High, CVSS 8.2
Gitea has insufficient permission checks for Composer package source links
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · <= 1.26.1 · CVE-2026-27771 · GHSA-8qw8-rq86-9pc2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.4
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
PyPI meta-ads-mcp · Upgrade to 1.0.115 or later · < 1.0.115 · CVE-2026-54547 · GHSA-2v2f-mvfg-ph56 · amended
- High, CVSS 8.3
meta-ads-mcp: Server-Side Request Forgery (SSRF) in
upload_ad_imagevia Unrestrictedimage_urlFetchPyPI meta-ads-mcp · Upgrade to 1.0.115 or later · < 1.0.115 · CVE-2026-54549 · GHSA-45gf-fjxp-cjpq · amended
- High, CVSS 7.9
sh _uid does not drop supplementary groups (incomplete privilege drop)
PyPI sh · Upgrade to 2.2.4 or later · < 2.2.4 · CVE-2026-54552 · GHSA-q38v-wp89-2w55 · amended
- High, CVSS 8.6
AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Maven software.amazon.jdbc:aws-advanced-jdbc-wrapper · Upgrade to 4.0.1 or later · >= 3.0.0, < 4.0.1 · CVE-2026-11400 · GHSA-mhww-p97m-3368
- High, CVSS 8.7
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
PyPI vllm · Upgrade to 0.24.0 or later · < 0.24.0 · CVE-2026-55574 · GHSA-rwxx-mrjm-wc2m · amended
- High, CVSS 7.5
vLLM has Remote DoS via Invalid Recovered Token Reinjection
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.17.1, < 0.24.0 · CVE-2026-54234 · GHSA-8wr5-jm2h-8r4f · amended
- High, CVSS 7.1
Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema
npm @genql/cli · Upgrade to 6.3.4 or later · < 6.3.4 · CVE-2026-63397 · GHSA-w757-xvvv-vgfw · amended
- High, CVSS 7.1
ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization
Maven com.arcadedb:arcadedb-server · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-x8mg-6r4p-87pf
- High, CVSS 8.7
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-vwjc-v7x7-cm6g
- High, CVSS 8.6
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-x9f9-r4m8-9xc2
- High, CVSS 7.6
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
PyPI mcp · Upgrade to 1.28.1 or later · < 1.28.1 · CVE-2026-59950 · GHSA-vj7q-gjh5-988w · amended
- High, CVSS 7.7
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
Maven com.arcadedb:arcadedb-server · Upgrade to 26.7.1 or later · < 26.7.1 · GHSA-48qw-824m-86pr
- Critical, CVSS 9.8
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Packagist pheditor/pheditor · Upgrade to 2.0.6 or later · >= 2.0.1, < 2.0.6 · CVE-2026-55579 · GHSA-p4h7-p9rj-2pq2
- High, CVSS 8.8
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Packagist pheditor/pheditor · Upgrade to 2.0.6 or later · >= 2.0.1, < 2.0.6 · CVE-2026-55578 · GHSA-wg4w-wr5q-6vjc
- High, CVSS 8.1
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.6.1 or later · < 26.6.1 · CVE-2026-54076 · GHSA-vg6x-6pg9-6qwg
- High, CVSS 7.1
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.6.1 or later · < 26.6.1 · CVE-2026-54077 · GHSA-8w86-m9h8-hvqg
- High, CVSS 8.8
Pheditor has an authenticated terminal command whitelist bypass
Packagist pheditor/pheditor · Upgrade to 2.0.5 or later · <= 2.0.4 · CVE-2026-54540 · GHSA-9643-6xjp-vx57
- High, CVSS 7.1
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
PyPI mcp · Upgrade to 1.27.2 or later · <= 1.27.1 · CVE-2026-52869 · GHSA-jpw9-pfvf-9f58 · amended
- High, CVSS 7.6
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
PyPI mcp · Upgrade to 1.27.2 or later · >= 1.23.0, <= 1.27.1 · CVE-2026-52870 · GHSA-hvrp-rf83-w775 · amended
- High, CVSS 8.0
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
Go github.com/nuclio/nuclio · Upgrade to 1.16.5 or later · < 1.16.5 · CVE-2026-52833 · GHSA-3v79-m2cg-89ww
- High, CVSS 7.4
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53714 · GHSA-22xc-xg2r-9j7v
- Critical, CVSS 9.1
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53713 · GHSA-wcrf-9vrr-854f
- Critical, CVSS 9.2
Snowflake Connector for Python improperly verifies TLS hostnames
PyPI snowflake-connector-python · Upgrade to 4.7.1 or 3.18.1 by release line · < 3.18.1; >= 4.0.0, < 4.7.1 · CVE-2026-15925 · GHSA-5cc2-282f-jjq2 · amended
- High, CVSS 8.8
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
npm @andrea9293/mcp-documentation-server · Upgrade to 1.13.1 or later · >= 1.13.0, <= 1.13.0 · CVE-2026-54504 · GHSA-6f5r-5672-72j7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.