High, CVSS 8.4
Pingora vulnerable to cache poisoning via insecure-by-default cache key
crates.io pingora-cache · Upgrade to 0.8.0 or later · <= 0.7.0 · CVE-2026-2836 · GHSA-f93w-pcj3-rggc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing
crates.io pingora-core · Upgrade to 0.8.0 or later · <= 0.7.0 · CVE-2026-2835 · GHSA-hj7x-879w-vrp7
- Critical, CVSS 9.3
Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade
crates.io pingora-core · Upgrade to 0.8.0 or later · <= 0.7.0 · CVE-2026-2833 · GHSA-xq2h-p299-vjwv
- High, CVSS 8.8
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260304231339-e97d8ecbd8d6 (pre-release) or later · < 0.0.0-20260304231339-e97d8ecbd8d6 · CVE-2026-30223 · GHSA-g962-2j28-3cg9
- High, CVSS 8.8
Gogs: Release tag option injection in release deletion
Go gogs.io/gogs · Upgrade to 0.14.2 or later · <= 0.14.1 · CVE-2026-26194 · GHSA-v9vm-r24h-6rqm
- High, CVSS 8.7
Gogs: Stored XSS via data URI in issue comments
Go gogs.io/gogs · Upgrade to 0.14.2 or later · <= 0.14.1 · CVE-2026-26022 · GHSA-xrcr-gmf5-2r8j
- Critical, CVSS 9.3
Gogs: Cross-repository LFS object overwrite via missing content hash verification
Go gogs.io/gogs · Upgrade to 0.14.2 or later · <= 0.14.1 · CVE-2026-25921 · GHSA-cj4v-437j-jq4c
- High, CVSS 8.7
Gokapi has Stored XSS in SVG Hotlinks
Go github.com/forceu/gokapi · Upgrade to 2.2.3 or later · < 2.2.3 · CVE-2026-28683 · GHSA-3c22-5j5m-4jq7
- Critical, CVSS 9.8
Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure
Go github.com/0xJacky/Nginx-UI · Upgrade to 2.3.3 or later · < 2.3.3 · CVE-2026-27944 · GHSA-g9w5-qffc-6762
- High, CVSS 8.7
xgrammar vulnerable to DoS via multi-layer nesting
PyPI xgrammar · Upgrade to 0.1.32 or later · <= 0.1.31 · CVE-2026-25048 · GHSA-7rgv-gqhr-fxg3 · amended
- High, CVSS 7.7
OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint
npm @opennextjs/cloudflare · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2025-6087 · GHSA-c7mq-gh6q-6q7c · amended
- High, CVSS 8.2
tar has Hardlink Path Traversal via Drive-Relative Linkpath
npm tar · Upgrade to 7.5.10 or later · <= 7.5.9 · CVE-2026-29786 · GHSA-qffp-2rhf-9h96 · amended
- High, CVSS 7.5
Ghost has incomplete CSRF protections around OTC use
npm ghost · Upgrade to 6.19.3 or later · >= 5.101.6, <= 6.19.2 · CVE-2026-29784 · GHSA-9m84-wc28-w895 · amended
- Critical, CVSS 10.0
zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
crates.io zeptoclaw · Upgrade to 0.6.2 or later · <= 0.6.1 · GHSA-5wp8-q9mx-8jx8
- High, CVSS 7.5
zeptoclaw has Android device shell blocklist bypass via argument permutation
crates.io zeptoclaw · Upgrade to 0.6.2 or later · <= 0.6.1 · GHSA-hhjv-jq77-cmvx
- High, CVSS 8.6
Parse Server's Cloud Hooks and Cloud Jobs bypass
readOnlyMasterKeywrite restrictionnpm parse-server · Upgrade to 9.4.1-alpha.3 (pre-release) or 8.6.4 by release line · >= 9.0.0, <= 9.4.1-alpha.2; <= 8.6.3 · CVE-2026-29182 · GHSA-vc89-5g3r-cmhh · amended
- High, CVSS 7.1
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
PyPI pyload-ng · Upgrade to 0.5.0b3.dev97 (pre-release) or later · >= 0.5.0b3.dev13, <= 0.5.0b3.dev96 · CVE-2026-29778 · GHSA-6px9-j4qr-xfjw · amended
- Critical, CVSS 10.0
pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT
Maven org.pac4j:pac4j-jwt · Upgrade to 6.3.3, 5.7.9 or 4.5.9 by release line · >= 6.0.4.1, < 6.3.3; >= 5.0.0-RC1, < 5.7.9; < 4.5.9 · CVE-2026-29000 · GHSA-pm7g-w2cf-q238
- High, CVSS 8.7
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
npm multer · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-3520 · GHSA-5528-5vmv-3xc2 · amended
- High, CVSS 7.7
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
npm @backstage/plugin-techdocs-node · Upgrade to 1.14.3 or later · <= 1.14.2 · CVE-2026-29186 · GHSA-928r-fm4v-mvrw · amended
- High, CVSS 7.5
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
npm svgo · Upgrade to 4.0.1, 3.3.3 or 2.8.1 by release line · >= 2.1.0, < 2.8.1; >= 3.0.0, < 3.3.3; >= 4.0.0, <= 4.0.0 · CVE-2026-29074 · GHSA-xpqw-6gx7-v673 · amended
- High, CVSS 7.7
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover
Go github.com/zitadel/zitadel +1 · Upgrade all 2 to 4.12.0 or later · >= 4.0.0, < 4.12.0 · CVE-2026-29192 · GHSA-6rx5-m2rc-hmf7
- High, CVSS 8.2
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication
Go github.com/zitadel/zitadel +1 · Upgrade all 2 to 4.12.1 or later · >= 4.0.0, <= 4.12.0 · CVE-2026-29193 · GHSA-25rw-g6ff-fmg8
- Critical, CVSS 9.3
ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint
Go github.com/zitadel/zitadel +1 · Upgrade all 2 to 4.12.0 or later · >= 4.0.0, < 4.12.0 · CVE-2026-29191 · GHSA-pr34-2v5x-6qjq
- Critical, CVSS 9.1
File Browser's TUS Delete Endpoint Bypasses Delete Permission Check
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.61.1 or later · <= 2.61.0 · CVE-2026-29188 · GHSA-79pf-vx4x-7jmm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.