High, CVSS 7.2
pgAdmin 4 File Manager has symbolic-link path traversal
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7819 · GHSA-hr4r-fwpv-c95j · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6576–6600 of 30,985 matching · newest first
- High, CVSS 8.7
pgAdmin 4: OS command injection vulnerability in Import/Export query export
PyPI pgadmin4 · Upgrade to 9.15 or later · < 9.15 · CVE-2026-7816 · GHSA-j74f-g7vx-fh4x · amended
- Medium, CVSS 5.3
MantisBT Has Authorization Bypass in Global Profile Creation
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · >= 2.28.0, < 2.28.2 · CVE-2026-33052 · GHSA-68w5-w573-q2r8
- Critical, CVSS 9.1
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
Maven io.unitycatalog:unitycatalog-server · Upgrade to 0.4.1 or later · <= 0.4.0 · CVE-2026-27478 · GHSA-qqcj-rghw-829x
- Critical, CVSS 9.8
WebdriverIO BrowserStack Service has a Command Injection issue
npm @wdio/browserstack-service · Upgrade to 9.24.0 or later · <= 9.23.2 · CVE-2026-25244 · GHSA-5c46-x3qw-q7j7 · amended
- Unrated
torrentpier has PHP Serialize Injections
Packagist torrentpier/torrentpier · Upgrade to 2.4.4 or later · <= 2.4.3 · GHSA-h29g-c9cx-c73q
- High, CVSS 7.5
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
npm next · Upgrade to 16.2.6 or 15.5.18 by release line · >= 15.2.0, < 15.5.18; >= 16.0.0, < 16.2.6 · CVE-2026-45109 · GHSA-26hh-7cqf-hhc6 · amended
- Critical, CVSS 9.3
Angular Expressions - Remote Code Execution using filters
npm angular-expressions · Upgrade to 1.5.2 or later · <= 1.5.1 · CVE-2026-44643 · GHSA-pw8r-6689-xvf4 · amended
- High, CVSS 7.7
Budibase vulnerable to SSRF via trivial
.tar.gzsubstring bypass in Plugin URL upload (/api/plugin)npm budibase · Upgrade to 3.35.10 or later · < 3.35.10 · CVE-2026-45061 · GHSA-xh5j-727m-w6gg · amended
- High, CVSS 7.5
Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding
Go github.com/xddxdd/bird-lg-go · Upgrade to 0.0.0-20260507060110-0ff87024cb9e (pre-release) or later · < 0.0.0-20260507060110-0ff87024cb9e · CVE-2026-45047 · GHSA-39qr-rc93-vhqm
- High, CVSS 7.5
LiteLLM has a sandbox escape in custom-code guardrail
PyPI litellm · Upgrade to 1.83.10 or later · >= 1.81.8, < 1.83.10 · CVE-2026-40217 · GHSA-wxxx-gvqv-xp7p · amended
- High, CVSS 8.5
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
npm @github/copilot · Upgrade to 1.0.43 or later · <= 1.0.42 · CVE-2026-45033 · GHSA-9ccr-r5hg-74gf · amended
- High, CVSS 8.7
Local Path Provisioner Vulnerable to HelperPod Template Injection
Go github.com/rancher/local-path-provisioner · Upgrade to 0.0.36 or later · < 0.0.36 · CVE-2026-44543 · GHSA-7fxv-8wr2-mfc4
- Low, CVSS 3.7
Next.js's Middleware / Proxy redirects can be cache-poisoned
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 12.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44572 · GHSA-3g8h-86w9-wvmq · amended
- High, CVSS 8.8
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
Packagist studio-42/elfinder · Upgrade to 2.1.68 or later · <= 2.1.67 · CVE-2026-44521 · GHSA-c3gj-q88f-7hqj
- High, CVSS 7.6
Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Maven com.ritense.valtimo:web · Upgrade to 13.26.0 or 12.33.0 by release line · >= 12.4.0, < 12.33.0; >= 13.0.0, < 13.26.0 · CVE-2026-44516 · GHSA-3jh5-rr2q-xfv7
- High, CVSS 7.5
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function
npm @theecryptochad/merge-guard · Upgrade to 1.0.1 or later · < 1.0.1 · GHSA-mhwj-73qx-jqxm · amended
- High, CVSS 8.2
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)
npm @rvf/set-get · Upgrade to 7.0.2 or 6.0.4 by release line · >= 7.0.0, < 7.0.2; >= 6.0.0, < 6.0.4 · CVE-2026-44483 · GHSA-c567-44rc-m5hq · amended
- Critical, CVSS 9.4
CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE
Go github.com/cloudnative-pg/cloudnative-pg · Upgrade to 1.29.1 or 1.28.3 by release line · < 1.28.3; >= 1.29.0, < 1.29.1 · CVE-2026-44477 · GHSA-423p-g724-fr39
- Medium, CVSS 4.7
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 13.4.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44581 · GHSA-ffhc-5mcf-pf4q · amended
- Low, CVSS 3.7
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44582 · GHSA-vfv6-92ff-j949 · amended
- Medium, CVSS 6.1
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44580 · GHSA-gx5p-jg67-6x7h · amended
- High, CVSS 7.5
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 15.0.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44579 · GHSA-mg66-mrh9-m8jx · amended
- Medium, CVSS 5.9
Next.js has a Denial of Service in the Image Optimization API
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44577 · GHSA-h64f-5h5j-jqjh · amended
- High, CVSS 8.6
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 13.4.13, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44578 · GHSA-c4j6-fc7j-m34r · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.