High, CVSS 8.7
Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint
Go github.com/gravitl/netmaker · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2026-29771 · GHSA-rhr9-hgcm-x289
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260304034809-d68bd5a79391 (pre-release) or later · < 0.0.0-20260304034809-d68bd5a79391 · CVE-2026-29183 · GHSA-6865-qjcf-286f
- High, CVSS 8.6
NLTK has a Path Traversal issue
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-0847 · GHSA-68j8-pq59-fqgm · amended
- High, CVSS 8.9
Fickling missing RCE-capable modules in UNSAFE_IMPORTS
PyPI fickling · Upgrade to 0.1.9 or later · <= 0.1.8 · GHSA-5hwf-rc88-82xm · amended
- High, CVSS 8.9
Fickling has
always_check_safety()bypass: pickle.loads and _pickle.loads remain unhookedPyPI fickling · Upgrade to 0.1.9 or later · <= 0.1.8 · GHSA-wccx-j62j-r448 · amended
- High, CVSS 8.8
changedetection.io has Zip Slip vulnerability in the backup restore functionality
PyPI changedetection-io · Upgrade to 0.54.4 or later · <= 0.54.3 · CVE-2026-29065 · GHSA-25g8-2mcf-fcx9 · amended
- High, CVSS 8.7
Immutable is vulnerable to Prototype Pollution
npm immutable · Upgrade to 5.1.5, 4.3.8 or 3.8.3 by release line · >= 5.0.0, < 5.1.5; >= 4.0.0-rc.1, < 4.3.8; < 3.8.3 · CVE-2026-29063 · GHSA-wf6x-7x77-mvgw · amended
- High, CVSS 8.7
jackson-core has Nesting Depth Constraint Bypass in
UTF8DataInputJsonParserpotentially allowing Resource ExhaustionMaven tools.jackson.core:jackson-core · Upgrade to 3.1.0 or later · >= 3.0.0, < 3.1.0 · CVE-2026-29062 · GHSA-6v53-7c9g-w56r
- High, CVSS 7.5
traefik CVE-2024-45410 fix bypass: lowercase
Connectiontokens can delete traefik-managed forwarded identity headers (for example,X-Real-Ip)Go github.com/traefik/traefik/v3 · Upgrade to 3.6.9 or later · >= 3.1.3, <= 3.6.8 · +1 more package · CVE-2026-29054 · GHSA-92mv-8f8w-wq52
- High, CVSS 8.9
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation
Go github.com/nuclio/nuclio · Upgrade to 1.15.20 or later · <= 1.15.9 · CVE-2026-29042 · GHSA-95fj-3w7g-4r27
- High, CVSS 8.8
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
PyPI changedetection-io · Upgrade to 0.54.4 or later · <= 0.54.3 · CVE-2026-29039 · GHSA-6fmw-82m7-jq6p · amended
- High, CVSS 7.7
Authlib: Setting
alg: noneand a blank signature appears to bypass signature verificationPyPI authlib · Upgrade to 1.6.7 or later · >= 1.6.5, <= 1.6.6 · CVE-2026-28802 · GHSA-7wc2-qxgw-g8gg · amended
- High, CVSS 7.7
Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint
crates.io lemmy_routes · Upgrade to 0.19.16 or later · <= 0.19.15 · CVE-2026-29178 · GHSA-jvxv-2jjp-jxc3
- High, CVSS 7.8
Craft CMS has unauthenticated activation email trigger with potential user enumeration
Packagist craftcms/cms · Upgrade to 5.9.0-beta.2 (pre-release) or 4.17.0-beta.2 (pre-release) by release line · >= 5.0.0-RC1, < 5.9.0-beta.2; >= 4.0.0-RC1, < 4.17.0-beta.2 · CVE-2026-29069 · GHSA-234q-vvw3-mrfq
- High, CVSS 8.1
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
PyPI irrd · Upgrade to 4.5.1 or 4.4.5 by release line · >= 4.4.0, < 4.4.5; >= 4.5.0, < 4.5.1 · CVE-2026-28681 · GHSA-22m3-c7vp-49fj · amended
- High, CVSS 8.1
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
npm locutus · Upgrade to 3.0.0 or later · <= 2.0.39 · CVE-2026-29091 · GHSA-fp25-p6mj-qqg6 · amended
- High, CVSS 8.3
Vaultwarden's Collection Management Operations Allowed Without
manageVerification for Manager Rolecrates.io vaultwarden · Upgrade to 1.35.4 or later · <= 1.35.3 · CVE-2026-27803 · GHSA-h4hq-rgvh-wh27
- High, CVSS 8.3
Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
crates.io vaultwarden · Upgrade to 1.35.4 or later · <= 1.35.3 · CVE-2026-27802 · GHSA-r32r-j5jq-3w4m
- High, CVSS 7.5
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
npm @hono/node-server · Upgrade to 1.19.10 or later · < 1.19.10 · CVE-2026-29087 · GHSA-wc8c-qw6v-h7f6 · amended
- High, CVSS 7.5
Hono vulnerable to arbitrary file access via serveStatic vulnerability
npm hono · Upgrade to 4.12.4 or later · < 4.12.4 · CVE-2026-29045 · GHSA-q5qw-h33p-qvwr · amended
- High, CVSS 7.6
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · GHSA-3jx4-q2m7-r496 · amended
- High, CVSS 7.4
OpenClaw Canvas Authentication Bypass Vulnerability
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-3690 · GHSA-vvjh-f6p9-5vcf · amended
- High, CVSS 7.6
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · CVE-2026-32005 · GHSA-x2ff-j5c2-ggpr · amended
- High, CVSS 7.5
Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS)
Go github.com/traefik/traefik/v3 · Upgrade to 3.6.9 or later · <= 3.6.8 · +1 more package · CVE-2026-26999 · GHSA-xw98-5q62-jx94
- High, CVSS 8.6
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
Maven org.xwiki.contrib.blog:application-blog-ui · Upgrade to 9.15.7 or later · >= 9.15, < 9.15.7 · CVE-2025-66024 · GHSA-h2xq-h7f9-vh6c
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.