Medium, CVSS 4.8
PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token
Go github.com/pinchtab/pinchtab · Upgrade to 0.8.5 or later · >= 0.7.7, < 0.8.5 · CVE-2026-33621 · GHSA-j65m-hv65-r264
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8826–8850 of 31,057 matching · newest first
- Medium, CVSS 6.7
PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution
Go github.com/pinchtab/pinchtab +1 · Upgrade all 2 to 0.8.5 or later · < 0.8.5 · CVE-2026-33623 · GHSA-p8mm-644p-phmh
- Medium, CVSS 4.3
PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems
Go github.com/pinchtab/pinchtab · Upgrade to 0.8.4 or later · >= 0.7.8, < 0.8.4 · CVE-2026-33620 · GHSA-mrqc-3276-74f8
- Medium, CVSS 4.1
PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl
Go github.com/pinchtab/pinchtab · Upgrade to 0.8.4 or later · <= 0.8.3 · CVE-2026-33619 · GHSA-xqq2-4j46-vwp7
- Medium, CVSS 5.9
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
npm @astrojs/node · Upgrade to 10.0.0 or later · < 10.0.0 · CVE-2026-29772 · GHSA-3rmj-9m5h-8fpv · amended
- Medium, CVSS 5.3
MobSF has SQL Injection in its SQLite Database Viewer Utils
PyPI mobsf · Upgrade to 4.4.6 or later · <= 4.4.5 · CVE-2026-33545 · GHSA-hqjr-43r5-9q58 · amended
- High, CVSS 7.1
JustHTML is vulnerable to XSS via code fence breakout in content
PyPI justhtml · Upgrade to 1.13.0 or later · <= 1.12.0 · CVE-2026-5389 · GHSA-5vp3-3cg6-2rq3 · amended
- Medium, CVSS 5.3
FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260317230626-af08800667b8 (pre-release) or later · < 0.0.0-20260317230626-af08800667b8 · CVE-2026-54685 · GHSA-7789-65hx-f26w
- Medium, CVSS 4.3
iCalendar has ICS injection via unsanitized URI property values
RubyGems icalendar · Upgrade to 2.12.2 or later · >= 2.0.0, < 2.12.2 · CVE-2026-33635 · GHSA-pv9c-9mfh-hvxq
- High, CVSS 8.6
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
npm parse-server · Upgrade to 9.6.0-alpha.53 (pre-release) or 8.6.59 by release line · >= 9.0.0, < 9.6.0-alpha.53; < 8.6.59 · CVE-2026-33539 · GHSA-p2w6-rmh7-w8q3 · amended
- High, CVSS 8.7
Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
npm parse-server · Upgrade to 9.6.0-alpha.52 (pre-release) or 8.6.58 by release line · >= 9.0.0, < 9.6.0-alpha.52; < 8.6.58 · CVE-2026-33538 · GHSA-g4cf-xj29-wqqr · amended
- High, CVSS 7.5
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
npm fido2-lib · Upgrade to 3.5.8 or later · <= 3.5.7 · GHSA-g3qj-j598-cxmq · amended
- Medium, CVSS 4.9
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
Packagist craftcms/cms · Upgrade to 5.9.14 or later · >= 5.3.0, <= 5.9.13 · CVE-2026-33162 · GHSA-f582-6gf6-gx4g
- Low, CVSS 1.3
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
Packagist craftcms/cms · Upgrade to 5.9.14 or 4.17.8 by release line · >= 5.0.0-RC1, <= 5.9.13; >= 4.0.0-RC1, <= 4.17.7 · CVE-2026-33161 · GHSA-vgjg-248p-rfm2
- Low, CVSS 2.7
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
Packagist craftcms/cms · Upgrade to 5.9.14 or 4.17.8 by release line · >= 5.0.0-RC1, <= 5.9.13; >= 4.0.0-RC1, <= 4.17.7 · CVE-2026-33160 · GHSA-5pgf-h923-m958
- Medium, CVSS 6.9
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Packagist craftcms/cms · Upgrade to 5.9.14 or 4.17.8 by release line · >= 5.0.0-RC1, <= 5.9.13; >= 4.0.0-RC1, <= 4.17.7 · CVE-2026-33159 · GHSA-6mrr-q3pj-h53w
- Medium, CVSS 4.9
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Packagist craftcms/cms · Upgrade to 5.9.14 or 4.17.8 by release line · >= 4.0.0-RC1, <= 4.17.7; >= 5.0.0-RC1, <= 5.9.13 · CVE-2026-33158 · GHSA-3pvf-vxrv-hh9c
- High, CVSS 8.7
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
Packagist craftcms/cms · Upgrade to 5.9.13 or later · >= 5.6.0, <= 5.9.12 · CVE-2026-33157 · GHSA-2fph-6v5w-89hh
- High, CVSS 8.6
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Packagist froxlor/froxlor · Upgrade to 2.3.5 or later · <= 2.3.4 · CVE-2026-30932 · GHSA-x6w6-2xwp-3jh6
- Medium, CVSS 6.5
GoDoxy has a Path Traversal Vulnerability in its File API
Go github.com/yusing/godoxy · Upgrade to 0.27.5 or later · < 0.27.5 · CVE-2026-33528 · GHSA-4753-cmc8-8j9v
- Medium, CVSS 5.3
Parse Server's Session Update endpoint allows overwriting server-generated session fields
npm parse-server · Upgrade to 9.6.0-alpha.48 (pre-release) or 8.6.57 by release line · >= 9.0.0, < 9.6.0-alpha.48; < 8.6.57 · CVE-2026-33527 · GHSA-jc39-686j-wp6q · amended
- Low, CVSS 0.5
Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting
Go github.com/authelia/authelia/v4 · Upgrade to 4.39.16 or later · >= 4.39.15, <= 4.39.15 · CVE-2026-33525 · GHSA-gmfg-3v4q-9qr4
- Low, CVSS 2.3
Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol
Maven org.apache.activemq:artemis-openwire-protocol +1 · Upgrade all 2 to 2.53.0 or later · >= 2.0.0, < 2.53.0 · CVE-2026-32642 · GHSA-f4gc-mwrg-q36r
- High, CVSS 8.6
Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access
Maven org.springframework.cloud:spring-cloud-config-server · Upgrade to 5.0.2 or 4.3.2 by release line; some affected versions have no fix yet · >= 4.3.0, < 4.3.2; >= 5.0.0-M1, < 5.0.2; >= 4.2.0, <= 4.2.4; >= 4.0.0, <= 4.1.7; <= 3.1.10 · CVE-2026-22739 · GHSA-3qwq-q9vm-5j42
- Unrated
Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery
runtime node · Upgrade to 25.8.2, 24.14.1, 22.22.2 or 20.20.2 by release line · >= 20.0.0, < 20.20.2; >= 22.0.0, < 22.22.2; >= 24.0.0, < 24.14.1; >= 25.0.0, < 25.8.2 · CVE-2026-21713
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.