High, CVSS 8.5
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48153 · GHSA-4q6h-8p4v-67vq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 962 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4726–4750 of 30,967 matching · newest first
- Unrated
skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery
crates.io skillctl · Upgrade to 0.1.3 or later · < 0.1.3 · GHSA-74p7-6h78-gw8p
- High, CVSS 8.3
Gogs has SSRF in webhook deliveries
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-47267 · GHSA-c4v7-xg93-qf8g
- Medium, CVSS 4.3
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
npm @actual-app/sync-server · Upgrade to 26.6.0 or later · < 26.6.0 · CVE-2026-46700 · GHSA-3f62-qv96-4p78 · amended
- Medium, CVSS 4.6
@actual-app/cli
--format csvOutput Vulnerable to CSV Formula Injection via CustomescapeCsvHelpernpm @actual-app/cli · Upgrade to 26.6.0 or later · < 26.6.0 · CVE-2026-46672 · GHSA-7gh7-258j-4mpq · amended
- Medium, CVSS 5.3
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46611 · GHSA-w856-8p3r-p338 · amended
- High, CVSS 7.4
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46608 · GHSA-87qc-fj39-wccr · amended
- High, CVSS 7.8
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46607 · GHSA-9837-48hr-q32j · amended
- High, CVSS 7.8
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46606 · GHSA-v5r2-qh84-fjx5 · amended
- Critical, CVSS 9.2
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 5.1.1 or later · <= 5.1.0 · CVE-2026-46495 · GHSA-43x2-g84q-fmqx
- Critical, CVSS 9.1
motionEye: Authentication possible via password hash
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-46488 · GHSA-r3cw-c95m-wfh9 · amended
- High, CVSS 8.5
Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types
Maven io.spinnaker.rosco:rosco-core +1 · Upgrade all 2 to 2026.0.3, 2025.4.4 or 2025.3.3 by release line · < 2025.3.3; >= 2025.4.0, < 2025.4.4; >= 2026.0.0, < 2026.0.3 · CVE-2026-44795 · GHSA-c8q4-9h32-2ww8
- Low, CVSS 2.3
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via
FSUtils.postToTargetMaven org.openidentityplatform.openam:openam-federation-library · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-44793 · GHSA-fhrq-3gmx-p879 · amended
- Low, CVSS 2.9
Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)
Go github.com/inspektor-gadget/inspektor-gadget · Upgrade to 0.53.1 or later · >= 0.28.0, < 0.53.1 · CVE-2026-44778 · GHSA-7cfq-5mhv-jrp9
- Medium, CVSS 5.4
Paymenter has broken object level authorization via service reference manipulation on ticket creation
Packagist paymenter/paymenter · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-44585 · GHSA-x93q-x9pc-w5hw
- Medium, CVSS 4.3
Paymenter doesn't reset email verification status after email change
Packagist paymenter/paymenter · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-44584 · GHSA-rv89-wch8-c574
- Medium, CVSS 5.3
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
Packagist paymenter/paymenter · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-44583 · GHSA-7wwh-xcc3-9fcg
- High, CVSS 8.3
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · >= 13.0.0, < 16.1.1 · CVE-2026-44203 · GHSA-fq9h-c788-fx73 · amended
- Medium, CVSS 6.2
OpenAM Authenticated Server-Side Request Forgery (SSRF) via
/sessionserviceMaven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-44202 · GHSA-c556-q2mh-477v · amended
- Critical, CVSS 9.9
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
Maven com.xwiki.pro:xwiki-pro-macros · Upgrade to 1.14.5 or later · >= 1.13, < 1.14.5 · CVE-2026-44179 · GHSA-w56x-9778-rppx
- Medium, CVSS 4.8
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
Go github.com/opencontainers/runc · Upgrade to 1.5.0-rc.3 (pre-release), 1.4.3 or 1.3.6 by release line · <= 1.3.5; >= 1.4.0, <= 1.4.2; >= 1.5.0-rc.1, <= 1.5.0-rc.2 · CVE-2026-41579 · GHSA-xjvp-4fhw-gc47
- High, CVSS 8.7
OpenAM has LDAP Injection via
_queryIdParameterMaven org.openidentityplatform.openam:openam-core-rest · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-41573 · GHSA-2vg8-q4c2-5cw3 · amended
- Medium, CVSS 6.5
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
Packagist wwbn/avideo · Upgrade to 29.0 or later · <= 28.0 · CVE-2026-33731 · GHSA-95jh-7r58-xmxw
- High, CVSS 7.5
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
PyPI comfyui-manager · Upgrade to 3.38 or later · < 3.38 · CVE-2025-67303 · GHSA-95pq-hr8p-f5g7 · amended
- High, CVSS 7.5
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Packagist wwbn/avideo · Upgrade to 29.0 or later · < 29.0 · CVE-2026-33692 · GHSA-wf69-r4mx-43rr
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.