High, CVSS 7.5
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46366 · GHSA-99qv-g4x9-mgc3
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6901–6925 of 30,985 matching · newest first
- High, CVSS 7.5
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46359 · GHSA-pm8c-3qq3-72w7
- Critical, CVSS 9.1
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-45010 · GHSA-9pq7-mfwh-xx2j
- Low, CVSS 3.5
Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
PyPI magic-wormhole · Upgrade to 0.24.0 or later · >= 0.23.0, <= 0.23.0 · CVE-2026-42448 · GHSA-cf92-gfcw-6v53 · amended
- Medium, CVSS 4.3
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · >= 4.1.1, <= 4.1.1 · CVE-2026-45009 · GHSA-jrc5-w569-h7h5
- Medium, CVSS 6.9
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46361 · GHSA-pqh6-8fxf-jx22
- Medium, CVSS 4.3
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-45007 · GHSA-rm98-82fr-mcfx
- Medium, CVSS 5.4
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46360 · GHSA-whqh-9pq5-c7r3
- Medium, CVSS 5.4
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46363 · GHSA-f5p7-2c9q-8896
- High, CVSS 8.6
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS
Go github.com/harvester/harvester · Upgrade to 1.8.0 or later · < 1.8.0 · CVE-2025-71261 · GHSA-pgh9-mpwc-8jjf
- Medium, CVSS 5.4
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · GHSA-7cx3-2qx2-3g6w
- Medium, CVSS 6.5
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46362 · GHSA-hpgw-ww76-c68r
- High, CVSS 7.6
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · >= 4.1.1, <= 4.1.1 · CVE-2026-46367 · GHSA-9525-27vj-c8r8
- High, CVSS 7.5
Micronaut has unbounded
formattersCacheinTimeConverterRegistrarthat Allows Memory Exhaustion viaAccept-LanguageHeaderMaven io.micronaut:micronaut-context · Upgrade to 4.10.22, 3.10.6 or 3.8.14 by release line · >= 4.3.0, < 4.10.22; >= 3.10.0, < 3.10.6; < 3.8.14 · CVE-2026-44241 · GHSA-8hjv-92q9-g4xj
- Low, CVSS 3.7
Micronaut has Unbounded
bundleCacheinResourceBundleMessageSourcethat Allows Memory Exhaustion viaAccept-LanguageHeaderMaven io.micronaut:micronaut-inject · Upgrade to 4.10.22, 3.10.6 or 3.8.14 by release line · >= 4.10.0, < 4.10.22; >= 3.10.0, < 3.10.6; < 3.8.14 · CVE-2026-44242 · GHSA-3rfq-4wpf-qqw3
- High, CVSS 8.8
Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain
Go github.com/mezo-org/mezod · Upgrade to 8.0.0 or later · <= 7.0.0 · GHSA-6447-269v-g68m
- Critical, CVSS 9.4
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
Packagist dedoc/scramble · Upgrade to 0.13.22 or later · >= 0.13.2, <= 0.13.21 · CVE-2026-44262 · GHSA-4rm2-28vj-fj39
- Medium, CVSS 5.4
wger: trainer_login open redirect - ?next= parameter not validated against host
PyPI wger · Upgrade to 2.6 or later · <= 2.5 · CVE-2026-86256 · GHSA-vqv8-j3mj-wjxj · amended
- Critical, CVSS 9.9
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
PyPI wger · Upgrade to 2.6 or later · <= 2.5 · CVE-2026-43948 · GHSA-mhc8-p3jx-84mm · amended
- High, CVSS 7.4
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
PyPI wger · Upgrade to 2.6 or later · <= 2.5 · CVE-2026-86257 · GHSA-xq9m-hmp9-fw87 · amended
- High, CVSS 7.8
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
PyPI gitpython · Upgrade to 3.1.48 or later · <= 3.1.47 · CVE-2026-44243 · GHSA-7545-fcxq-7j24 · amended
- High, CVSS 7.5
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
npm basic-ftp · Upgrade to 5.3.1 or later · <= 5.3.0 · CVE-2026-44240 · GHSA-rpmf-866q-6p89 · amended
- High, CVSS 8.1
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
PyPI lemur · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-44304 · GHSA-3r34-vq8m-39gh · amended
- Medium, CVSS 6.8
Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled
PyPI lemur · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-44305 · GHSA-vr7c-r5gj-j3w5 · amended
- Medium, CVSS 5.0
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
Packagist kimai/kimai · Upgrade to 2.56.0 or later · <= 2.55.0 · GHSA-vrqv-52x7-rm4v
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.