Low, CVSS 2.0
Kimai leaks API Token Hash via Invoice Twig Template
Packagist kimai/kimai · Upgrade to 2.53.0 or later · <= 2.52.0 · GHSA-rh42-6rj2-xwmc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7826–7850 of 31,057 matching · newest first
- Unrated
Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler
Packagist kimai/kimai · Upgrade to 2.53.0 or later · <= 2.52.0 · GHSA-3jp4-mhh4-gcgr
- Medium, CVSS 6.9
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
Packagist webonyx/graphql-php · Upgrade to 15.31.5 or later · <= 15.31.4 · CVE-2026-40476 · GHSA-68jq-c3rv-pcrr
- Unrated
Rand is unsound with a custom logger using rand::rng()
crates.io rand · Upgrade to 0.10.1, 0.9.3 or 0.8.6 by release line · >= 0.10.0, <= 0.10.0; >= 0.9.0, < 0.9.3; >= 0.7.0, < 0.8.6 · GHSA-cq8v-f236-94qc
- Medium, CVSS 5.5
Sigstore Timestamp Authority has Improper Certificate Validation in verifier
Go github.com/sigstore/timestamp-authority/v2 · Upgrade to 2.0.6 or later · <= 2.0.5 · CVE-2026-39984 · GHSA-xm5m-wgh2-rrg3
- Low, CVSS 1.7
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
Packagist craftcms/commerce · Upgrade to 5.6.0 or 4.11.0 by release line · >= 5.0.0, <= 5.5.4; >= 4.0.0, <= 4.10.2 · CVE-2026-32270 · GHSA-3vxg-x5f8-f5qf
- High, CVSS 7.5
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
npm @nestjs/microservices · Upgrade to 11.1.19 or later · <= 11.1.18 · CVE-2026-40879 · GHSA-hpwf-8g29-85qm · amended
- High, CVSS 7.5
ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · CVE-2026-33901 · GHSA-x9h5-r9v2-vcww
- High, CVSS 8.7
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
Packagist craftcms/commerce · Upgrade to 5.5.5 or 4.10.3 by release line · >= 4.0.0, <= 4.10.2; >= 5.0.0, <= 5.5.4 · CVE-2026-32271 · GHSA-875v-7m49-8x88
- High, CVSS 8.7
Craft Commerce hasVariant/hasProduct Blind SQL Injection
Packagist craftcms/commerce · Upgrade to 5.6.0 or later · >= 5.0.0, < 5.6.0 · CVE-2026-32272 · GHSA-r54v-qq87-px5r
- High, CVSS 7.5
ImageMagick has a Stack Overflow in DestroyXMLTree()
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · CVE-2026-33908 · GHSA-fwvm-ggf6-2p4x
- High, CVSS 7.4
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Maven org.eclipse.jetty.ee9:jetty-ee9-jaspi · Upgrade to 12.1.8 or 12.0.34 by release line · >= 12.1.0, <= 12.1.7; >= 12.0.0, <= 12.0.33 · +4 more packages · CVE-2026-5795 · GHSA-r7p8-xq5m-436c
- High, CVSS 8.9
SP1 V6 Recursion Circuit Row-Count Binding Gap
crates.io sp1_prover +2 · Upgrade all 3 to 6.1.0 or later · >= 6.0.0, <= 6.0.2 · CVE-2026-40323 · GHSA-63x8-x938-vx33
- High, CVSS 8.7
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
npm @aiondadotcom/mcp-ssh · Upgrade to 1.3.5 or later · < 1.3.5 · GHSA-p4h8-56qp-hpgv · amended
- High, CVSS 8.2
In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation
Go github.com/monetr/monetr · Upgrade to 1.12.4 or later · <= 1.12.3 · CVE-2026-40481 · GHSA-v7xq-3wx6-fqc2
- Critical, CVSS 9.4
excel-mcp-server has a Path Traversal issue
PyPI excel-mcp-server · Upgrade to 0.1.8 or later · < 0.1.8 · CVE-2026-40576 · GHSA-j98m-w3xp-9f56 · amended
- Low, CVSS 2.0
DbGate has cross site scripting via the SVG Icon String Handler component
npm dbgate-web · Upgrade to 7.1.5 or later · < 7.1.5 · CVE-2026-6216 · GHSA-j8j5-7r4h-vj2g · amended
- Medium, CVSS 5.3
ImageMagick has a heap-Buffer-Overflow write of a single zero byte when parsing xml.
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · CVE-2026-33899 · GHSA-cr67-pvmx-2pp2
- Medium, CVSS 5.9
Note Mark has Broken Access Control on Asset Download
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260411145023-6593898855ad (pre-release) or later · < 0.0.0-20260411145023-6593898855ad · CVE-2026-40265 · GHSA-p5w6-75f9-cc2p
- Low, CVSS 3.7
Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
Go github.com/enchant97/note-mark/backend · Upgrade to 0.19.2-0.20260411145025-cf4c6f6acf70 (pre-release) or later · < 0.19.2-0.20260411145025-cf4c6f6acf70 · CVE-2026-40263 · GHSA-w6m9-39cv-2fwp
- High, CVSS 8.7
Note Mark has Stored XSS via Unrestricted Asset Upload
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260411145018-6bb62842ccb9 (pre-release) or later · < 0.0.0-20260411145018-6bb62842ccb9 · CVE-2026-40262 · GHSA-9pr4-rf97-79qh
- High, CVSS 8.2
Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username
Go github.com/foxcpp/maddy · Upgrade to 0.9.3 or later · < 0.9.3 · CVE-2026-40193 · GHSA-5835-4gvc-32pc
- High, CVSS 8.7
FITS GZIP decompression bomb in Pillow
PyPI pillow · Upgrade to 12.2.0 or later · >= 10.3.0, < 12.2.0 · CVE-2026-40192 · GHSA-whj4-6x5x-4v2j · amended
- Medium, CVSS 5.1
ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds
NuGet magick.net-q8-x86 +5 · Upgrade all 6 to 14.12.0 or later · < 14.12.0 · CVE-2026-34238 · GHSA-26qp-ffjh-2x4v
- Medium, CVSS 5.9
ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds
NuGet magick.net-q8-x86 +5 · Upgrade all 6 to 14.12.0 or later · < 14.12.0 · CVE-2026-33900 · GHSA-v67w-737x-v2c9
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.