Critical, CVSS 9.1
GlassFish's Administration Console is Vulnerable to RCE
Maven org.glassfish.jsftemplating:jsftemplating · Upgrade to 4.2.0 or later · < 4.2.0 · +1 more package · CVE-2026-2586 · GHSA-96v6-hq43-x9h4
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering
Maven org.apache.camel:camel-cxf-rest · Upgrade to 4.18.2 or 4.14.6 by release line · >= 3.18.0, < 4.14.6; >= 4.15.0, < 4.18.2 · CVE-2026-47323 · GHSA-8364-hfqj-pwm6
- High, CVSS 8.7
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.0 or later · <= 25.0.0 · CVE-2026-46511 · GHSA-x3x5-7h4h-gwxg · amended
- High, CVSS 8.6
Stored XSS via in HAX CMS allows access to sensitive client-side data and account takeover
npm @haxtheweb/iframe-loader +2 · Upgrade all 3 to 26.0.0 or later · <= 25.0.0 · CVE-2026-46396 · GHSA-jh3h-rpxg-fr36 · amended
- Critical, CVSS 9.3
HAXcms: Private Key Disclosure via Broken HMAC Implementation
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.0 or later · <= 25.0.0 · CVE-2026-46395 · GHSA-6c8g-9hfh-pq5h · amended
- High, CVSS 8.7
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
npm @haxtheweb/open-apis · Upgrade to 26.0.0 or later · < 26.0.0 · CVE-2026-46391 · GHSA-4fg7-f244-3j49 · amended
- High, CVSS 7.1
HAXcms createSite SSRF Enables Arbitrary File Read
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.0 or later · <= 25.0.0 · CVE-2026-46393 · GHSA-q862-gcgq-5m6g · amended
- Critical, CVSS 9.0
Algernon: handler.lua discovery walks parent directories above the server root
Go github.com/xyproto/algernon · Upgrade to 1.17.7 or later · <= 1.17.6 · CVE-2026-45721 · GHSA-xwcr-wm99-g9jc
- High, CVSS 7.5
Algernon: Single-file mode unconditionally enables debug mode
Go github.com/xyproto/algernon · Upgrade to 1.17.7 or later · <= 1.17.6 · CVE-2026-45728 · GHSA-fwqx-8365-9983
- High, CVSS 8.7
Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString
NuGet scriban +1 · Upgrade all 2 to 7.2.0 or later · <= 7.1.0 · GHSA-24c8-4792-22hx
- High, CVSS 8.1
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7504 · GHSA-rp95-xpg9-c2cq
- High, CVSS 7.1
Keycloak: Access token disclosure and implicit flow bypass via forged client data
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7571 · GHSA-hq3p-w4xv-x7vp
- High, CVSS 7.5
Keycloak: Session fixation in OIDC login flow that can lead to account takeover
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7507 · GHSA-hf67-5vvq-fm3r
- High, CVSS 7.5
Keycloak: Denial of Service via specially crafted SAML input
Maven org.keycloak:keycloak-saml-core · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7307 · GHSA-p5mv-gj8j-xqgf
- High, CVSS 8.2
TYPO3 SQL Injection in extension "Address List" (tt_address)
Packagist friendsoftypo3/tt-address · Upgrade to 10.0.1, 9.1.1 or 8.1.2 by release line · >= 10.0.0, < 10.0.1; >= 9.0.0, < 9.1.1; < 8.1.2 · CVE-2026-8827 · GHSA-3h52-6v6j-6wwv
- Critical, CVSS 9.2
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
Packagist mmc/ceselector · Upgrade to 6.0.1, 5.0.1, 4.0.2 or 3.0.3 by release line · >= 6.0.0, < 6.0.1; >= 5.0.0, < 5.0.1; >= 4.0.0, < 4.0.2; < 3.0.3 · CVE-2026-46725 · GHSA-8x3j-439w-537c
- High, CVSS 7.1
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
Packagist tomasnorre/crawler · Upgrade to 12.0.11 or 11.0.13 by release line · >= 12.0.0, < 12.0.11; < 11.0.13 · CVE-2026-8727 · GHSA-jr8m-x4p7-p3v5
- High, CVSS 8.2
georgringer/news has SQL Injection in extension "News system" (news)
Packagist georgringer/news · Upgrade to 14.0.3, 13.0.2, 12.3.2 or 2 more by release line · >= 12.0.0, < 12.3.2; >= 13.0.0, < 13.0.2; >= 14.0.0, < 14.0.3; < 10.0.4; >= 11.0.0, < 11.4.4 · CVE-2026-8726 · GHSA-g868-j3qm-4j28
- Critical, CVSS 9.6
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
PyPI mlflow · Upgrade to 3.10.0 or later · >= 3.9.0, <= 3.9.0 · CVE-2026-2611 · GHSA-67c5-x5mf-rppq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.