High, CVSS 8.1
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-62376 · GHSA-r6w9-259g-gwrv · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 1.0.0, <= 2.3.0 · CVE-2026-62367 · GHSA-xv7q-fvmc-jx96 · amended
- Critical, CVSS 9.0
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728074146-a467ed652591 (pre-release) or later · >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 · CVE-2026-107806 · GHSA-p393-cf76-4jmr · amended
- High, CVSS 7.5
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud
getFileURLEndpoint Leads to Remote Denial of ServiceGo github.com/luskaner/ageLANServer/server · Upgrade to 1.8.2-0.20260809203301-1dd40166a593 (pre-release) or later · < 1.8.2-0.20260809203301-1dd40166a593 · CVE-2026-107839 · GHSA-4jfq-pmq9-257h · amended
- High, CVSS 7.5
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
Go code.vikunja.io/api · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2026-76216 · GHSA-32r8-5843-4qw2 · amended
- High, CVSS 7.5
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
Go github.com/jhaals/yopass · Upgrade to 0.0.0-20260727191436-61e31ead04a4 (pre-release) or later · < 0.0.0-20260727191436-61e31ead04a4 · CVE-2026-107840 · GHSA-6r69-c6wg-7g8m · amended
- Critical, CVSS 9.3
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.24.0, <= 2.3.0 · CVE-2026-68582 · GHSA-rj9j-8772-4h6c · amended
- High, CVSS 8.1
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.22.0, <= 2.3.0 · CVE-2026-68581 · GHSA-vvcv-vpph-h844 · amended
- High, CVSS 8.1
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 2.3.0, <= 2.3.0 · CVE-2026-57458 · GHSA-v3p6-34mc-hj7v · amended
- High, CVSS 7.5
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728114330-580585516dd8 (pre-release) or later · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728114330-580585516dd8 · CVE-2026-107812 · GHSA-662p-52hx-cmh2 · amended
- High, CVSS 8.1
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728074558-95cd21b70814 (pre-release) or later · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814 · CVE-2026-107808 · GHSA-45gv-9wjv-xh7p · amended
- High, CVSS 8.8
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728074433-a3999bd78a3b (pre-release) or later · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b · CVE-2026-107809 · GHSA-33rr-wq23-g6gg · amended
- High, CVSS 8.8
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728074433-a3999bd78a3b (pre-release) or later · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b · CVE-2026-107813 · GHSA-h246-wpgf-vmq5 · amended
- High, CVSS 8.8
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728091109-0ecbd106c37b (pre-release) or later · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728091109-0ecbd106c37b · CVE-2026-107811 · GHSA-32gc-wf3m-78w9 · amended
- High, CVSS 8.8
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728074433-a3999bd78a3b (pre-release) or later · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b · CVE-2026-107807 · GHSA-pvgv-gcp7-v38g · amended
- High, CVSS 8.1
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728074146-a467ed652591 (pre-release) or later · >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591 · CVE-2026-107810 · GHSA-p8v3-89rh-jxc7 · amended
- High, CVSS 8.1
pyLoad has an authentication bypass in API key validation (check_apikey cache)
PyPI pyload-ng · Upgrade to 0.5.0b3.dev101 (pre-release) or later · < 0.5.0b3.dev101 · CVE-2026-123816 · GHSA-r44w-v6gf-x3p6 · amended
- High, CVSS 7.5
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
PyPI strawberry-graphql · Upgrade to 0.326.1 or later · >= 0.217.0, <= 0.326.0 · CVE-2026-107728 · GHSA-pfvf-fwfp-25mp · amended
- High, CVSS 7.3
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
crates.io zip · Upgrade to 9.0.0 or later · >= 0.0.0-0, < 9.0.0 · GHSA-vv5m-jxxh-4627
- High, CVSS 7.5
MIKEY message MAC is never verified on receive, so forged messages are accepted
crates.io mykey · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-xq78-wvcv-hqvj
- High, CVSS 7.5
Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
crates.io ic-cipher · Upgrade to 0.2.20 or later · >= 0.2.5, < 0.2.20 · GHSA-xr22-8pqp-gwfh
- Critical, CVSS 9.1
Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
crates.io mykey · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-fwjg-cm92-j3hj
- Critical, CVSS 9.3
Hazelcast allows arbitrary member memory access by low-privileged client
Maven com.hazelcast:hazelcast · Upgrade to 5.7.0 or later · >= 5.6.0, < 5.7.0; >= 5.5.0, < 5.7.0; < 5.7.0 · CVE-2026-107726 · GHSA-6v25-8wq6-xq4j · amended
- High, CVSS 8.7
Hazelcast has an authorization bypass in IMap Predicates API
Maven com.hazelcast:hazelcast · Upgrade to 5.7.0 or later · >= 5.6.0, < 5.7.0; >= 5.5.0, < 5.7.0; < 5.7.0 · CVE-2026-107725 · GHSA-w294-6q5q-53p8 · amended
- High, CVSS 7.4
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
npm fast-jwt · Upgrade to 6.3.1 or later · <= 6.3.0 · CVE-2026-107720 · GHSA-8wpc-h4q6-8fxv · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.