High, CVSS 8.8
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Packagist statamic/cms · Upgrade to 6.4.0 or later · >= 6.0.0, < 6.4.0 · CVE-2026-27939 · GHSA-rw9x-pxqx-q789
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
Packagist thorsten/phpmyfaq · Upgrade to 4.0.18 or later · < 4.0.18 · CVE-2026-27836 · GHSA-w22q-m2fm-x9f4
- High, CVSS 7.5
Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints
NuGet umbraco.engage.forms · Upgrade to 17.1.1 or 16.2.1 by release line · >= 17.0.0, < 17.1.1; >= 16.0.0, < 16.2.1 · CVE-2026-27449 · GHSA-86vq-ccwf-rm62
- High, CVSS 7.0
Angular i18n vulnerable to Cross-Site Scripting
npm @angular/core · Upgrade to 21.2.0, 21.1.6, 20.3.17 or 19.2.19 by release line; some affected versions have no fix yet · >= 21.2.0-next.0, <= 21.2.0-rc.0; >= 21.0.0-next.0, <= 21.1.5; >= 20.0.0-next.0, <= 20.3.16; >= 19.0.0-next.0, <= 19.2.18; <= 18.2.14 · CVE-2026-27970 · GHSA-prjf-86w9-mfqv · amended
- High, CVSS 8.3
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage
npm clevertap-web-sdk · Upgrade to 1.15.3 or later · < 1.15.3 · CVE-2026-26862 · GHSA-jfrq-hj9f-c8qx · amended
- High, CVSS 8.3
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function
npm clevertap-web-sdk · Upgrade to 1.15.3 or later · < 1.15.3 · CVE-2026-26861 · GHSA-j5mf-6rh3-rhgg · amended
- Critical, CVSS 9.3
Vitess users with backup storage access can write to arbitrary file paths on restore
Go vitess.io/vitess · Upgrade to 0.23.3 or 0.22.4 by release line · >= 0.23.0-rc1, < 0.23.3; < 0.22.4 · CVE-2026-27969 · GHSA-r492-hjgh-c9gw
- High, CVSS 8.3
rubyipmi is vulnerable to OS Command Injection through malicious usernames
RubyGems rubyipmi · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2026-0980 · GHSA-hfcp-477w-3wjw
- Critical, CVSS 9.1
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
PyPI vitrage · Upgrade to 15.0.1, 14.0.1, 13.0.1 or 12.0.1 by release line · >= 15.0.0.0rc1, < 15.0.1; >= 14.0.0.0rc1, < 14.0.1; >= 13.0.0.0rc1, < 13.0.1; < 12.0.1 · CVE-2026-28370 · GHSA-8xwf-cr4r-856r · amended
- High, CVSS 8.7
OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode
npm openclaw · Upgrade to 2026.2.23 or later · < 2026.2.23 · CVE-2026-28363 · GHSA-7977-c43c-xpwj · amended
- High, CVSS 7.1
Curio exposes database credentials to users with network access through verbose HTTP error responses
Go github.com/filecoin-project/curio · Upgrade to 1.27.3-rc2 (pre-release) or later · >= 1.24.3, <= 1.27.2 · GHSA-gj6x-q8rh-wj6x
- High, CVSS 7.5
Koa has Host Header Injection via ctx.hostname
npm koa · Upgrade to 3.1.2 or 2.16.4 by release line · >= 3.0.0, < 3.1.2; < 2.16.4 · CVE-2026-27959 · GHSA-7gcc-r8m5-44qm · amended
- High, CVSS 8.8
WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level
Go github.com/h44z/wg-portal · Upgrade to 2.1.3 or later · <= 2.1.2 · CVE-2026-27899 · GHSA-5rmx-256w-8mj9
- High, CVSS 7.0
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
Go github.com/modelcontextprotocol/go-sdk · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-27896 · GHSA-wvj2-96wp-fq3f
- High, CVSS 7.5
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
npm minimatch · Upgrade to 10.2.3, 9.0.7, 8.0.6 or 5 more by release line · >= 10.0.0, < 10.2.3; >= 9.0.0, < 9.0.7; >= 8.0.0, < 8.0.6; >= 7.0.0, < 7.4.8; >= 6.0.0, < 6.2.2; >= 5.0.0, < 5.1.8; >= 4.0.0, < 4.2.5; < 3.1.3 · CVE-2026-27903 · GHSA-7r86-cg39-jmmj · amended
- High, CVSS 7.5
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
npm minimatch · Upgrade to 10.2.3, 9.0.7, 8.0.6 or 5 more by release line · >= 10.0.0, < 10.2.3; >= 9.0.0, < 9.0.7; >= 8.0.0, < 8.0.6; >= 7.0.0, < 7.4.8; >= 6.0.0, < 6.2.2; >= 5.0.0, < 5.1.8; >= 4.0.0, < 4.2.5; < 3.1.4 · CVE-2026-27904 · GHSA-23c5-xmqv-rm74 · amended
- High, CVSS 7.1
Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.80.1 or later · < 4.80.1 · CVE-2026-27465 · GHSA-2v6m-6xw3-6467
- High, CVSS 8.7
TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist
npm terriajs-server · Upgrade to 4.0.3 or later · < 4.0.3 · CVE-2026-27818 · GHSA-w789-49fc-v8hr · amended
- High, CVSS 8.9
Storybook Dev Server is Vulnerable to WebSocket Hijacking
npm storybook · Upgrade to 10.2.10, 9.1.19 or 8.6.17 by release line · >= 8.1.0, < 8.6.17; >= 8.7.0-alpha.0, < 9.1.19; >= 10.0.0-beta.0, < 10.2.10 · CVE-2026-27148 · GHSA-mjf5-7g4m-gx5w · amended
- High, CVSS 8.8
PYSEC-2026-7
PyPI agenta · Upgrade to 0.86.8 or later · < 0.86.8 · CVE-2026-27961 · GHSA-cfr2-mp74-3763
- Critical, CVSS 9.9
PYSEC-2026-6
PyPI agenta · Upgrade to 0.48.1 or later · < 0.48.1 · CVE-2026-27952 · GHSA-pmgp-2m3v-34mq
- Critical, CVSS 9.9
PYSEC-2026-2246
PyPI openlit · Upgrade to 1.37.1 or later · >= 1.36.2, < 1.37.1 · CVE-2026-27941 · GHSA-9jgv-x8cq-296q
- Critical, CVSS 9.3
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
npm parse-server · Upgrade to 9.3.1-alpha.4 (pre-release) or 8.6.3 by release line · >= 9.0.0, <= 9.3.1-alpha.3; <= 8.6.2 · CVE-2026-27804 · GHSA-4q3h-vp4r-prv2 · amended
- Critical, CVSS 9.0
Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
crates.io rustfs · Upgrade to 1.0.0-alpha.83 (pre-release) or later · < 1.0.0-alpha.83 · CVE-2026-27822 · GHSA-v9fg-3cr2-277j
- High, CVSS 8.6
esm.sh has SSRF localhost/private-network bypass in
/http(s)module routeGo github.com/esm-dev/esm.sh · Upgrade to 0.0.0-20250616164159-0593516c4cfa (pre-release) or later · < 0.0.0-20250616164159-0593516c4cfa · CVE-2026-27730 · GHSA-p2v6-84h2-5x4r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.