High, CVSS 8.7
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
Go github.com/klever-io/klever-go · Upgrade to 1.7.19-rc4 (pre-release) or later · <= 1.7.19-rc2 · CVE-2026-55763 · GHSA-v358-wf77-39xv · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2401–2425 of 30,910 matching · newest first
- Unrated
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
Packagist privatebin/privatebin · Upgrade to 2.0.5 or later · <= 2.0.4 · CVE-2026-55891 · GHSA-xrjc-c68j-hp7w · amended
- Medium, CVSS 4.3
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Packagist privatebin/privatebin · Upgrade to 2.0.5 or later · <= 2.0.4 · CVE-2026-55696 · GHSA-f2xf-7x3g-4272 · amended
- Medium, CVSS 6.9
AIIR verification and policy gates could report success without enforcing the control (fail-open)
PyPI aiir · Upgrade to 1.7.0 or later · < 1.7.0 · GHSA-73p9-6hrp-8qhr
- High, CVSS 7.5
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
Go github.com/guno1928/alos-http · Upgrade to 0.0.0-20260617230736-314b6783e196 (pre-release) or later · < 0.0.0-20260617230736-314b6783e196 · CVE-2026-55484 · GHSA-hr6j-w4mw-g9mj · amended
- Critical, CVSS 9.9
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · <= 12.3.9; >= 2026.1.0, <= 2026.1.5 · CVE-2026-55634 · GHSA-9x44-4gxf-8c25 · amended
- Critical, CVSS 9.3
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Packagist pimcore/pimcore · Upgrade to 2026.1.6 or 12.3.10 by release line · >= 2026.1.0, <= 2026.1.5; <= 12.3.9 · CVE-2026-55220 · GHSA-w23p-wrp7-ch38 · amended
- High, CVSS 7.1
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or later · < 2026.1.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55212 · GHSA-f97c-ph8j-8vff
- High, CVSS 7.7
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or 2025.4.6 by release line · < 2025.4.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55208 · GHSA-79cw-hfcc-7mw9 · amended
- High, CVSS 8.8
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
Packagist pimcore/studio-backend-bundle · Upgrade to 2026.1.6 or 2025.4.6 by release line · < 2025.4.6; >= 2026.1.0, < 2026.1.6 · CVE-2026-55207 · GHSA-h854-c3m3-mh5v · amended
- High, CVSS 7.5
MariaDB's connector leaks the cleartext password to an MitM despite
ssl: truenpm mariadb · Upgrade to 3.5.3, 3.4.6, 3.3.3 or 3.2.4 by release line · < 3.2.4; >= 3.3.0, < 3.3.3; >= 3.4.0, < 3.4.6; >= 3.5.0, < 3.5.3 · CVE-2026-55215 · GHSA-cqhc-2h57-wpxf
- Critical, CVSS 9.1
plone.app.event vulnerable to denial of service via iCalendar import
PyPI plone-app-event · Upgrade to 6.0.1 or 5.2.4 by release line · < 5.2.4; >= 6.0.0a1, < 6.0.1 · CVE-2026-55247 · GHSA-r82h-mqw3-fc56 · amended
- High, CVSS 8.1
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
PyPI weblate · Upgrade to 2026.7 or later · < 2026.7 · CVE-2026-55228 · GHSA-2q2q-jr9g-v9rf
- Medium, CVSS 4.3
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
PyPI weblate · Upgrade to 2026.7 or later · < 2026.7 · CVE-2026-55227 · GHSA-2p9g-x3cv-5hh4
- High, CVSS 7.1
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
PyPI protego · Upgrade to 0.6.2 or later · <= 0.6.1 · CVE-2026-55520 · GHSA-wjmf-p669-5m5p
- Critical, CVSS 9.1
plone.app.portlets vulnerable to denial of service via RSS feed portlet
PyPI plone-app-portlets · Upgrade to 7.0.2, 6.0.4 or 5.0.8 by release line · >= 7.0.0, <= 7.0.1; >= 6.0.0, < 6.0.4; < 5.0.8 · CVE-2026-55248 · GHSA-x5g3-w747-2h8q · amended
- High, CVSS 7.1
PowSyBl Core has Command Injection in LocalCommandExecutor-s
Maven com.powsybl:powsybl-computation-local · Upgrade to 7.2.2 or later · <= 7.2.1 · CVE-2026-55673 · GHSA-jqvf-j3ww-r8c7 · amended
- High, CVSS 7.5
Spinnaker: Improper yaml processing on kustomize bake operations
Maven io.spinnaker.rosco:rosco-manifests · Upgrade to 2026.1.1, 2026.0.3, 2025.4.4 or 2025.3.4 by release line · < 2025.3.4; >= 2025.4.0, < 2025.4.4; >= 2026.0.0, < 2026.0.3; >= 2026.1.0, < 2026.1.1 · CVE-2026-55175 · GHSA-p68j-q7hf-3qcp
- Medium, CVSS 6.3
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
crates.io buffa · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-55407 · GHSA-f9qc-qg88-7pq5 · amended
- Medium, CVSS 5.9
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
crates.io buffa · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-55406 · GHSA-9pwq-gcrx-wghh · amended
- High, CVSS 8.2
9router: Unauthenticated
/v1proxy access viaHost-header spoofing → open AI relay + SSRFnpm 9router · Upgrade to 0.5.2 or later · < 0.5.2 · CVE-2026-55641 · GHSA-86m2-fcxq-5q7c
- High, CVSS 8.6
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass
npm 9router · Upgrade to 0.5.2 or later · < 0.5.2 · CVE-2026-55638 · GHSA-8gmq-j984-vp4r
- High, CVSS 7.5
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Packagist phpsysinfo/phpsysinfo · Upgrade to 3.4.6 or later · <= 3.4.5 · CVE-2026-55584 · GHSA-786w-p5pm-cvgh · amended
- High, CVSS 8.7
Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
Go github.com/maximhq/bifrost/core · Upgrade to 1.5.17 or later · < 1.5.17 · CVE-2026-55245 · GHSA-w98g-5w9p-p3rc · amended
- Low, CVSS 2.0
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
Go oras.land/oras · Upgrade to 1.3.3 or later · < 1.3.3 · CVE-2026-55588 · GHSA-298f-872v-2rcx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.