High, CVSS 7.2
baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30940 · GHSA-c5c6-37vq-pjcq
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8526–8550 of 31,057 matching · newest first
- Critical, CVSS 9.2
baserCMS has OS command injection vulnerability in installer
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30880 · GHSA-6hpg-8rx3-cwgv
- Medium, CVSS 6.9
baserCMS has a cross-site scripting vulnerability in blog posts
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30879 · GHSA-jmq3-x8q7-j9qm
- Medium, CVSS 5.3
baserCMS has Mail Form Acceptance Bypass via Public API
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30878 · GHSA-8cr7-r8qw-gp3c
- Critical, CVSS 9.1
baserCMS Update Functionality Vulnerable to OS Command Injection
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30877 · GHSA-m9g7-rgfc-jcm7
- Medium, CVSS 6.9
baserCMS has an SQL injection vulnerability in its blog post functionality
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-27697 · GHSA-vh89-rjph-2g7p
- High, CVSS 8.7
onnx Vulnerable to Path Traversal via Symlink
PyPI onnx · Upgrade to 1.21.0 or later · < 1.21.0 · CVE-2026-27489 · GHSA-3r9x-f23j-gc73 · amended
- High, CVSS 8.2
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
PyPI fastmcp · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-27124 · GHSA-rww4-4w9c-7733 · amended
- High, CVSS 8.1
Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)
Go github.com/cloudreve/Cloudreve/v4 · Upgrade to 4.0.0-20260205113604-ec9fdd33bc54 (pre-release) or later · < 4.0.0-20260205113604-ec9fdd33bc54 · CVE-2026-25726 · GHSA-f8xp-wvcx-p6f4
- Critical, CVSS 9.1
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-21861 · GHSA-qxmc-6f24-g86g
- Medium, CVSS 6.7
FastMCP has a Command Injection vulnerability - Gemini CLI
PyPI fastmcp · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2025-64340 · GHSA-m8x7-r2rg-vh5g · amended
- High, CVSS 8.7
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2025-32957 · GHSA-hv78-cwp4-8r7r
- Critical, CVSS 9.6
Mlflow: Command Injection when serving models with enable_mlserver=True
PyPI mlflow · Upgrade to 3.9.0 or later · < 3.9.0 · CVE-2026-0596 · GHSA-rvhj-8chj-8v3c · amended
- Medium, CVSS 5.0
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
PyPI glance · Upgrade to 31.1.0, 30.2.0 or 29.2.0 by release line · < 29.2.0; >= 30.0.0, < 30.2.0; >= 31.0.0, <= 31.0.0 · CVE-2026-34881 · GHSA-mc26-q38v-83gv · amended
- Medium, CVSS 4.8
Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
PyPI apache-airflow · Upgrade to 1.12.0 or later · >= 1.10.0, < 1.12.0 · CVE-2026-32794 · GHSA-wrpj-755p-x363 · amended
- Medium, CVSS 4.9
Fleet's user account creation via invite does not enforce invited email address
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.81.0 or later · < 4.81.0 · CVE-2026-34389 · GHSA-4f9r-x588-pp2h
- Medium, CVSS 6.6
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.81.0 or later · < 4.81.0 · CVE-2026-34388 · GHSA-w254-4hp5-7cvv
- Medium, CVSS 6.3
Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.81.0 or later · < 4.81.0 · CVE-2026-34386 · GHSA-9p23-p2m4-2r4m
- Medium, CVSS 6.2
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.81.0 or later · < 4.81.0 · CVE-2026-34385 · GHSA-v895-833r-8c45
- High, CVSS 8.4
Zebra has a Consensus Failure due to Improper Verification of V5 Transactions
crates.io zebra-consensus · Upgrade to 5.0.1 or later · < 5.0.1 · +1 more package · CVE-2026-34377 · GHSA-3vmh-33xr-9cqh
- Medium, CVSS 5.3
OpenClaw: Non-owner command-authorized sender can change the owner-only
/sendsession delivery policynpm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · CVE-2026-35620 · GHSA-39mp-545q-w789 · amended
- High, CVSS 8.1
OpenClaw:
browser.requeststill allowsPOST /reset-profilethrough theoperator.writesurfacenpm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · CVE-2026-35653 · GHSA-xp9r-prpg-373r · amended
- Medium, CVSS 6.5
OpenClaw: Mutating internal
/allowlistchat commands missedoperator.adminscope enforcementnpm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · GHSA-vqvg-86cc-cg83 · amended
- Unrated
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
npm openclaw · Upgrade to 2026.3.24 or later · <= 2026.3.23 · CVE-2026-35621 · GHSA-94pw-c6m8-p9p9 · amended
- High, CVSS 8.4
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
npm openclaw · Upgrade to 2026.3.24 or later · <= 2025.3.23 · CVE-2026-35641 · GHSA-m3mh-3mpg-37hw · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.