High, CVSS 7.5
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
PyPI nicegui · Upgrade to 3.12.0 or later · <= 3.11.1 · CVE-2026-45553 · GHSA-jfrm-rx66-g536 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6251–6275 of 30,985 matching · newest first
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · >= 0.7.0, < 0.9.0 · CVE-2026-45686 · GHSA-43g7-cwr8-q3jh
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45685 · GHSA-j8p6-96vp-f3r9
- Medium, CVSS 4.9
OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · >= 0.7.0, < 0.9.0 · CVE-2026-45684 · GHSA-vvmg-8mjr-g6q3
- Medium, CVSS 5.1
OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45682 · GHSA-962q-hwm5-52x5
- Low, CVSS 3.8
OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45683 · GHSA-fjq3-ffvr-vm46
- Medium, CVSS 5.9
OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45681 · GHSA-r6c9-g6q5-qrf9
- Medium, CVSS 5.9
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45680 · GHSA-89c6-vpcj-7vj4
- High, CVSS 7.3
Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-35433 · GHSA-8x9c-mqxv-q2pp
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-42899 · GHSA-9v76-4qcc-frgh
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +3 · Upgrade all 4 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-32175 · GHSA-rg75-q538-x34v
- Medium, CVSS 4.4
ws: Uninitialized memory disclosure
npm ws · Upgrade to 8.20.1 or later · >= 8.0.0, < 8.20.1 · CVE-2026-45736 · GHSA-58qx-3vcg-4xpx · amended
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45678 · GHSA-pgvv-q3wf-mm9m
- Medium, CVSS 6.5
OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45679 · GHSA-8rrq-wcg8-cv5q
- Medium, CVSS 5.5
OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45676 · GHSA-wp73-mwgf-4jq9
- Medium, CVSS 5.3
ImageMagick: Policy Bypass in PSD decoder
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-45031 · GHSA-cwpj-h54c-xjpx
- High, CVSS 8.8
CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
PyPI cloakbrowser · Upgrade to 0.3.28 or later · <= 0.3.27 · CVE-2026-45727 · GHSA-mf33-gv72-w2h5 · amended
- Medium, CVSS 5.3
ImageMagick: Out-of-Bounds Read of a single byte in meta encoder
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-45358 · GHSA-cr6r-hmj8-pr7r
- Medium, CVSS 5.7
ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-45359 · GHSA-vhrh-72hq-w8m7
- Medium, CVSS 6.5
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
npm @budibase/server · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45719 · GHSA-363w-hvwh-w7m6 · amended
- Medium, CVSS 5.4
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
npm budibase · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45718 · GHSA-3263-v5v9-xq8q · amended
- High, CVSS 8.8
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
npm @budibase/worker · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45716 · GHSA-c54j-xp92-wh28 · amended
- High, CVSS 8.1
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
npm n8n-mcp · Upgrade to 2.51.2 or later · <= 2.51.1 · CVE-2026-45707 · GHSA-jxx9-px88-pj69 · amended
- High, CVSS 7.5
multiparty vulnerable to ReDoS via filename parsing
npm multiparty · Upgrade to 4.3.0 or later · <= 4.2.3 · CVE-2026-8159 · GHSA-65x3-rw7q-gx94 · amended
- High, CVSS 7.5
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
npm multiparty · Upgrade to 4.3.0 or later · <= 4.2.3 · CVE-2026-8162 · GHSA-xh3c-6gcq-g4rv · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.