Medium, CVSS 6.5
view_component: Preview Route Can Dispatch Inherited Helper Methods
RubyGems view_component · Upgrade to 4.9.0 or later · >= 3.0.0, < 4.9.0 · CVE-2026-44836 · GHSA-7f3r-gwc9-2995
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6651–6675 of 30,985 matching · newest first
- Medium, CVSS 5.9
Snipe-IT has an open redirect vulnerability
Packagist snipe/snipe-it · Upgrade to 8.4.1 or later · < 8.4.1 · CVE-2026-44833 · GHSA-mghp-5cq4-v6mg
- High, CVSS 7.0
GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
PyPI gitpython · Upgrade to 3.1.50 or later · <= 3.1.49 · CVE-2026-67326 · GHSA-mv93-w799-cj2w · amended
- Medium, CVSS 6.3
eml_parser has recursion DoS via nested message/rfc822 attachments
PyPI eml-parser · Upgrade to 3.0.1 or later · <= 3.0.0 · CVE-2026-44844 · GHSA-g47v-rwmh-r9f8 · amended
- High, CVSS 8.2
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad
load()allowlistsPyPI langchain-core · Upgrade to 1.3.3 or 0.3.85 by release line · >= 1.0.0, <= 1.3.2; <= 0.3.84 · CVE-2026-44843 · GHSA-pjwx-r37v-7724 · amended
- High, CVSS 7.5
Phpseclib needs guardrails on large binaryfield integers
Packagist phpseclib/phpseclib · Upgrade to 3.0.34 or later · >= 3.0.0, < 3.0.34 · CVE-2023-49316 · GHSA-2f25-pfq3-c7h8
- Critical, CVSS 9.8
Snipe-IT has insecure permissions in file uploads
Packagist snipe/snipe-it · Upgrade to 8.4.1 or later · < 8.4.1 · CVE-2026-37709 · GHSA-xg82-2hrv-hf64
- Critical, CVSS 10.0
free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
Go github.com/free5gc/smf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-44329 · GHSA-3258-qmv8-frp3
- High, CVSS 8.2
free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating
Go github.com/free5gc/smf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-44328 · GHSA-p9mg-74mg-cwwr
- High, CVSS 7.5
free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types
Go github.com/free5gc/nrf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-44325 · GHSA-f8qv-7x5w-qr48
- Medium, CVSS 6.5
free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)
Go github.com/free5gc/udr · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-44324 · GHSA-jqfc-gwj5-3w63
- Medium, CVSS 4.3
free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)
Go github.com/free5gc/udr · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-44323 · GHSA-4rqf-grm6-vf75
- High, CVSS 7.5
free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference
Go github.com/free5gc/nef · Upgrade to 1.2.3 or later · < 1.2.3 · CVE-2026-44322 · GHSA-j59f-x285-69jx
- High, CVSS 7.5
free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)
Go github.com/free5gc/nef · Upgrade to 1.2.3 or later · < 1.2.3 · CVE-2026-44319 · GHSA-rxrq-fv76-26pr
- Medium, CVSS 6.5
free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions
Go github.com/free5gc/bsf · Upgrade to 1.0.2 or later · < 1.0.2 · CVE-2026-44318 · GHSA-27ph-8q4f-h7m7
- Medium, CVSS 6.5
free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference
Go github.com/free5gc/pcf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-44317 · GHSA-wwqh-7jm5-gj7w
- High, CVSS 7.5
free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference
Go github.com/free5gc/pcf · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-44316 · GHSA-wr8j-6chw-gm6p
- Medium, CVSS 5.3
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
Go github.com/sigstore/gitsign · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-44309 · GHSA-7rmh-48mx-2vwc
- High, CVSS 7.3
Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
PyPI open-webui · Upgrade to 0.1.124 or later · <= 0.1.123 · CVE-2026-44566 · GHSA-9pgh-j74g-qj6m · amended
- High, CVSS 7.3
Open WebUI has Improper Authorization Control
PyPI open-webui · Upgrade to 0.1.124 or later · <= 0.1.123 · CVE-2026-44567 · GHSA-4vg5-rp28-gvjf · amended
- High, CVSS 7.3
Open WebUI has stored XSS in Excel file preview
PyPI open-webui · Upgrade to 0.8.0 or later · <= 0.7.2 · CVE-2026-44549 · GHSA-jwf8-pv5p-vhmc · amended
- High, CVSS 8.7
Snipe-IT has Privilege Escalation via API Permissions Assignment
Packagist snipe/snipe-it · Upgrade to 8.4.1 or later · < 8.4.1 · CVE-2026-44832 · GHSA-hq28-crg7-95pr
- Medium, CVSS 4.1
in-toto-golang and in-toto-python have inconsistent negation behavior
Go github.com/in-toto/in-toto-golang · Upgrade to 0.11.0 or later · < 0.11.0 · GHSA-pmwq-pjrm-6p5r
- Medium, CVSS 4.8
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)
Packagist snipe/snipe-it · Upgrade to 8.4.1 or later · < 8.4.1 · CVE-2026-44831 · GHSA-r42m-953q-6vjx
- Medium, CVSS 4.1
Kimai has an arbitrary file read in its invoice PDF renderer (admin)
Packagist kimai/kimai · Upgrade to 2.56 or later · >= 2.32.0, <= 2.55 · CVE-2026-44298 · GHSA-h5fh-7hwr-97mw
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.