High, CVSS 8.1
Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
PyPI apache-airflow · Upgrade to 3.1.8 or later · >= 3.1.0, < 3.1.8 · CVE-2026-30911 · GHSA-8x34-9q3v-h7g8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9101–9125 of 31,071 matching · newest first
- Medium, CVSS 4.3
Apache Airflow: DAG authorization bypass
PyPI apache-airflow · Upgrade to 3.1.8 or later · >= 3.0.0, < 3.1.8 · CVE-2026-28563 · GHSA-x3fv-96qh-67m7 · amended
- High, CVSS 7.5
Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
PyPI apache-airflow · Upgrade to 3.1.8 or later · >= 3.0.0, < 3.1.8 · CVE-2026-26929 · GHSA-4m3h-wp5w-5hqh · amended
- Low, CVSS 2.3
Broken Access Control in extension "Redirect Tab" (redirect_tab)
Packagist ayacoo/redirect-tab · Upgrade to 4.0.5, 3.1.7 or 2.1.2 by release line · < 2.1.2; >= 3.0.0, < 3.1.7; >= 4.0.0, < 4.0.5 · CVE-2026-4202 · GHSA-755r-r738-mjgp
- High, CVSS 7.7
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
Packagist ralffreit/mfa-email · Upgrade to 2.0.1 or 1.0.7 by release line · < 1.0.7; >= 2.0.0, <= 2.0.0 · CVE-2026-4208 · GHSA-29r8-gvx4-r9w3
- High, CVSS 7.7
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
npm sjcl · Upgrade to 1.0.9 or later · <= 1.0.8 · CVE-2026-4258 · GHSA-2w8x-224x-785m · amended
- Medium, CVSS 4.3
Mattermost fails to verify run_create permission for empty playbookId
Go github.com/mattermost/mattermost-plugin-playbooks · Upgrade to 1.41.1-0.20260316224925-705f54a81841 (pre-release) or later · < 1.41.1-0.20260316224925-705f54a81841 · CVE-2026-26304 · GHSA-4pmx-622h-x359
- High, CVSS 8.0
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Packagist admidio/admidio · Upgrade to 5.0.7 or later · <= 5.0.6 · CVE-2026-32813 · GHSA-3x67-4c2c-w45m
- Medium, CVSS 6.5
Admidio is Missing Authorization on Forum Topic and Post Deletion
Packagist admidio/admidio · Upgrade to 5.0.7 or later · >= 5.0.0, <= 5.0.6 · CVE-2026-32818 · GHSA-g375-5wmp-xr78
- Medium, CVSS 5.4
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Packagist admidio/admidio · Upgrade to 5.0.7 or later · <= 5.0.6 · CVE-2026-32757 · GHSA-4wr4-f2qf-x5wj
- Critical, CVSS 9.1
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Packagist admidio/admidio · Upgrade to 5.0.7 or later · >= 5.0.0, <= 5.0.6 · CVE-2026-32817 · GHSA-rmpj-3x5m-9m5f
- Medium, CVSS 6.8
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
Packagist admidio/admidio · Upgrade to 5.0.7 or later · >= 5.0.0, <= 5.0.6 · CVE-2026-32812 · GHSA-6j68-gcc3-mq73
- Medium, CVSS 5.7
Admidio is Missing CSRF Protection on Role Membership Date Changes
Packagist admidio/admidio · Upgrade to 5.0.7 or later · <= 5.0.6 · CVE-2026-32755 · GHSA-h8gr-qwr6-m9gx
- Medium, CVSS 5.7
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
Packagist admidio/admidio · Upgrade to 5.0.7 or later · >= 5.0.0, <= 5.0.6 · CVE-2026-32816 · GHSA-wwg8-6ffr-h4q2
- High, CVSS 8.8
File Upload(RCE) Vulnerability in admidio
Packagist admidio/admidio · Upgrade to 5.0.7 or later · <= 5.0.6 · CVE-2026-32756 · GHSA-95cq-p4w2-32w5
- High, CVSS 8.2
lz4_flex's decompression can leak information from uninitialized memory or reused output buffer
crates.io lz4_flex · Upgrade to 0.12.1 or 0.11.6 by release line · < 0.11.6; >= 0.12.0, < 0.12.1 · CVE-2026-32829 · GHSA-vvp9-7p8x-rfvv
- Medium, CVSS 5.1
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Go github.com/akuity/kargo · Upgrade to 1.9.5, 1.8.12, 1.7.9 or 1.6.4 by release line · >= 1.4.0, < 1.6.4; >= 1.7.0-rc.1, < 1.7.9; >= 1.8.0-rc.1, < 1.8.12; >= 1.9.0-rc.1, < 1.9.5 · CVE-2026-32828 · GHSA-j94x-8wcp-x7hm
- High, CVSS 7.1
Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Go github.com/ctfer-io/fullchain · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-32769 · GHSA-hxm7-9q36-c77f
- High, CVSS 8.3
Romeo is vulnerable to Archive Slip due to missing checks in sanitization
Go github.com/ctfer-io/romeo/webserver · Upgrade to 0.2.2 or later · < 0.2.2 · CVE-2026-32805 · GHSA-p799-g7vv-f279
- High, CVSS 8.3
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
Go github.com/ctfer-io/monitoring · Upgrade to 0.2.2 or later · < 0.2.2 · CVE-2026-32771 · GHSA-f7cq-gvh6-qr25
- High, CVSS 7.9
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Go github.com/ctfer-io/romeo/environment/deploy · Upgrade to 0.2.1 or later · < 0.2.1 · CVE-2026-32737 · GHSA-fgm3-q9r5-43v9
- High, CVSS 7.9
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Go github.com/ctfer-io/chall-manager/deploy +1 · Upgrade all 2 to 0.6.5 or later · < 0.6.5 · CVE-2026-32768 · GHSA-mw24-f3xh-j3qv
- Medium, CVSS 6.5
File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.62.0 or later · <= 2.61.2 · CVE-2026-32758 · GHSA-9f3r-2vgw-m8xp
- Critical, CVSS 10.0
File Browser Signup Grants Admin When Default Permissions Include Admin
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.62.0 or later · <= 2.61.2 · CVE-2026-32760 · GHSA-5gg9-5g7w-hm73
- Medium, CVSS 5.3
File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.33.8 or later · < 2.33.8 · CVE-2026-32759 · GHSA-ffx7-75gc-jg7c
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.