Medium, CVSS 5.5
uutils coreutils has an Improper Input Validation Issue in its cut Utility
crates.io coreutils · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-35380 · GHSA-m2pg-c7m6-77pj
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7476–7500 of 31,057 matching · newest first
- Low, CVSS 3.3
uutils coreutils has an Incorrect Short Circuit Evaluation Issue
crates.io coreutils · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-35378 · GHSA-5pv5-xh52-hvrp
- Low, CVSS 3.3
uutils coreutils has an Incorrect Provision of Specified Functionality Issue
crates.io coreutils · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-35379 · GHSA-fhr3-xh3q-69w6
- Medium, CVSS 5.0
uutils coreutils has a UNIX Symbolic Link (Symlink) Following issue
crates.io coreutils · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-35372 · GHSA-wq63-vh5h-pr5p
- Medium, CVSS 6.6
Inspektor Gadget: Command Injection via malicious buildOptions manipulation
Go github.com/inspektor-gadget/inspektor-gadget · Upgrade to 0.51.1 or later · < 0.51.1 · CVE-2026-24905 · GHSA-79qw-g77v-2vfh
- High, CVSS 8.2
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
npm i18next-fs-backend · Upgrade to 2.6.4 or later · < 2.6.4 · CVE-2026-41693 · GHSA-8847-338w-5hcj · amended
- Medium, CVSS 4.7
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
npm i18nextify · Upgrade to 4.0.8 or later · < 4.0.8 · CVE-2026-41692 · GHSA-6457-mxpq-4fqq · amended
- Medium, CVSS 6.5
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
npm i18next-http-backend · Upgrade to 3.0.5 or later · < 3.0.5 · CVE-2026-41691 · GHSA-q89c-q3h5-w34g · amended
- High, CVSS 8.6
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
npm i18next-http-middleware · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-41690 · GHSA-5fgg-jcpf-8jjw · amended
- High, CVSS 8.3
Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API
Go github.com/daptin/daptin · Upgrade to 0.11.4 or later · < 0.11.4 · CVE-2026-41422 · GHSA-rw2c-8rfq-gwfv
- Medium, CVSS 6.0
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
npm dompurify · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-41240 · GHSA-h7mw-gpvr-xq4m · amended
- Medium, CVSS 6.8
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
npm dompurify · Upgrade to 3.4.0 or later · >= 1.0.10, < 3.4.0 · CVE-2026-41239 · GHSA-crv5-9vww-q3g8 · amended
- Medium, CVSS 6.9
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
npm dompurify · Upgrade to 3.4.0 or later · >= 3.0.1, < 3.4.0 · CVE-2026-41238 · GHSA-v9jr-rg53-9pgp · amended
- Critical, CVSS 9.4
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.5.0 or later · < 0.31.5.0 · CVE-2026-41203 · GHSA-xv3r-vr59-95rg
- Critical, CVSS 9.4
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.5.0 or later · < 0.31.5.0 · CVE-2026-41202 · GHSA-xp9f-pvvc-57p4
- Medium, CVSS 6.8
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.5.0 or later · < 0.31.5.0 · CVE-2026-41201 · GHSA-qxpq-82f3-xj47
- High, CVSS 7.5
camel-infinispan Vulnerable to Deserialization of Untrusted Data
Maven org.apache.camel:camel-infinispan · Upgrade to 4.20.0 or later · < 4.20.0 · CVE-2026-6857 · GHSA-xfxp-ppx7-cqrp
- High, CVSS 7.8
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Packagist phpunit/phpunit · Upgrade to 13.1.6 or 12.5.22 by release line · >= 12.5.21, < 12.5.22; >= 13.1.5, < 13.1.6 · GHSA-mh6w-vxff-9wqp
- High, CVSS 8.6
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
npm engramx · Upgrade to 2.0.2 or later · < 2.0.2 · GHSA-2r2p-4cgf-hv7h · amended
- Critical, CVSS 9.2
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Go github.com/rclone/rclone · Upgrade to 1.73.5 or later · >= 1.45.0, < 1.73.5 · CVE-2026-41176 · GHSA-25qr-6mpr-f7qx
- High, CVSS 7.0
OpenRemote has Improper Access Control via updateUserRealmRoles function
Maven io.openremote:openremote-manager · Upgrade to 1.22.1 or later · < 1.22.1 · CVE-2026-41166 · GHSA-49vv-25qx-mg44
- Medium, CVSS 6.3
actix-http has HTTP/1.1 CL.TE Request Smuggling
crates.io actix-http · Upgrade to 3.12.1 or later · < 3.12.1 · GHSA-xhj4-vrgc-hr34
- Low, CVSS 0.6
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
PyPI poetry · Upgrade to 2.3.4 or later · < 2.3.4 · CVE-2026-41140 · GHSA-73h3-mf4w-8647 · amended
- High, CVSS 8.7
@saltcorn/data: Tenant user role is used for tenant creation role check
npm @saltcorn/data · Upgrade to 1.6.0-beta.2 (pre-release), 1.5.2 or 1.4.4 by release line · < 1.4.4; >= 1.5.0-beta.0, < 1.5.2; >= 1.6.0-alpha.0, < 1.6.0-beta.2 · GHSA-9237-rg5p-rhfw · amended
- Critical, CVSS 10.0
openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access
Go github.com/jkroepke/openvpn-auth-oauth2 · Upgrade to 1.27.3 or later · >= 1.26.3, < 1.27.3 · CVE-2026-41070 · GHSA-246w-jgmq-88fg
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.