October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
Packagist october/system · Upgrade to 4.1.16 or 3.7.16 by release line · >= 4.0.0, < 4.1.16; < 3.7.16 · CVE-2026-29179 · GHSA-jvwg-phxx-j3rp
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
7526–7550 of 31,057 matching · newest first
Packagist october/system · Upgrade to 4.1.16 or 3.7.16 by release line · >= 4.0.0, < 4.1.16; < 3.7.16 · CVE-2026-29179 · GHSA-jvwg-phxx-j3rp
Packagist october/october · Upgrade to 4.1.10 or 3.7.14 by release line · < 3.7.14; >= 4.0.0, < 4.1.10 · CVE-2026-26274 · GHSA-h6jm-f4hh-fw27
Packagist october/system · Upgrade to 4.1.10 or 3.7.14 by release line · < 3.7.14; >= 4.0.0, < 4.1.10 · CVE-2026-26067 · GHSA-3888-q23f-x7qh
Go github.com/tektoncd/pipeline · Upgrade to 1.11.1, 1.9.3, 1.6.2 or 2 more by release line · >= 0.43.0, < 1.0.2; >= 1.2.0, < 1.3.4; >= 1.4.0, < 1.6.2; >= 1.7.0, < 1.9.3; >= 1.10.0, < 1.11.1 · CVE-2026-25542 · GHSA-rmx9-2pp3-xhcr
npm @auth0/nextjs-auth0 · Upgrade to 4.18.0 or later · >= 4.12.0, <= 4.17.0 · CVE-2026-40155 · GHSA-xq8m-7c5p-c2r6 · amended
Packagist openmage/magento-lts · Upgrade to 20.17.0 or later · < 20.17.0 · CVE-2026-40098 · GHSA-665x-ppc4-685w
PyPI glances · Upgrade to 4.5.4 or later · < 4.5.4 · CVE-2026-35588 · GHSA-grp3-h8m8-45p7 · amended
PyPI glances · Upgrade to 4.5.4 or later · < 4.5.4 · CVE-2026-35587 · GHSA-g5pq-48mj-jvw8 · amended
npm @gitlawb/openclaude · Upgrade to 0.5.1 or later · < 0.5.1 · CVE-2026-35570 · GHSA-m6rx-7pvw-2f73 · amended
PyPI glances · Upgrade to 4.5.4 or later · < 4.5.4 · CVE-2026-34839 · GHSA-gfc2-9qmw-w7vh · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260316053337-1a9cd29a3082 (pre-release) or later · < 1.9.10-0.20260316053337-1a9cd29a3082 · CVE-2026-34403 · GHSA-78mf-482w-62qj
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260314152518-7b66578adb47 (pre-release) or later · < 1.9.10-0.20260314152518-7b66578adb47 · CVE-2026-33031 · GHSA-x234-x5vq-cc2v
Maven io.spinnaker.echo:echo-pipelinetriggers · Upgrade to 2026.0.1, 2025.4.2 or 2025.3.2 by release line · >= 2026.0-0, < 2026.0.1; >= 2025.4-0, < 2025.4.2; < 2025.3.2 · CVE-2026-32613 · GHSA-69rw-45wj-g4v6
Maven io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo · Upgrade to 2026.0.1 or later · < 2026.0.1 · CVE-2026-32604 · GHSA-x3j7-7pgj-h87r
PyPI python-dotenv · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-28684 · GHSA-mf9w-mj56-hr94 · amended
Packagist openmage/magento-lts · Upgrade to 20.17.0 or later · < 20.17.0 · CVE-2026-25525 · GHSA-6vqf-6fhm-7rc6
Packagist openmage/magento-lts · Upgrade to 20.17.0 or later · < 20.17.0 · CVE-2026-25524 · GHSA-fg79-cr9c-7369
PyPI pip · Upgrade to 26.1 or later · <= 26.0.1 · CVE-2026-3219 · GHSA-58qw-9mgm-455v · amended
Maven org.apache.kafka:kafka-clients · Upgrade to 4.1.2 or later · >= 4.1.0, < 4.1.2 · CVE-2026-33557 · GHSA-28jg-cgg7-j4wc
PyPI doris-mcp-server · Upgrade to 0.6.1 or later · >= 0.1.0, < 0.6.1 · CVE-2025-66335 · GHSA-qhfq-gvvc-5q6q · amended
Maven org.apache.kafka:kafka-clients · Upgrade to 4.0.1 or 3.9.2 by release line · >= 0.11.0, < 3.9.2; >= 4.0.0, <= 4.0.0 · CVE-2026-33558 · GHSA-wf66-mphr-4c4r
Packagist cockpit-hq/cockpit · Upgrade to 2.14.0 or later · < 2.14.0 · CVE-2026-6626 · GHSA-5pv2-86qj-5jf9
PyPI langflow · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2026-6598 · GHSA-9jpj-cph8-w449 · amended
PyPI langflow-base · Upgrade to 0.9.1 or later · < 0.9.1 · CVE-2026-6596 · GHSA-vvfc-fp59-m92g · amended
PyPI apache-airflow-providers-keycloak · Upgrade to 0.7.0 or later · >= 0.0.1, < 0.7.0 · CVE-2026-40948 · GHSA-5w6h-pjw6-wvc6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.