High, CVSS 7.1
Kirby: File upload permissions are not checked during processing of chunk data
Packagist getkirby/cms · Upgrade to 5.5.2 or later · >= 5.0.0, < 5.5.2 · CVE-2026-71415 · GHSA-67mx-6wf2-92xp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · <= 4.9.4; >= 5.0.0, < 5.5.2 · CVE-2026-75594 · GHSA-9vx2-j98c-p72w · amended
- High, CVSS 7.5
Socket.IO: Engine.IO WebTransport SID DoS
npm engine.io · Upgrade to 6.6.7 or later · >= 6.5.0, < 6.6.7 · CVE-2026-59724 · GHSA-gr94-w7qr-f4j3
- High, CVSS 8.6
elFinder: SSRF protection bypass via DNS rebinding in the
fsock_get_contents()fallbackPackagist studio-42/elfinder · Upgrade to 2.1.70 or later · <= 2.1.69 · CVE-2026-81889 · GHSA-8x3q-jpjh-qh5c · amended
- High, CVSS 7.3
zbus_polkit: authorization bypass via PID reusecrates.io zbus_polkit · Upgrade to 5.1.0 or later · >= 0.0.0-0, < 5.1.0 · CVE-2026-78422 · amended
- High, CVSS 8.3
RestrictedPython guard hooks can be shadowed via positional-only arguments
PyPI restrictedpython · Upgrade to 8.3 or later · <= 8.2 · CVE-2026-55830 · GHSA-ffg3-p8fm-mjx2
- High, CVSS 7.0
Snipe-IT has an Improper Privilege Management issue
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-55843 · GHSA-j5g3-42wp-gqm3
- High, CVSS 8.6
MapFish Print has XXE that allows reading arbitrary files of certain types
Maven org.mapfish:print.print-servlet · Upgrade to 3.28.30 or later · >= 3.0.0, < 3.28.30 · +2 more packages · CVE-2026-55848 · GHSA-5v29-34h8-v68r · amended
- High, CVSS 7.7
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260612000715-b44cf51fe931 (pre-release) or later · < 0.0.0-20260612000715-b44cf51fe931 · CVE-2026-55874 · GHSA-56wq-x3wv-3ff4 · amended
- High, CVSS 7.5
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
Maven org.graylog2:graylog2-server · Upgrade to 7.1.2, 7.0.7 or 6.3.12 by release line · < 6.3.12; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.2 · CVE-2026-55841 · GHSA-gqr6-r77p-c2pj · amended
- High, CVSS 8.7
klever-go: SFT add-quantity
int64overflow bypasses a finite per-nonce MaxSupplyGo github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-55764 · GHSA-mrpp-v6pg-p54x · amended
- High, CVSS 7.1
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
Go github.com/portainer/portainer · Upgrade to 2.43.0 or 2.39.4 by release line · >= 2.39.0, < 2.39.4; >= 2.40.0, < 2.43.0 · CVE-2026-55761 · GHSA-x626-fcwx-f5pc · amended
- High, CVSS 8.7
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
Go github.com/klever-io/klever-go · Upgrade to 1.7.19-rc4 (pre-release) or later · <= 1.7.19-rc2 · CVE-2026-55763 · GHSA-v358-wf77-39xv · amended
- High, CVSS 7.5
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
Go github.com/guno1928/alos-http · Upgrade to 0.0.0-20260617230736-314b6783e196 (pre-release) or later · < 0.0.0-20260617230736-314b6783e196 · CVE-2026-55484 · GHSA-hr6j-w4mw-g9mj · amended
- Critical, CVSS 9.9
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · <= 12.3.9; >= 2026.1.0, <= 2026.1.5 · CVE-2026-55634 · GHSA-9x44-4gxf-8c25 · amended
- Critical, CVSS 9.3
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · >= 2026.1.0, <= 2026.1.5; <= 12.3.9 · CVE-2026-55220 · GHSA-w23p-wrp7-ch38 · amended
- High, CVSS 7.1
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or later · < 2026.1.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55212 · GHSA-f97c-ph8j-8vff
- High, CVSS 7.7
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or 2025.4.6 by release line · < 2025.4.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55208 · GHSA-79cw-hfcc-7mw9 · amended
- High, CVSS 8.8
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or 2025.4.6 by release line · < 2025.4.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55207 · GHSA-h854-c3m3-mh5v · amended
- High, CVSS 7.5
MariaDB's connector leaks the cleartext password to an MitM despite
ssl: truenpm mariadb · Upgrade to 3.5.3, 3.4.6, 3.3.3 or 3.2.4 by release line · < 3.2.4; >= 3.3.0, < 3.3.3; >= 3.4.0, < 3.4.6; >= 3.5.0, < 3.5.3 · CVE-2026-55215 · GHSA-cqhc-2h57-wpxf
- Critical, CVSS 9.1
plone.app.event vulnerable to denial of service via iCalendar import
PyPI plone-app-event · Upgrade to 6.0.1 or 5.2.4 by release line · < 5.2.4; >= 6.0.0a1, < 6.0.1 · CVE-2026-55247 · GHSA-r82h-mqw3-fc56 · amended
- High, CVSS 8.1
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
PyPI weblate · Upgrade to 2026.7 or later · < 2026.7 · CVE-2026-55228 · GHSA-2q2q-jr9g-v9rf
- High, CVSS 7.1
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
PyPI protego · Upgrade to 0.6.2 or later · <= 0.6.1 · CVE-2026-55520 · GHSA-wjmf-p669-5m5p
- Critical, CVSS 9.1
plone.app.portlets vulnerable to denial of service via RSS feed portlet
PyPI plone-app-portlets · Upgrade to 7.0.2, 6.0.4 or 5.0.8 by release line · >= 7.0.0, <= 7.0.1; >= 6.0.0, < 6.0.4; < 5.0.8 · CVE-2026-55248 · GHSA-x5g3-w747-2h8q · amended
- High, CVSS 7.1
PowSyBl Core has Command Injection in LocalCommandExecutor-s
Maven com.powsybl:powsybl-computation-local · Upgrade to 7.2.2 or later · <= 7.2.1 · CVE-2026-55673 · GHSA-jqvf-j3ww-r8c7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.