Low, CVSS 3.1
Bugsink: Issue event views can show an event from another project if its UUID is known
PyPI bugsink · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-47715 · GHSA-vx2f-6m6h-9frf · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5576–5600 of 30,985 matching · newest first
- High, CVSS 8.7
Twig: Possible sandbox bypass when using a source policy
Packagist twig/twig · Upgrade to 3.26.0; some affected versions have no fix yet · >= 2.16.0, <= 2.16.1; >= 3.9.0, < 3.26.0 · CVE-2026-24425 · GHSA-2q52-x2ff-qgfr
- Critical, CVSS 9.9
Shopper: Authorization bypass and RBAC privilege escalation in team settings
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47744 · GHSA-c3qp-2ggw-xjg7
- High, CVSS 8.7
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47743 · GHSA-hr9v-r8r2-hg7j
- Medium, CVSS 6.5
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47745 · GHSA-fxqw-97cc-7g5c
- Medium, CVSS 6.5
Shopper: Missing authorization on Product admin Livewire sub-form components
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47742 · GHSA-h4mp-g9c6-xwph
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin
data-mce-objectinjectionNuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · <= 5.10.9; >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1 · CVE-2026-47761 · GHSA-vg35-5wq7-3x7w
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability through
mce:protectedcommentsNuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1; <= 5.10.9 · CVE-2026-47762 · GHSA-v98h-vmpc-fpqv · amended
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
NuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1; <= 5.10.9 · CVE-2026-47759 · GHSA-q742-qvgc-gc2f · amended
- High, CVSS 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
NuGet tinymce +2 · Upgrade all 3 to 7.1.0 or later · >= 6.8.0, < 7.1.0 · CVE-2026-47760 · GHSA-mh5m-5hw4-5c69 · amended
- High, CVSS 7.1
skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion
crates.io skillctl · Upgrade to 0.1.2 or later · < 0.1.2 · GHSA-wx3m-whqv-xv47
- Critical, CVSS 9.1
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
PyPI ait-core · Upgrade to 3.1.1 or 2.6.1 by release line · >= 3.1.0, <= 3.1.0; < 2.6.1 · CVE-2026-47731 · GHSA-p462-prxw-mjx4 · amended
- Medium, CVSS 6.9
vantage6 node has an Improper Access Control issue
PyPI vantage6 · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-54533 · GHSA-x9f6-9rvm-mmrg · amended
- Medium, CVSS 6.9
Vantage6: Set admin user and password from environment or configuration
PyPI vantage6 · Upgrade to 5.0.0 or later · <= 4.2.3 · CVE-2026-54445 · GHSA-fgmc-2hqj-86v4 · amended
- High, CVSS 7.5
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52878 · GHSA-rm5c-5x2p-48wr
- High, CVSS 7.5
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52880 · GHSA-w4c6-7r69-w7j9
- High, CVSS 7.5
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52879 · GHSA-hf2g-6j7h-98wg
- Medium, CVSS 5.9
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · < 1.7.18 · CVE-2026-49343 · GHSA-fw38-pc54-jvx9
- High, CVSS 8.8
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
npm dbgate-api · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-48017 · GHSA-hv83-ggc4-v385 · amended
- High, CVSS 7.7
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
npm @sync-in/server · Upgrade to 2.3.0 or later · <= 2.2.1 · CVE-2026-47684 · GHSA-q4x5-8cj6-52wg · amended
- Medium, CVSS 5.3
Source controller: Improper path handling allows traversal
Go github.com/fluxcd/source-controller · Upgrade to 1.8.5 or later · >= 0.0.17, <= 1.8.4 · CVE-2026-47680 · GHSA-jjrm-hr5f-673x
- Critical, CVSS 9.4
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
npm dbgate-api · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47670 · GHSA-wm5r-5qp3-5vxf · amended
- High, CVSS 8.3
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47419 · GHSA-7p8g-6c6g-h9w7 · amended
- Critical, CVSS 9.3
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
npm dbgate · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47669 · GHSA-h535-j5hr-mv56 · amended
- Critical, CVSS 10.0
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
npm dbgate-serve · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47668 · GHSA-8v3q-9vmx-36vc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.