High, CVSS 8.1
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56829 · GHSA-g3f9-g5vj-p62f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Shopper: privilege escalation via improper Livewire admin component authorization
Packagist shopper/framework · Upgrade to 2.9.2 or later · >= 2.8.0, < 2.9.2 · CVE-2026-56828 · GHSA-j328-xmgp-j4q3 · amended
- High, CVSS 8.1
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56827 · GHSA-243p-f3cv-c5wh · amended
- High, CVSS 8.8
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
Maven com.linecorp.centraldogma:centraldogma-server-mirror-git · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11745 · GHSA-vjfw-cpmh-xwv3 · amended
- Critical, CVSS 9.4
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Maven com.linecorp.centraldogma:centraldogma-server · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11746 · GHSA-2j95-gqxf-v3vg · amended
- Critical, CVSS 10.0
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
PyPI mysql-mcp-server · Upgrade to 0.4.2 or later · < 0.4.2 · CVE-2026-59971 · GHSA-rqfv-2mw9-78g2 · amended
- Critical, CVSS 9.8
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · < 1.75.1 · CVE-2026-88018 · GHSA-xwwr-4h3p-r22c · amended
- Critical, CVSS 9.1
rclone: RC per-server auth-proxy bypass
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.70.0, < 1.75.1 · CVE-2026-88044 · GHSA-p569-5gjg-9cmj · amended
- High, CVSS 7.3
rclone: FTP cross-session auth-proxy backend confusion
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.64.0, <= 1.75.0 · CVE-2026-88017 · GHSA-c476-6w5q-jw77 · amended
- High, CVSS 7.5
rclone: S3 multipart declared-length memory exhaustion
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.75.0, <= 1.75.0 · CVE-2026-88045 · GHSA-2p48-j3qc-rx9f · amended
- High, CVSS 7.5
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.9.0, <= 0.11.0 · CVE-2026-87011 · GHSA-3g9q-v48f-hh9w · amended
- High, CVSS 7.1
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API
overrideAccessOmissionnpm @jhb.software/payload-alt-text-plugin · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-59965 · GHSA-4qpv-39hg-f7fx · amended
- High, CVSS 7.5
@argos-ci/core: CI Branch Name OS Command Injection
npm @argos-ci/core · Upgrade to 6.2.1 or later · <= 6.2.0 · CVE-2026-59960 · GHSA-4x45-gxvp-6283 · amended
- High, CVSS 7.5
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
crates.io mistralrs-server-core · Upgrade to 0.8.18 or later · <= 0.8.4 · GHSA-m3wp-48jr-vr4g · amended
- High, CVSS 7.2
mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
crates.io mistralrs-server-core · Upgrade to 0.8.18 or later · <= 0.8.17 · GHSA-wfgq-w7cq-qj7j · amended
- High, CVSS 8.1
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.6.41, < 0.11.1 · CVE-2026-87016 · GHSA-wpmr-8h3q-fwj7 · amended
- High, CVSS 7.7
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
npm n8n · Upgrade to 2.38.2, 2.37.7 or 1.123.76 by release line · < 1.123.76; >= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7 · CVE-2026-86083 · GHSA-6xcw-7xm6-48c6 · amended
- High, CVSS 8.6
Angular: SSR XSS via Unescaped Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
npm @angular/platform-server · Upgrade to 22.1.4, 21.2.22 or 20.3.30 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.4; >= 21.0.0, < 21.2.22; >= 20.0.0, < 20.3.30; <= 19.2.25 · CVE-2026-88060 · GHSA-v3p8-whq6-r5jg · amended
- High, CVSS 8.6
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
npm @angular/platform-server · Upgrade to 22.1.4, 21.2.22 or 20.3.30 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.4; >= 21.0.0, < 21.2.22; >= 20.0.0, < 20.3.30; <= 19.2.25 · CVE-2026-88056 · GHSA-f6mr-pjwc-34m4 · amended
- High, CVSS 8.8
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
Packagist pimcore/pimcore · Upgrade to 2026.1.6, 12.3.10 or 11.5.19 by release line · >= 2026.1.0, < 2026.1.6; >= 12.0.0-RC1, < 12.3.10; < 11.5.19 · CVE-2026-55416 · GHSA-23rh-xw42-fq82
- High, CVSS 7.1
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
npm n8n · Upgrade to 2.38.2, 2.37.7 or 1.123.76 by release line · < 1.123.76; >= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7 · CVE-2026-86082 · GHSA-34ff-336r-5q23 · amended
- High, CVSS 7.1
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
npm n8n · Upgrade to 2.38.2, 2.37.7 or 1.123.76 by release line · < 1.123.76; >= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7 · CVE-2026-86081 · GHSA-j535-v25q-vx3q · amended
- High, CVSS 8.7
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
npm n8n · Upgrade to 2.38.2 or 2.37.7 by release line · >= 2.38.0, < 2.38.2; < 2.37.7 · CVE-2026-86075 · GHSA-hh89-3r9w-qj3j · amended
- High, CVSS 8.7
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
npm n8n · Upgrade to 2.38.2, 2.37.7 or 1.123.76 by release line · < 1.123.76; >= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7 · CVE-2026-86076 · GHSA-hw8v-xxg5-vvvx · amended
- High, CVSS 8.7
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.8.11, <= 0.11.0 · CVE-2026-87995 · GHSA-jmc6-2wr8-h3wj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.