High, CVSS 8.7
free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion
Go github.com/free5gc/ausf · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33063 · GHSA-4jrw-92fg-4jwx
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9001–9025 of 31,057 matching · newest first
- High, CVSS 8.7
free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter
Go github.com/free5gc/nrf · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33062 · GHSA-7c47-xr7q-p6hg
- Critical, CVSS 9.8
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
PyPI mesop · Upgrade to 1.2.3 or later · <= 1.2.2 · CVE-2026-33057 · GHSA-gjgx-rvqr-6w6v · amended
- Critical, CVSS 10.0
Mesop has a Path Traversal utilizing
FileStateSessionBackendleads to Application Denial of Service and File Write/DeletionPyPI mesop · Upgrade to 1.2.3 or later · <= 1.2.2 · CVE-2026-33054 · GHSA-8qvf-mr4w-9x2c · amended
- Medium, CVSS 4.3
Statamic is missing authorization check on taxonomy term creation via fieldtype
Packagist statamic/cms · Upgrade to 6.7.0 or 5.73.14 by release line · >= 6.0.0-alpha.1, < 6.7.0; < 5.73.14 · CVE-2026-33177 · GHSA-wh3h-gvc4-cc2g
- Medium, CVSS 4.3
Statamic has a path traversal in file dictionary fieldtype
Packagist statamic/cms · Upgrade to 6.7.0 or 5.73.14 by release line · >= 6.0.0-alpha.1, < 6.7.0; < 5.73.14 · CVE-2026-33171 · GHSA-qm7r-wwq7-6f85
- High, CVSS 8.7
Statamic has Stored XSS via SVG Sanitization Bypass
Packagist statamic/cms · Upgrade to 6.7.0 or 5.73.14 by release line · >= 6.0.0-alpha.1, < 6.7.0; < 5.73.14 · CVE-2026-33172 · GHSA-7rcv-55mj-chg7
- High, CVSS 8.7
Gossipsub PRUNE.backoff Duration Overflow
crates.io libp2p-gossipsub · Upgrade to 0.49.3 or later · < 0.49.3 · CVE-2026-33040 · GHSA-gc42-3jg7-rxr2 · amended
- High, CVSS 8.6
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
Maven io.qameta.allure:allure-generator · Upgrade to 2.38.0 or later · <= 2.37.0 · CVE-2026-33166 · GHSA-64hm-gfwq-jppw
- High, CVSS 8.2
Parse Server leaks protected fields via LiveQuery afterEvent trigger
npm parse-server · Upgrade to 9.6.0-alpha.35 (pre-release) or 8.6.50 by release line · >= 9.0.0, < 9.6.0-alpha.35; < 8.6.50 · CVE-2026-33163 · GHSA-5hmj-jcgp-6hff · amended
- Critical, CVSS 9.9
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
npm @apostrophecms/import-export · Upgrade to 3.5.3 or later · <= 3.5.2 · CVE-2026-32731 · GHSA-mwxc-m426-3f78 · amended
- High, CVSS 8.1
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
npm apostrophe · Upgrade to 4.28.0 or later · <= 4.27.1 · CVE-2026-32730 · GHSA-v9xm-ffx2-7h35 · amended
- Medium, CVSS 4.3
Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form
Maven org.jenkins-ci.plugins:loadninja · Upgrade to 2.2 or later · < 2.2 · CVE-2026-33004 · GHSA-p9hg-wrmv-v8cp
- High, CVSS 8.8
Jenkins has a link following vulnerability allows arbitrary file creation
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.555 or later · <= 2.554 · CVE-2026-33001 · GHSA-r6qv-frpc-q66c
- High, CVSS 7.5
Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.555 or later · >= 2.442, < 2.555 · CVE-2026-33002 · GHSA-phhv-63fh-rrc8
- Medium, CVSS 4.3
Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files
Maven org.jenkins-ci.plugins:loadninja · Upgrade to 2.2 or later · < 2.2 · CVE-2026-33003 · GHSA-qqjr-hf5h-jx3q
- Medium, CVSS 5.3
Avo has a XSS vulnerability on
return_toparamRubyGems avo · Upgrade to 3.30.3 or later · <= 3.30.2 · CVE-2026-33209 · GHSA-762r-27w2-q22j
- Low, CVSS 2.7
Improper detection of disallowed URIs by Loofah
allowed_uri?RubyGems loofah · Upgrade to 2.25.1 or later · >= 2.25.0, <= 2.25.0 · GHSA-46fp-8f5p-pf2m
- High, CVSS 7.1
Out-of-Bounds Slice Access in free5GC CHF Leading to DoS
Go github.com/free5gc/chf · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-32937 · GHSA-6g43-577r-wf4x
- High, CVSS 8.7
socket.io allows an unbounded number of binary attachments
npm socket.io-parser · Upgrade to 4.2.6, 3.4.4 or 3.3.5 by release line · < 3.3.5; >= 3.4.0, < 3.4.4; >= 4.0.0, < 4.2.6 · CVE-2026-33151 · GHSA-677m-j7p3-52f9 · amended
- Medium, CVSS 5.3
Zitadel is missing enforcement of organization scopes
Go github.com/zitadel/zitadel · Upgrade to 4.12.3, 3.4.9 or 1.80.0-v2.20.0.20260317120401-d90285929ca0 (pre-release) by release line · >= 4.0.0-rc.1, <= 4.12.2; >= 3.0.0-rc.1, < 3.4.9; < 1.80.0-v2.20.0.20260317120401-d90285929ca0 · CVE-2026-33132 · GHSA-g2pf-ww5m-2r9m
- High, CVSS 8.7
OneUptime WhatsApp Webhook Missing Signature Verification
npm oneuptime · Upgrade to 10.0.34 or later · < 10.0.34 · CVE-2026-33143 · GHSA-g5ph-f57v-mwjc · amended
- High, CVSS 8.1
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
npm oneuptime · Upgrade to 10.0.34 or later · < 10.0.34 · CVE-2026-33142 · GHSA-gcg3-c5p2-cqgg · amended
- Medium, CVSS 5.8
PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation
Go github.com/pinchtab/pinchtab · Upgrade to 0.8.3 or later · <= 0.8.2 · CVE-2026-33081 · GHSA-qwxp-6qf9-wr4m
- Medium, CVSS 5.3
Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution
PyPI pyspector · Upgrade to 0.1.7 or later · <= 0.1.6 · CVE-2026-33140 · GHSA-2gmv-2r3v-jxj2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.