High, CVSS 7.7
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.9.6, < 0.11.1 · CVE-2026-87996 · GHSA-4v28-j6q3-5m4r · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.10.0, < 0.11.1 · CVE-2026-87998 · GHSA-2724-6cpj-gf3v · amended
- High, CVSS 7.1
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
PyPI open-webui · Upgrade to 0.11.1 or later · < 0.11.1 · CVE-2026-87999 · GHSA-34r3-9m95-vq73 · amended
- High, CVSS 8.1
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
npm @eigenpal/docx-editor-react +1 · Upgrade all 2 to 1.8.3 or later · <= 1.8.2 · GHSA-x7m8-jrm8-hpvx · amended
- Critical, CVSS 9.3
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-11720 · GHSA-vwxw-jrg6-9jxv · amended
- Critical, CVSS 9.8
Gitea pre-receive hook scanner errors allow branch-protection bypass
Go code.gitea.io/gitea · Upgrade to 1.26.0 or later · < 1.26.0 · CVE-2026-27780 · GHSA-vhq7-fwwh-7hjf · amended
- High, CVSS 7.5
Gitea draft releases and attachments are exposed without write permission
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-27660 · GHSA-x92v-f5gc-r34v · amended
- High, CVSS 7.5
Gitea forwarded-proto validation allows canonical URL spoofing
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-27779 · GHSA-v8f2-2ghq-9whv · amended
- Critical, CVSS 9.8
Gitea LFS mirror operations bypass migration HTTP transport protections
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-26292 · GHSA-rc56-rj3f-xggf · amended
- Critical, CVSS 9.1
Apache FreeMarker template loading mechanism vulnerable to path traversal
Maven org.freemarker:freemarker · Upgrade to 2.3.35 or later · >= 2.2.0, <= 2.3.34 · CVE-2026-84939 · GHSA-27j2-h3m2-8237 · amended
- High, CVSS 8.5
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Go github.com/identrail/identrail · Upgrade to 1.0.2 or later · < 1.0.2 · CVE-2026-59185 · GHSA-cp3j-m783-3ph5 · amended
- High, CVSS 8.3
@openhop/server: Path Traversal in Flow ID File Operations
npm @openhop/server · Upgrade to 0.3.6 or later · <= 0.3.5 · CVE-2026-59179 · GHSA-g72f-jw3w-mgh7 · amended
- High, CVSS 8.8
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
PyPI esphome-device-builder · Upgrade to 1.0.10 or later · < 1.0.10 · CVE-2026-59177 · GHSA-vv4j-m4vr-f3g6 · amended
- High, CVSS 7.8
functype-mcp-server: MCP
set_functype_versionPackage Alias RCE via Unsanitized pnpm install + Dynamic Importnpm functype-mcp-server · Upgrade to 1.4.4 or later · < 1.4.4 · CVE-2026-59176 · GHSA-wcjj-9m6g-2fr2 · amended
- High, CVSS 7.8
Joker linter executed project-local .jokerd/linter.* files during linting
Go github.com/candid82/joker · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2026-59172 · GHSA-m835-3cm9-rggg · amended
- High, CVSS 8.8
Komari: Management Interface CSRF
Go github.com/komari-monitor/komari · Upgrade to 0.0.0-20260609084633-98122fa4d110 (pre-release) or later · < 0.0.0-20260609084633-98122fa4d110 · GHSA-hxjg-93wc-h8p8 · amended
- High, CVSS 8.8
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
npm @yeger/turbo-graph · Upgrade to 2.8.12 or later · <= 2.8.8 · CVE-2026-59160 · GHSA-2r5q-h53f-9rp3 · amended
- High, CVSS 7.5
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
npm nuxt-ollama · Upgrade to 1.3.1 or later · >= 1.2.26, < 1.3.1 · CVE-2026-59158 · GHSA-fxg7-897c-57mp · amended
- High, CVSS 7.7
GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool
Maven org.geonetwork-opensource:gn-web-app · Upgrade to 4.4.12 or 4.2.17 by release line · >= 4.4.0, <= 4.4.11; >= 4.0.0, <= 4.2.16 · CVE-2026-55864 · GHSA-5hx7-j24v-rffj · amended
- High, CVSS 8.2
smol-toml: Denial of Service via malformed TOML documents
npm smol-toml · Upgrade to 1.7.1 or later · <= 1.7.0 · CVE-2026-85730 · GHSA-7w5x-hrqm-74c2 · amended
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.diasymreader.native · Upgrade to 18.9.0-beta1.26405.2 (pre-release) or later · >= 17.10.0-beta1.24272.1, < 18.9.0-beta1.26405.2 · CVE-2026-69522 · GHSA-2j8r-3c22-8565 · amended
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability
NuGet microsoft.diasymreader.native · Upgrade to 18.9.0-beta1.26405.2 (pre-release) or later · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 · CVE-2026-69439 · GHSA-527h-q9f6-p7qx · amended
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.diasymreader.native · Upgrade to 18.9.0-beta1.26405.2 (pre-release) or later · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1 · CVE-2026-71328 · GHSA-63gh-g2x5-x69v · amended
- High, CVSS 7.5
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
npm nodemailer · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-92596 · GHSA-2x7j-588g-ccc2 · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via crafted multipart field names
npm multer · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2026-77078 · GHSA-wc9g-mqfw-jrwm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.