High, CVSS 7.7
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via allow_private
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.7.2 or later · >= 0.6.0, <= 0.7.1 · GHSA-7rx3-5wx3-5v76
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via
- High, CVSS 8.1
nebula-mesh: Certificate revocation is never enforced at the mesh
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.7.1 or later · < 0.7.1 · CVE-2026-61699 · GHSA-cm26-5974-52h8
- High, CVSS 7.1
nebula-mesh: Operator session tokens stored in plaintext in the database
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.3.8 or later · <= 0.3.7 · CVE-2026-53603 · GHSA-q4vm-pq3q-8wgq
- High, CVSS 7.5
Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
Maven io.netty:netty-codec-stomp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Alpha1, <= 4.2.15.Final; <= 4.1.135.Final · CVE-2026-44891 · GHSA-vhch-2wf3-m8rp
- High, CVSS 8.7
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.3.8 or later · <= 0.3.7 · CVE-2026-53604 · GHSA-2p2f-px33-4vv5
- High, CVSS 7.6
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
Packagist easycorp/easyadmin-bundle · Upgrade to 5.0.13 or later · >= 5.0.0, < 5.0.13 · CVE-2026-54087 · GHSA-8559-gwj3-q37r
- High, CVSS 7.7
yutu: Arbitrary File Write via MCP
caption-downloadToolGo github.com/eat-pray-ai/yutu · Upgrade to 0.10.9-dev1 (pre-release) or later · < 0.10.9-dev1 · CVE-2026-50158 · GHSA-2c7f-fxww-6w6c
- Critical, CVSS 9.9
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
npm n8n-mcp · Upgrade to 2.56.1 or later · <= 2.56.0 · CVE-2026-54052 · GHSA-j6r7-6fhx-77wx · amended
- High, CVSS 7.1
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
Go go.woodpecker-ci.org/woodpecker/v3 · Upgrade to 3.14.1 or later · >= 3.0.0, < 3.14.1 · CVE-2026-50141 · GHSA-g7mm-9vx7-jm7h
- High, CVSS 8.6
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
npm @fedify/fedify · Upgrade to 2.2.4, 2.1.15, 2.0.19 or 2 more by release line · >= 0.11.2, < 1.9.12; >= 1.10.0, < 1.10.11; >= 2.0.0, < 2.0.19; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.4 · +1 more package · CVE-2026-50131 · GHSA-xw9q-2mv6-9fr8 · amended
- High, CVSS 7.5
MKP: Unbounded Pod Log Read via Attacker-Controlled
limitBytes/tailLinesCauses Memory ExhaustionGo github.com/StacklokLabs/mkp · Upgrade to 0.4.1 or later · < 0.4.1 · CVE-2026-50125 · GHSA-qw5r-ppcg-f8rj
- High, CVSS 7.5
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Go github.com/SpectoLabs/hoverfly · Upgrade to 1.12.8 or later · <= 1.12.7 · CVE-2026-50013 · GHSA-qrh4-p6v4-mrfg
- High, CVSS 8.0
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
Packagist facturascripts/facturascripts · Upgrade to 2026.2 or later · < 2026.2 · CVE-2026-45263 · GHSA-2p5x-4jr6-x5jg · amended
- Critical, CVSS 9.9
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in
Where::sqlColumnPackagist facturascripts/facturascripts · Upgrade to 2026.2 or later · < 2026.2 · CVE-2026-45262 · GHSA-5qmh-x653-g8qj · amended
- High, CVSS 8.8
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
Go github.com/opencost/opencost · Upgrade to 1.119.1 or later · < 1.119.1 · CVE-2026-44300 · GHSA-wmj8-9953-vff5
- High, CVSS 8.3
Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities
PyPI snowflake-sqlalchemy · Upgrade to 1.11.0 or later · >= 1.1.6, < 1.11.0 · CVE-2026-15736 · GHSA-8g6f-qw9x-4q6q · amended
- Critical, CVSS 9.1
SAP Approuter Vulnerable to HTTP Request Smuggling
npm @sap/approuter · Upgrade to 20.10.0 or later · < 20.10.0 · CVE-2026-27690 · GHSA-8m85-wqg7-c529 · amended
- High, CVSS 8.1
SAP Approuter has an Open Redirect vulnerability
npm @sap/approuter · Upgrade to 21.2.0 or later · < 21.2.0 · CVE-2026-44745 · GHSA-44p5-3m5g-vfhj · amended
- High, CVSS 7.1
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP
Packagist kimai/kimai · Upgrade to 2.59.0 or later · < 2.59.0 · CVE-2026-52827 · GHSA-v8hx-4vx8-wc96
- High, CVSS 8.3
crewai-tools SSRF redirect bypass exposes internal services
PyPI crewai-tools · Upgrade to 1.15.1 or later · < 1.15.1 · CVE-2026-62240 · GHSA-mr4r-hcgx-8p4h · amended
- Critical, CVSS 9.1
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-52824 · GHSA-jr9p-4h4j-6c58
- High, CVSS 7.5
json_repair: Circular JSON Schema
$refcauses unbounded CPU DoSPyPI json-repair · Upgrade to 0.60.1 or later · < 0.60.1 · GHSA-xf7x-x43h-rpqh · amended
- Critical, CVSS 9.3
FacturaScripts: Account takeover of any 2FA-enabled user
Packagist facturascripts/facturascripts · Upgrade to 2026.3 or later · <= 2026.2 · CVE-2026-47677 · GHSA-c67f-gmxw-mj93
- High, CVSS 8.7
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
Packagist plank/laravel-mediable · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-49970 · GHSA-xv8g-76mx-2rxc
- High, CVSS 8.5
DIRAC: SQL injection and lack of access control in PilotManager service
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · GHSA-7xw9-549r-8jrc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.