Medium, CVSS 6.8
Velocidex Velociraptor has an Incorrect Authorization issue
Go www.velocidex.com/golang/velociraptor · Upgrade to 0.76.4 or later · < 0.76.4 · CVE-2026-6863 · GHSA-2v93-vp82-cjv8
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6926–6950 of 30,985 matching · newest first
- Medium, CVSS 5.7
Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation
Packagist kimai/kimai · Upgrade to 2.56.0 or later · <= 2.55.0 · GHSA-9g2q-w3w2-vf7q
- Medium, CVSS 5.3
Nokogiri XSLT transform has a memory leak
RubyGems nokogiri · Upgrade to 1.19.3 or later · < 1.19.3 · CVE-2026-79771 · GHSA-v2fc-qm4h-8hqv
- High, CVSS 7.5
Nokogiri CSS selector tokenizer has regular expression backtracking
RubyGems nokogiri · Upgrade to 1.19.3 or later · < 1.19.3 · CVE-2026-79770 · GHSA-c4rq-3m3g-8wgx
- High, CVSS 8.7
dssrf: every IPv6 category bypasses is_url_safe
npm dssrf · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2026-44232 · GHSA-8p33-q827-ghj5 · amended
- High, CVSS 8.7
phpseclib: guardrails needed on isPrime and randomPrime
Packagist phpseclib/phpseclib · Upgrade to 3.0.36, 2.0.47 or 1.0.23 by release line · >= 0.1.1, < 1.0.23; >= 2.0.0, < 2.0.47; >= 3.0.0, < 3.0.36 · CVE-2024-27354 · GHSA-2528-jw5q-ww88
- High, CVSS 7.1
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Packagist craftcms/cms · Upgrade to 5.9.18 or later · >= 5.0.0-RC1, < 5.9.18 · CVE-2026-44012 · GHSA-33m5-hqp9-97pw
- Medium, CVSS 5.3
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
PyPI pyload-ng · Upgrade to 0.5.0b3.dev100 (pre-release) or later · < 0.5.0b3.dev100 · CVE-2026-44226 · GHSA-c3gc-9pf2-84gg · amended
- High, CVSS 8.6
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
Packagist craftcms/cms · Upgrade to 5.9.18 or 4.17.12 by release line · >= 4.0.0, < 4.17.12; >= 5.0.0, < 5.9.18 · CVE-2026-44011 · GHSA-qrgm-p9w5-rrfw
- High, CVSS 7.1
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
Packagist craftcms/cms · Upgrade to 5.9.18 or 4.17.12 by release line · >= 5.0.0, < 5.9.18; >= 4.0.0, < 4.17.12 · CVE-2026-44010 · GHSA-gj2p-p9m4-c8gw
- Medium, CVSS 4.2
next-intl has prototype pollution with
experimental.messages.precompilevia attacker-controlled translation catalog keysnpm next-intl · Upgrade to 4.9.2 or later · <= 4.9.1 · GHSA-4c35-wcg5-mm9h · amended
- Low, CVSS 3.7
mcp-data-vis vulnerable to denial of service via unsanitized
selectkey lookup onObject.prototypewithprecompile: truenpm icu-minify · Upgrade to 4.9.2 or later · <= 4.9.1 · GHSA-r27j-894h-3w3p · amended
- Low, CVSS 2.7
astral-tokio-tar:
unpack_incan chmod arbitrary directories by following symlinkscrates.io astral-tokio-tar · Upgrade to 0.6.1 or later · <= 0.6.0 · GHSA-xx64-wwv2-hcqq
- Medium, CVSS 6.6
astral-tokio-tar is Vulnerable to PAX Header Desynchronization
crates.io astral-tokio-tar · Upgrade to 0.6.1 or later · <= 0.6.0 · GHSA-fp55-jw48-c537
- High, CVSS 7.7
DevSpace UI Server WebSocket CheckOrigin does not validate source
Go github.com/loft-sh/devspace · Upgrade to 6.3.21 or later · >= 6.3.20, <= 6.3.20 · CVE-2026-42283 · GHSA-hqwm-7x7x-8379
- High, CVSS 7.1
Auth.js SDK has Improper Permission Checking
npm auth0-js · Upgrade to 10.0.0 or later · >= 8.11.0, <= 9.32.0 · CVE-2026-42280 · GHSA-8qjv-jj2q-x832 · amended
- Critical, CVSS 9.0
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
Go github.com/0xJacky/nginx-ui · Upgrade to 2.3.8 or later · < 2.3.8 · CVE-2026-42238 · GHSA-4pvg-prr3-9cxr
- Medium, CVSS 6.5
Nginx-UI Settings API Exposes Protected Secrets
Go github.com/0xJacky/nginx-ui · Upgrade to 2.3.8 or later · <= 2.3.7 · CVE-2026-42223 · GHSA-q4w7-56hr-83rm
- High, CVSS 8.1
Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
Go github.com/0xJacky/Nginx-UI · Upgrade to 2.3.8 or later · >= 2.0.0, <= 2.3.5 · CVE-2026-42221 · GHSA-h27v-ph7w-m9fp
- Medium, CVSS 6.1
Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands
crates.io tauri · Upgrade to 2.11.1 or later · >= 2.0.0, <= 2.11.0 · CVE-2026-42184 · GHSA-7gmj-67g7-phm9
- High, CVSS 8.7
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
PyPI mistune · Upgrade to 3.2.1 or later · >= 3.0.0a1, <= 3.2.0 · CVE-2026-33079 · GHSA-8mp2-v27r-99xp · amended
- Critical, CVSS 9.0
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
PyPI rucio · Upgrade to 40.1.1, 39.4.2, 38.5.5 or 35.8.5 by release line · >= 1.30.0, < 35.8.5; >= 36.0.0, < 38.5.5; >= 39.0.0, < 39.4.2; >= 40.0.0, < 40.1.1 · CVE-2026-29090 · GHSA-6j7p-qjhg-9947 · amended
- Critical, CVSS 9.4
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
PyPI rucio · Upgrade to 40.1.1, 39.4.2, 38.5.5 or 35.8.5 by release line · >= 1.27.0, < 35.8.5; >= 36.0.0, < 38.5.5; >= 39.0.0, < 39.4.2; >= 40.0.0, < 40.1.1 · CVE-2026-29080 · GHSA-vjr5-c9qv-hgm3 · amended
- High, CVSS 7.5
Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Maven org.apache.wicket:wicket-parent · Upgrade to 10.9.0; some affected versions have no fix yet · >= 8.0.0-M1, <= 8.17.0; >= 9.0.0-M1, <= 9.22.0; >= 10.0.0-M1, <= 10.8.0 · CVE-2026-43646 · GHSA-jvv4-8wxx-m5r6
- Medium, CVSS 6.5
Apache Wicket has a Path Traversal issue
Maven org.apache.wicket:wicket-core · Upgrade to 10.9.0; some affected versions have no fix yet · >= 8.0.0-M1, <= 8.17.0; >= 9.0.0-M1, <= 9.22.0; >= 10.0.0-M1, <= 10.8.0 · CVE-2026-43975 · GHSA-3gmf-p6r4-q8m6
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.