Medium, CVSS 5.3
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-46405 · GHSA-7j6w-vvw2-5f9c
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5851–5875 of 30,985 matching · newest first
- Medium, CVSS 6.0
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calico · Upgrade to 3.31.6 or 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f (pre-release) by release line · >= 2.0.0, < 3.31.6; < 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f · CVE-2026-41184 · GHSA-9p7w-w5q6-mxj3
- High, CVSS 7.2
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calicoctl/v3 · Upgrade to 3.31.6 or later · < 3.31.6 · CVE-2026-6720 · GHSA-3m4q-ggcj-j6m4
- Critical, CVSS 9.8
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
Go github.com/casdoor/casdoor · Upgrade to 2.387.0 or later · < 2.387.0 · CVE-2026-9094 · GHSA-c9w5-qp6m-m395
- Medium, CVSS 6.0
Calico Inserts Sensitive Information into Log File
Go github.com/projectcalico/calico · Upgrade to 3.31.6 or 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f (pre-release) by release line · >= 2.0.0, < 3.31.6; < 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f · CVE-2026-41185 · GHSA-m67g-87rx-v42c
- Medium, CVSS 6.7
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, < 4.0.3; < 3.12.2 · CVE-2026-46380 · GHSA-w76h-q7c6-jpjp · amended
- High, CVSS 7.2
OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd
PyPI pycti · Upgrade to 6.9.7 or later · < 6.9.7 · CVE-2026-44730 · GHSA-q537-qhj4-wcjx · amended
- Medium, CVSS 5.4
OpenBao's Inline Auth Incorrectly Redacted Headers
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-46358 · GHSA-q8cj-789h-vg24
- High, CVSS 8.4
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, < 4.0.3; <= 3.12.1 · CVE-2026-46345 · GHSA-4q5v-7g7x-j79w · amended
- High, CVSS 7.1
OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
Go github.com/openbao/openbao · Upgrade to 2.5.4 or later · <= 2.5.3 · CVE-2026-45808 · GHSA-v8v8-cm84-m686
- Medium, CVSS 5.5
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · >= 4.0.0, <= 4.0.2; < 3.12.2 · CVE-2026-45774 · GHSA-mj4x-vf5c-5xg8 · amended
- Low, CVSS 2.7
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12 or 7.4.12 by release line · >= 7.3.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45756 · GHSA-8v8v-g73j-492j
- Medium, CVSS 6.6
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12 or 7.4.12 by release line · >= 7.2.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45755 · GHSA-59f3-vp2f-mp9w
- Medium, CVSS 6.6
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Packagist symfony/symfony · Upgrade to 8.0.12, 7.4.12 or 6.4.40 by release line · >= 6.4.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · +2 more packages · CVE-2026-45754 · GHSA-64hg-93w9-fc35
- Low, CVSS 2.1
opentelemetry-go's Schema ParseFile leaks file descriptors on each parse
Go go.opentelemetry.io/otel/schema +2 · Upgrade all 3 to 0.0.17 or later · < 0.0.17 · CVE-2026-45287 · GHSA-995v-fvrw-c78m
- Medium, CVSS 5.3
opentelemetry-go's baggage parsing no longer caps raw header length
Go go.opentelemetry.io/otel/baggage +1 · Upgrade all 2 to 1.44.0 or 1.42.0 by release line · >= 1.41.0, <= 1.41.0; >= 1.43.0, <= 1.43.0 · CVE-2026-41178 · GHSA-5wrp-cwcj-q835
- Medium, CVSS 6.9
Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability
Go github.com/projectcapsule/capsule · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2026-22872 · GHSA-qjjm-7j9w-pw72
- Low, CVSS 3.9
Capsule Namespace Hijacking via subresource
Go github.com/projectcapsule/capsule · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2026-30963 · GHSA-2ww6-hf35-mfjm
- Low, CVSS 1.2
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite —
javascript: URI Survives Sanitization (XSS)Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12 or 6.4.40 by release line · >= 6.1.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45753 · GHSA-hhg7-c65m-h7ff
- Low, CVSS 1.2
QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability
Maven ch.qos.logback:logback-core · Upgrade to 1.5.33 or later · <= 1.5.32 · CVE-2026-9828 · GHSA-p47f-322f-whfh
- Medium, CVSS 4.3
Apache Artemis has an Incorrect Authorization issue
Maven org.apache.artemis:artemis-stomp-protocol · Upgrade to 2.54.0; some affected versions have no fix yet · >= 2.50.0, <= 2.53.0; >= 2.0.0, <= 2.44.0 · CVE-2026-40914 · GHSA-rf99-f9j2-gv3f
- High, CVSS 8.5
Apache Ignite REST API Has a Relative Path Traversal Vulnerability
Maven org.apache.ignite:ignite-core · Upgrade to 2.18.0 or later · >= 2.0.0, < 2.18.0 · CVE-2025-48977 · GHSA-v45h-mqf4-6939
- Medium, CVSS 4.9
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input
Maven org.keycloak:keycloak-ldap-federation · Upgrade to 26.6.3 or later · < 26.6.3 · CVE-2026-9801 · GHSA-f6r7-6w34-x2gp
- Medium, CVSS 5.3
Keycloak has an Out-of-bounds Read
Maven org.keycloak:keycloak-services · Upgrade to 26.6.3; some affected versions have no fix yet · <= 26.4.7; >= 26.5.0, < 26.6.3 · CVE-2026-9803 · GHSA-cpf7-j4cf-vqx4
- Medium, CVSS 6.8
Keycloak has Insufficient Session Expiration
Maven org.keycloak:keycloak-services · Upgrade to 26.6.3; some affected versions have no fix yet · <= 26.4.7; >= 26.5.0, < 26.6.3 · CVE-2026-9802 · GHSA-v5g5-wwmp-jppw
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.