAsallowsreadOnlyMasterKeyto gain full read and write access as any usernpm parse-server · Upgrade to 9.5.0-alpha.4 (pre-release) or 8.6.6 by release line · < 8.6.6; >= 9.0.0, < 9.5.0-alpha.4 · CVE-2026-30229 · GHSA-79wj-8rqv-jvp5 · amended
- High, CVSS 7.5
PinchTab has SSRF with Full Response Exfiltration via Download Handler
Go github.com/pinchtab/pinchtab/cmd/pinchtab · Upgrade to 0.7.7 or later · <= 0.7.6 · CVE-2026-30834 · GHSA-rw8p-c6hf-q3pg
- High, CVSS 7.5
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
npm express-rate-limit · Upgrade to 8.2.2, 8.1.1 or 8.0.2 by release line · >= 8.2.0, < 8.2.2; >= 8.1.0, <= 8.1.0; >= 8.0.0, < 8.0.2 · CVE-2026-30827 · GHSA-46wh-pxpv-q5gq · amended
- High, CVSS 8.7
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
Packagist snipe/snipe-it · Upgrade to 8.3.7 or later · < 8.3.7 · CVE-2025-15602 · GHSA-5448-v74m-7mv7
- High, CVSS 7.7
CoreDNS ACL Bypass
Go github.com/coredns/coredns · Upgrade to 1.14.2 or later · < 1.14.2 · CVE-2026-26017 · GHSA-c9v3-4pv7-87pr
- High, CVSS 7.5
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
npm @github/copilot · Upgrade to 0.0.423 or later · <= 0.0.422 · CVE-2026-29783 · GHSA-g8r9-g2v8-jv6f · amended
- High, CVSS 8.4
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality
PyPI sagemaker · Upgrade to 3.4.0 or later · >= 3.0.0, < 3.4.0 · GHSA-5r2p-pjr8-7fh7 · amended
- High, CVSS 8.5
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
PyPI plane · Upgrade to 1.2.3 or later · <= 1.2.1 · CVE-2026-30242 · GHSA-fpx8-73gf-7x73 · amended
- High, CVSS 8.1
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
Maven org.keycloak:keycloak-services · Upgrade to 26.5.5 or later · < 26.5.5 · CVE-2026-3009 · GHSA-m297-3jv9-m927
- High, CVSS 7.7
RAGAS has an Arbitrary File Read vulnerability
PyPI ragas · Upgrade to 0.3.0rc1 (pre-release) or later · >= 0.2.3, < 0.3.0rc1 · CVE-2025-45691 · GHSA-v2xr-wvrv-p969
- High, CVSS 7.5
The Eclipse Jetty Server Artifact has a Gzip request memory leak
Maven org.eclipse.jetty:jetty-server · Upgrade to 12.1.6 or 12.0.32 by release line · >= 12.1.0, <= 12.1.5; >= 12.0.0, <= 12.0.31 · CVE-2026-1605 · GHSA-xxh7-fcf3-rj7f
- Critical, CVSS 10.0
PYSEC-2026-99
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-0848
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.