High, CVSS 8.0
OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
PyPI ironic-python-agent · Upgrade to 11.6.0 or later · >= 1.0.0, <= 11.5.0 · CVE-2026-43003 · GHSA-rmxr-45gj-889w · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7226–7250 of 31,057 matching · newest first
- Medium, CVSS 5.4
@diplodoc/search-extension allows stored XSS via Markdown file title
npm @diplodoc/search-extension · Upgrade to 3.0.5 or later · >= 1.0.0, < 3.0.5 · CVE-2026-40201 · GHSA-rjmp-rwj4-mv82 · amended
- High, CVSS 7.5
Apache Neethi does not properly detect circular references in policy definitions.
Maven org.apache.neethi:neethi · Upgrade to 3.2.2 or later · < 3.2.2 · CVE-2026-42403 · GHSA-2hfh-9h53-qc24
- High, CVSS 7.1
Kirby CMS's
pages.access/listandfiles.access/listpermissions are not consistently checked in the Panel and REST APIPackagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · <= 4.8.0; >= 5.0.0, <= 5.3.3 · CVE-2026-42137 · GHSA-85x2-r8xv-ww8c
- Low, CVSS 2.7
ps_checkout allows unauthorized method invocation through unvalidated parameter
Packagist prestashop/ps_checkout · Upgrade to 5.3.0 or later · < 5.3.0 · GHSA-mqq7-wxx5-mp8h
- High, CVSS 8.1
Contras Affected by CopyFile Policy Subversion via Symlinks
Go github.com/edgelesssys/contrast · Upgrade to 1.19.1 or later · < 1.19.1 · GHSA-rh99-wc69-c255
- High, CVSS 8.7
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl.
.envsecrets)Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-42461 · GHSA-cxx3-hr75-4q96
- Critical, CVSS 9.1
auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation
Go github.com/go-pkgz/auth · Upgrade to 1.25.2 or later · >= 1.18.0, <= 1.25.1 · +1 more package · CVE-2026-42560 · GHSA-f6qq-3m3h-4g42
- Critical, CVSS 9.1
Sentry's improper authentication on SAML SSO process allows user identity linking
PyPI sentry · Upgrade to 26.4.1 or later · >= 21.12.0, <= 26.4.0 · CVE-2026-42354 · GHSA-rcmw-7mc7-3rj7 · amended
- Medium, CVSS 6.5
OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter
NuGet opentelemetry.exporter.opentelemetryprotocol · Upgrade to 1.15.3 or later · >= 1.8.0, <= 1.15.2 · CVE-2026-42191 · GHSA-4625-4j76-fww9
- High, CVSS 8.1
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
Packagist krayin/laravel-crm · Upgrade to 2.1.6 or later · >= 2.1.5, <= 2.1.5 · CVE-2026-36340 · GHSA-32px-ccfx-cxq3
- Low, CVSS 2.7
ydb-go-sdk's transactions are not committed using the
options.WithCommit()option on last calltable.Transaction.Executein transactionGo github.com/ydb-platform/ydb-go-sdk/v3 · Upgrade to 3.134.2 or later · >= 3.104.6, <= 3.134.1 · GHSA-28xx-pppm-vqff
- High, CVSS 7.6
Clerk has an authorization bypass when combining organization, billing, or reverification checks
npm @clerk/expo · Upgrade to 3.2.2 or later · >= 3.0.0, <= 3.2.1 · +16 more packages · CVE-2026-42349 · GHSA-w24r-5266-9c3c · amended
- High, CVSS 8.5
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
npm n8n-mcp · Upgrade to 2.47.14 or later · >= 2.47.4, < 2.47.14 · CVE-2026-42449 · GHSA-56c3-vfp2-5qqj · amended
- Medium, CVSS 6.7
CKAN has Unauthenticated Authorization Bypass in
datastore_search_sqlPyPI ckan · Upgrade to 2.11.5 or 2.10.10 by release line · < 2.10.10; >= 2.11.0, <= 2.11.4 · CVE-2026-42032 · GHSA-cg4x-64p3-x59h · amended
- Medium, CVSS 5.3
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
PyPI weblate · Upgrade to 5.17.1 or later · < 5.17.1 · CVE-2026-41654 · GHSA-cwcx-382v-8m9g · amended
- Medium, CVSS 4.2
Weblate Doesn't Invalidate API Token on Password Change
PyPI weblate · Upgrade to 5.17.1 or later · < 5.17.1 · CVE-2026-41519 · GHSA-6j8j-4qp3-36p2 · amended
- Critical, CVSS 10.0
Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.31.0 or later · <= 8.30.1 · CVE-2026-40281 · GHSA-q7r4-hc83-hf2q
- High, CVSS 8.4
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
PyPI notebook · Upgrade to 7.5.6 or later · >= 7.0.0, <= 7.5.5 · +3 more packages · CVE-2026-40171 · GHSA-rch3-82jr-f9w9 · amended
- Medium, CVSS 6.9
Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.31.0 or later · >= 8.29.1, < 8.31.0 · CVE-2026-39383 · GHSA-5vh4-rgv7-p9g4
- High, CVSS 7.8
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.31.0 or later · <= 8.30.1 · CVE-2026-40280 · GHSA-5q7p-7jgv-ww56
- Medium, CVSS 5.9
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
PyPI apache-airflow-providers-smtp · Upgrade to 3.0.0 or later · >= 2.0.0, < 3.0.0 · CVE-2026-41016 · GHSA-x8mh-94wc-33gv · amended
- Medium, CVSS 5.5
mcp-server-semgrep has a Command Injection issue
npm mcp-server-semgrep · Upgrade to 1.0.1 or later · <= 1.0.0 · CVE-2026-7446 · GHSA-86hp-qxqp-w9wv · amended
- High, CVSS 8.3
CKAN has Unauthenticated SQL Injection and Authorization Bypass in
datastore_search_sqlPyPI ckan · Upgrade to 2.11.5 or 2.10.10 by release line · < 2.10.10; >= 2.11.0, <= 2.11.4 · CVE-2026-42031 · GHSA-h7j7-3rx6-xvcg · amended
- Medium, CVSS 4.8
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
npm @anthropic-ai/sdk · Upgrade to 0.91.1 or later · >= 0.79.0, < 0.91.1 · CVE-2026-41686 · GHSA-p7fg-763f-g4gf · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.