High, CVSS 7.0
MLFlow Creates a Temporary File With Insecure Permissions
PyPI mlflow · Upgrade to 3.11.0 or later · >= 1.26.0, < 3.11.0 · CVE-2026-4137 · GHSA-f2m9-wcf4-cwwx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 96 matching · newest first
- Medium, CVSS 4.6
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links
npm @steipete/summarize · Upgrade to 0.15.1 or later · < 0.15.1 · CVE-2026-45245 · GHSA-2r69-qgv3-hr65 · amended
- Low, CVSS 2.1
Summarize contains a missing authorization vulnerability
npm @steipete/summarize · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2026-45244 · GHSA-67gq-6q8c-qqh6 · amended
- High, CVSS 7.1
Summarize contains a path traversal vulnerability
npm @steipete/summarize · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2026-45242 · GHSA-8jr4-6r33-phwm · amended
- Medium, CVSS 5.3
Summarize contains a missing authorization vulnerability
npm @steipete/summarize · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2026-45243 · GHSA-5624-2pmv-jx46 · amended
- Medium, CVSS 4.0
ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46559 · GHSA-533m-3wf6-c33v
- Medium, CVSS 6.2
ImageMagick: Stack overflow in fx operation
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46557 · GHSA-rcr6-g7jc-f57g
- Medium, CVSS 6.2
ImageMagick: Use-After-Free in MSL decoder.
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46523 · GHSA-5r4x-w6p5-222q
- High, CVSS 7.5
ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46522 · GHSA-7gg8-qqx7-92g5
- Medium, CVSS 5.5
ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46521 · GHSA-jcqp-6r6f-3mfx
- High, CVSS 7.5
ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46520 · GHSA-36wm-hprc-mcf5
- Medium, CVSS 5.3
ImageMagick: Policy Bypass in MNG coder could
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-45664 · GHSA-g5mf-wqq5-vwg6
- Medium, CVSS 5.1
ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-45624 · GHSA-pfvh-m9xv-8966
- High, CVSS 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +7 · Upgrade all 8 to 6.9.7 or later · <= 6.9.6 · CVE-2026-45367 · GHSA-3653-68v6-rq57
- Medium, CVSS 5.3
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
PyPI nicegui · Upgrade to 3.12.0 or later · <= 3.11.1 · CVE-2026-45554 · GHSA-pq7c-x8g4-rvp6 · amended
- High, CVSS 7.5
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
PyPI nicegui · Upgrade to 3.12.0 or later · <= 3.11.1 · CVE-2026-45553 · GHSA-jfrm-rx66-g536 · amended
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · >= 0.7.0, < 0.9.0 · CVE-2026-45686 · GHSA-43g7-cwr8-q3jh
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45685 · GHSA-j8p6-96vp-f3r9
- Medium, CVSS 4.9
OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · >= 0.7.0, < 0.9.0 · CVE-2026-45684 · GHSA-vvmg-8mjr-g6q3
- Medium, CVSS 5.1
OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45682 · GHSA-962q-hwm5-52x5
- Low, CVSS 3.8
OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45683 · GHSA-fjq3-ffvr-vm46
- Medium, CVSS 5.9
OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45681 · GHSA-r6c9-g6q5-qrf9
- Medium, CVSS 5.9
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45680 · GHSA-89c6-vpcj-7vj4
- High, CVSS 7.3
Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-35433 · GHSA-8x9c-mqxv-q2pp
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-42899 · GHSA-9v76-4qcc-frgh
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.