Medium, CVSS 5.3
Contao: Path traversal in the images controller
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.1.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107844 · GHSA-mrvp-7wmx-5m4h · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1001–1025 of 30,910 matching · newest first
- Critical, CVSS 9.3
Contao: Cross-site scripting in the comments bundle
Packagist contao/comments-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107845 · GHSA-628f-v4f6-p37r · amended
- Medium, CVSS 4.3
Contao: Improper access control in the preview links module
Packagist contao/core-bundle · Upgrade to 5.7.12 or later · >= 5.7.1, < 5.7.12 · CVE-2026-107850 · GHSA-q6wp-fr43-gm9v · amended
- Medium, CVSS 4.3
Contao: Improper access control in the table access voter
Packagist contao/core-bundle · Upgrade to 5.7.12 or later · >= 5.7.0, < 5.7.12 · CVE-2026-107851 · GHSA-5974-gfqc-wrcm · amended
- High, CVSS 7.1
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · >= 2.5.0, < 2.6.0 · CVE-2026-91970 · GHSA-wq92-8x3r-fm38 · amended
- High, CVSS 7.1
Vikunja: Unbounded CSV row cardinality permits API process termination
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · >= 2.5.0, <= 2.5.0 · CVE-2026-91969 · GHSA-pqf9-h8g4-8gmh · amended
- High, CVSS 7.1
Vikunja: Unbounded nested task-filter recursion permits API process termination
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · >= 2.5.0, <= 2.5.0 · CVE-2026-91968 · GHSA-xxc3-xpmc-vmvr · amended
- High, CVSS 7.1
Vikunja: Denial of service via decompression bomb in the data import
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91979 · GHSA-w7jp-mf2v-8342 · amended
- Medium, CVSS 5.3
Vikunja: Link-share token can enumerate users through the v2 API
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91981 · GHSA-vfxw-3x8p-2vjr · amended
- Medium, CVSS 5.3
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91980 · GHSA-39p5-2wrr-xh29 · amended
- High, CVSS 7.1
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91971 · GHSA-4vh2-39rq-rq8j · amended
- Unrated
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91973 · GHSA-m469-88xx-8rx2 · amended
- Medium, CVSS 5.3
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · >= 1.0.0, <= 2.5.0 · CVE-2026-91983 · GHSA-9rg3-v78m-26q8 · amended
- Medium, CVSS 5.3
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91984 · GHSA-w39f-h553-h2mx · amended
- Unrated
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91985 · GHSA-qfwc-vx6f-3g6g · amended
- Medium, CVSS 5.3
Vikunja: TOTP secret is readable after enrollment, no step-up auth
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91982 · GHSA-88f6-4rjv-x774 · amended
- High, CVSS 8.7
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · CVE-2026-91972 · GHSA-6rvj-qwjf-3m4q · amended
- High, CVSS 8.1
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-62376 · GHSA-r6w9-259g-gwrv · amended
- High, CVSS 7.5
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 1.0.0, <= 2.3.0 · CVE-2026-62367 · GHSA-xv7q-fvmc-jx96 · amended
- Critical, CVSS 9.0
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260728074146-a467ed652591 (pre-release) or later · >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 · CVE-2026-107806 · GHSA-p393-cf76-4jmr · amended
- High, CVSS 7.5
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud
getFileURLEndpoint Leads to Remote Denial of ServiceGo github.com/luskaner/ageLANServer/server · Upgrade to 1.8.2-0.20260809203301-1dd40166a593 (pre-release) or later · < 1.8.2-0.20260809203301-1dd40166a593 · CVE-2026-107839 · GHSA-4jfq-pmq9-257h · amended
- High, CVSS 7.5
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
Go code.vikunja.io/api · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2026-76216 · GHSA-32r8-5843-4qw2 · amended
- High, CVSS 7.5
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
Go github.com/jhaals/yopass · Upgrade to 0.0.0-20260727191436-61e31ead04a4 (pre-release) or later · < 0.0.0-20260727191436-61e31ead04a4 · CVE-2026-107840 · GHSA-6r69-c6wg-7g8m · amended
- Medium, CVSS 5.7
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
PyPI pacioli-guard · Upgrade to 0.10.0 or later · >= 0.9.6, < 0.10.0 · CVE-2026-107841 · GHSA-3hj7-6vmj-h8v4 · amended
- Critical, CVSS 9.3
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.24.0, <= 2.3.0 · CVE-2026-68582 · GHSA-rj9j-8772-4h6c · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.