Medium, CVSS 5.3
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Maven io.opentelemetry:opentelemetry-api +1 · Upgrade all 2 to 1.62.0 or later · <= 1.61.0 · CVE-2026-45292 · GHSA-rcgg-9c38-7xpx
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6426–6450 of 30,985 matching · newest first
- Medium, CVSS 6.0
Portainer missing authorization on custom template file endpoint, which exposes template content
Go github.com/portainer/portainer · Upgrade to 2.39.1 or 2.33.8 by release line · >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.1 · CVE-2026-44884 · GHSA-cqpq-2fgr-8mvc
- High, CVSS 7.7
Portainer: JWT accepted in URL query leaks tokens to logs and referers
Go github.com/portainer/portainer · Upgrade to 2.41.0, 2.39.2 or 2.33.8 by release line · >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0 · CVE-2026-44883 · GHSA-jvp4-q659-95mj
- Critical, CVSS 9.4
Portainer has an endpoint security bypass via Swarm service create/update
Go github.com/portainer/portainer · Upgrade to 2.41.0, 2.39.2 or 2.33.8 by release line · >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0 · CVE-2026-44849 · GHSA-5fxq-qcf3-244w
- High, CVSS 8.1
Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization
Go github.com/portainer/portainer · Upgrade to 2.33.8 or later · >= 2.33.0, < 2.33.8 · CVE-2026-44882 · GHSA-mgq6-4x29-88r3
- High, CVSS 8.5
Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update
Go github.com/portainer/portainer · Upgrade to 2.41.0, 2.39.2 or 2.33.8 by release line · >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0 · CVE-2026-44881 · GHSA-rpgq-m5fp-32wr
- High, CVSS 8.5
Portainer has a bind-mount restriction bypass via HostConfig.Mounts
Go github.com/portainer/portainer · Upgrade to 2.41.0, 2.39.2 or 2.33.8 by release line · >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0 · CVE-2026-44850 · GHSA-7fw3-x4r2-g7wc
- Medium, CVSS 5.5
Portainer has a path traversal in backup archive extraction that allows arbitrary file write
Go github.com/portainer/portainer · Upgrade to 2.33.8 or later · >= 2.33.0, < 2.33.8 · CVE-2026-44885 · GHSA-m8fg-67j7-cx4v
- Critical, CVSS 9.4
Portainer missing authorization on Docker plugin endpoints, which allows host RCE
Go github.com/portainer/portainer · Upgrade to 2.41.0, 2.39.2 or 2.33.8 by release line · >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0 · CVE-2026-44848 · GHSA-rrmm-9v76-h3p4
- High, CVSS 7.7
FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
npm flowise · Upgrade to 3.1.2 or later · <= 3.1.1 · CVE-2026-46480 · GHSA-wxrr-jp8m-qq7f · amended
- High, CVSS 7.7
FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
npm flowise · Upgrade to 3.1.2 or later · <= 3.1.1 · CVE-2026-46479 · GHSA-mq53-pc65-wjc4 · amended
- High, CVSS 7.7
FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover
npm flowise · Upgrade to 3.1.2 or later · <= 3.1.1 · CVE-2026-46478 · GHSA-7j65-65cr-6644 · amended
- High, CVSS 7.7
FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover
npm flowise · Upgrade to 3.1.2 or later · <= 3.1.1 · CVE-2026-46477 · GHSA-5h9v-837x-m97r · amended
- High, CVSS 7.7
FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
npm flowise · Upgrade to 3.1.2 or later · <= 3.1.1 · CVE-2026-46476 · GHSA-728h-4mwj-f2p4 · amended
- High, CVSS 7.7
FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
npm flowise · Upgrade to 3.1.2 or later · <= 3.1.1 · CVE-2026-46475 · GHSA-78pr-c5x5-jggc · amended
- High, CVSS 8.7
FlowiseAI: Vector Store No Permission Checks
npm flowise · Upgrade to 3.1.2 or later · <= 3.1.1 · CVE-2026-46444 · GHSA-hmg2-jjjx-jcp2 · amended
- Medium, CVSS 6.9
Synapse pagination Denial of Service
PyPI matrix-synapse · Upgrade to 1.152.1 or later · < 1.152.1 · CVE-2026-45076 · GHSA-6qf2-7x63-mm6v · amended
- High, CVSS 7.1
Synapse CPU starvation (Denial of Service)
PyPI matrix-synapse · Upgrade to 1.152.1 or later · < 1.152.1 · CVE-2026-45078 · GHSA-8q93-326v-3m7g · amended
- High, CVSS 8.3
n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
npm n8n · Upgrade to 2.21.1, 2.20.7 or 1.123.43 by release line · < 1.123.43; >= 2.21.0, < 2.21.1; >= 2.0.0-rc.0, < 2.20.7 · CVE-2026-45732 · GHSA-6h4j-wcr9-2vg7 · amended
- High, CVSS 8.9
n8n Has a Source Control Pull SQL Injection
npm n8n · Upgrade to 2.21.1, 2.20.7 or 1.123.43 by release line · < 1.123.43; >= 2.21.0, < 2.21.1; >= 2.0.0-rc.0, < 2.20.7 · CVE-2026-44792 · GHSA-mhrx-qhrj-673w · amended
- Critical, CVSS 9.4
n8n Has an XML Node Prototype Pollution Patch Bypass
npm n8n · Upgrade to 2.22.1, 2.20.7 or 1.123.43 by release line · < 1.123.43; >= 2.21.0, < 2.22.1; >= 2.0.0-rc.0, < 2.20.7 · CVE-2026-44791 · GHSA-wrwr-h859-xh2r · amended
- Critical, CVSS 9.4
n8n Has an Arbitrary File Read via Git Node
npm n8n · Upgrade to 2.22.1, 2.20.7 or 1.123.43 by release line · < 1.123.43; >= 2.21.0, < 2.22.1; >= 2.0.0-rc.0, < 2.20.7 · CVE-2026-44790 · GHSA-57g9-58c2-xjg3 · amended
- Critical, CVSS 9.4
n8n: HTTP Request Node Pagination Prototype Pollution to RCE
npm n8n · Upgrade to 2.22.1, 2.20.7 or 1.123.43 by release line · < 1.123.43; >= 2.21.0, < 2.22.1; >= 2.0.0-rc.0, < 2.20.7 · CVE-2026-44789 · GHSA-c8xv-5998-g76h · amended
- Medium, CVSS 6.2
pyzipper has an encryption bypass for small files encrypted using it
PyPI pyzipper · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2026-44722 · GHSA-crqm-m339-7m2p · amended
- Medium, CVSS 5.1
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints
Go github.com/stefanprodan/podinfo · Upgrade to 1.8.1-0.20260519111337-cbebb20fd485 (pre-release) or later · < 1.8.1-0.20260519111337-cbebb20fd485 · CVE-2026-43644 · GHSA-q23m-vm9r-5745
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.