Low, CVSS 2.1
AMF Vulnerable to Improper Resource Shutdown or Release
Go github.com/omec-project/amf · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-8783 · GHSA-6v92-ph9p-hrpc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6326–6350 of 30,985 matching · newest first
- Low, CVSS 2.1
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer
Go github.com/omec-project/amf · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-8779 · GHSA-fxvj-wqv2-xgcq
- Low, CVSS 2.1
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer
Go github.com/omec-project/amf · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-8780 · GHSA-3x4g-259h-5p7c
- Low, CVSS 2.1
AMF Vulnerable to Improper Resource Shutdown or Release
Go github.com/omec-project/amf · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-8782 · GHSA-6h8r-h22r-jj64
- Low, CVSS 2.1
AMF Vulnerable to Improper Resource Shutdown or Release
Go github.com/omec-project/amf · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-8781 · GHSA-4qf2-p32m-7hmf
- Low, CVSS 2.1
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
npm @ai-sdk/provider-utils · Upgrade to 5.0.1, 4.0.33 or 3.0.28 by release line · < 3.0.28; >= 4.0.0-beta.10, < 4.0.33; >= 5.0.0-beta.0, < 5.0.1 · CVE-2026-8769 · GHSA-866g-f22w-33x8 · amended
- Low, CVSS 2.1
AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py
PyPI astrbot · Upgrade to 4.23.6 or later · < 4.23.6 · CVE-2026-8754 · GHSA-f63h-wc26-pmvc · amended
- High, CVSS 7.8
jsondiffpatch patch APIs are vulnerable to prototype pollution
npm jsondiffpatch · Upgrade to 0.7.6 or later · < 0.7.6 · CVE-2026-8657 · GHSA-j4fx-xxwh-2485 · amended
- Low, CVSS 3.1
Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields
Go github.com/mattermost/mattermost-server · Upgrade to 11.5.2 or 0.0.0-20260414103857-b21ef302025e (pre-release) by release line · >= 11.5.0, < 11.5.2; >= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e · CVE-2026-4053 · GHSA-hw87-6jcq-9f8q
- Medium, CVSS 4.3
Mattermost doesn't validate the response body of proxied images
Go github.com/mattermost/mattermost-server · Upgrade to 11.5.2, 11.4.4 or 0.0.0-20260414103857-b21ef302025e (pre-release) by release line · >= 11.5.0, < 11.5.2; >= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e; >= 11.4.0, < 11.4.4 · CVE-2026-4054 · GHSA-j76w-p754-g2w7
- High, CVSS 7.4
Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client
Maven com.oviva.telematik:epa4all-client · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-45575 · GHSA-gqx7-6552-67hf
- High, CVSS 8.1
Apache Flink: Remote code execution via SQL injection in code generation
Maven org.apache.flink:flink-table-planner_2.12 +2 · Upgrade all 3 to 2.2.1, 2.1.2, 2.0.2 or 1.20.4 by release line · >= 1.15.0, < 1.20.4; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.2; >= 2.2.0, < 2.2.1 · CVE-2026-35194 · GHSA-2f54-v4hm-fx73
- High, CVSS 8.1
epa4all-client: TLS Certificate Validation Disabled in Production
Maven com.oviva.telematik:epa4all-client · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-45574 · GHSA-5hhf-xmfx-4vvr
- Medium, CVSS 5.5
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in
apm installPyPI apm-cli · Upgrade to 0.13.0 or later · <= 0.12.4 · CVE-2026-46383 · GHSA-mq5j-pw29-jcv3 · amended
- Medium, CVSS 6.3
arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS
Go github.com/arnika-project/arnika · Upgrade to 1.0.1 or later · <= 1.0.0 · GHSA-rc6v-5rmx-w5mv
- Medium, CVSS 6.9
rkyv: Panic safety bugs in
InlineVec::clearandSerVec::clearenable arbitrary code executioncrates.io rkyv · Upgrade to 0.8.16 or later · >= 0.8.0, < 0.8.16 · GHSA-vfvv-c25p-m7mm
- High, CVSS 8.6
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
Packagist simplesamlphp/simplesamlphp-module-casserver · Upgrade to 7.0.3 or later · <= 7.0.2 · CVE-2026-46491 · GHSA-jrrg-99xh-5j2q
- High, CVSS 7.7
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
Packagist code16/sharp · Upgrade to 9.22.0 or later · < 9.22.0 · CVE-2026-44692 · GHSA-748w-hm6r-qc7v
- High, CVSS 8.8
Budibase:
PUT /api/datasources/:datasourceIdis protected only byTABLE/READpermission instead of builder access, allowing any authenticated app user to overwrite datasource connection…npm @budibase/server · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45717 · GHSA-44m2-crh7-f4q2 · amended
- High, CVSS 7.7
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
npm @budibase/server · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45715 · GHSA-fgqv-jh4g-pvg2 · amended
- High, CVSS 7.7
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
npm @budibase/server · Upgrade to 3.34.8 or later · < 3.34.8 · CVE-2026-45548 · GHSA-rpj4-7x2v-wjrf · amended
- High, CVSS 7.3
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
npm better-auth · Upgrade to 1.5.0-beta.9 (pre-release) or 1.4.17 by release line · < 1.4.17; >= 1.5.0-beta.1, < 1.5.0-beta.9 · CVE-2026-45364 · GHSA-p6v2-xcpg-h6xw · amended
- Medium, CVSS 5.3
Better Auth: OAuth callback accepts mismatched
statewhen cookie-backed state storage is used without PKCEnpm better-auth · Upgrade to 1.6.2 or later · < 1.6.2 · CVE-2026-67335 · GHSA-wxw3-q3m9-c3jr · amended
- High, CVSS 7.4
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request
Go goshs.de/goshs/v2 · Upgrade to 2.0.7 or later · <= 2.0.6 · GHSA-mxg3-432p-mr72
- Medium, CVSS 4.6
Weblate: Stored HTML injection in editor search preview
PyPI weblate · Upgrade to 2026.5 or later · < 2026.5 · CVE-2026-45106 · GHSA-6wxc-8mgq-w26m · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.