High, CVSS 7.4
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
Packagist getgrav/grav · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2026-62232 · GHSA-7mgc-c7pq-3rr3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
PyPI omnigent · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-62677 · GHSA-p8rw-8qj3-hf33
- Critical, CVSS 9.0
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
PyPI omnigent · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-62674 · GHSA-jrrm-9hc7-2v3h · amended
- High, CVSS 8.8
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
PyPI omnigent · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-62675 · GHSA-756x-9hf6-q4h4
- High, CVSS 7.5
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
npm link-preview-js · Upgrade to 4.0.4 or later · <= 4.0.3 · CVE-2026-61704 · GHSA-cpjf-6666-r8fx
- High, CVSS 7.5
Gitea git grep searches allow server resource exhaustion
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-26307 · GHSA-h9c5-x7g8-4q7f · amended
- Critical, CVSS 9.1
Gitea OAuth2 PKCE S256 verifier bypass
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-26247 · GHSA-m5ch-ppfx-xv3v · amended
- Critical, CVSS 9.1
Gitea OAuth2 authorization codes can be reused after expiry
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-26232 · GHSA-5v69-g2m3-3hq3 · amended
- Critical, CVSS 9.1
Gitea repository creation accepts insufficiently validated fields
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-22547 · GHSA-922f-hfwp-p56f · amended
- High, CVSS 7.5
Gitea primary email ownership bypass allows cross-user email changes
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-27657 · GHSA-4c8f-3m6h-m56r · amended
- High, CVSS 7.5
Gitea organization permission APIs expose hidden membership and private organization data
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-25712 · GHSA-37w2-86g3-h4qh · amended
- Critical, CVSS 9.1
Gitea template repository generation follows unsafe filesystem paths
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-25718 · GHSA-h697-89cp-24q8 · amended
- High, CVSS 7.5
Gitea pull request branch permission checks allow unauthorized updates and rebases
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-24690 · GHSA-47rq-xp99-92mx · amended
- High, CVSS 7.5
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.4.2, < 2.4.5; >= 3.1.3, < 3.1.6; >= 4.0.1, < 4.1.3 · CVE-2026-75931 · GHSA-5jgf-p345-68v8
- High, CVSS 7.5
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.3.1, < 2.4.5; >= 3.0.0, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-75975 · GHSA-f65p-4m7j-42xc
- High, CVSS 7.5
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.4.1, < 2.4.5; >= 3.1.2, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-75899 · GHSA-fph4-wmhf-6fwf
- High, CVSS 7.5
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.3.1, < 2.4.5; >= 3.0.0, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-76172 · GHSA-jqff-g426-hqxp
- High, CVSS 8.7
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-62388 · GHSA-p3m8-78j2-g5p3 · amended
- High, CVSS 7.5
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
PyPI mistune · Upgrade to 3.3.3 or later · >= 3.3.0, < 3.3.3 · CVE-2026-76098 · GHSA-6m44-fpc8-c3rq
- High, CVSS 7.1
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
npm apostrophe · Upgrade to 4.32.1 or later · < 4.32.1 · CVE-2026-71553 · GHSA-vmg4-6gfg-83qx · amended
- High, CVSS 7.1
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
npm orval · Upgrade to 8.22.0 or later · < 8.22.0 · CVE-2026-62680 · GHSA-cxq5-97v7-87j8
- Critical, CVSS 9.3
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72716 · GHSA-p4cg-3328-rvfg · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71866 · GHSA-6mr6-jvcr-2f25 · amended
- Critical, CVSS 9.8
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171108-5e8f99f40a8a (pre-release) or later · < 0.0.0-20260512171108-5e8f99f40a8a · CVE-2026-72920 · GHSA-2v6v-25fm-p4fg · amended
- High, CVSS 8.7
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Packagist getgrav/grav · Upgrade to 2.0.7 or later · < 2.0.7 · CVE-2026-64850 · GHSA-fj2p-qj2f-74v5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.