Low, CVSS 3.5
MCP Registry: OCI validator skips ownership check on upstream rate limits
Go github.com/modelcontextprotocol/registry · Upgrade to 1.7.9 or later · < 1.7.9 · CVE-2026-45781 · GHSA-2v5f-5r6w-p67r
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 85 matching · newest first
- High, CVSS 7.3
ModelScope is vulnerable to arbitrary code injection via a crafted module
PyPI modelscope · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2025-51427 · GHSA-fhhq-h4hg-549x · amended
- Critical, CVSS 9.6
GlassFish's gadget handler is vulnerable to RCE
Maven org.glassfish.jsftemplating:jsftemplating · Upgrade to 4.2.0 or later · < 4.2.0 · +1 more package · CVE-2026-2587 · GHSA-29wv-cv7p-xjc2
- Critical, CVSS 9.1
GlassFish's Administration Console is Vulnerable to RCE
Maven org.glassfish.jsftemplating:jsftemplating · Upgrade to 4.2.0 or later · < 4.2.0 · +1 more package · CVE-2026-2586 · GHSA-96v6-hq43-x9h4
- Critical, CVSS 9.8
Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering
Maven org.apache.camel:camel-cxf-rest · Upgrade to 4.18.2 or 4.14.6 by release line · >= 3.18.0, < 4.14.6; >= 4.15.0, < 4.18.2 · CVE-2026-47323 · GHSA-8364-hfqj-pwm6
- High, CVSS 8.7
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.0 or later · <= 25.0.0 · CVE-2026-46511 · GHSA-x3x5-7h4h-gwxg · amended
- High, CVSS 8.6
Stored XSS via in HAX CMS allows access to sensitive client-side data and account takeover
npm @haxtheweb/iframe-loader +2 · Upgrade all 3 to 26.0.0 or later · <= 25.0.0 · CVE-2026-46396 · GHSA-jh3h-rpxg-fr36 · amended
- Critical, CVSS 9.3
HAXcms: Private Key Disclosure via Broken HMAC Implementation
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.0 or later · <= 25.0.0 · CVE-2026-46395 · GHSA-6c8g-9hfh-pq5h · amended
- High, CVSS 8.7
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
npm @haxtheweb/open-apis · Upgrade to 26.0.0 or later · < 26.0.0 · CVE-2026-46391 · GHSA-4fg7-f244-3j49 · amended
- Medium, CVSS 5.1
HAX CMS: Stored XSS via ' ' component allows arbitrary JavaScript execution and token theft
npm @haxtheweb/haxcms-nodejs +1 · Upgrade all 2 to 26.0.0 or later · <= 25.0.0 · CVE-2026-46496 · GHSA-2m6p-hm3w-6jm3 · amended
- High, CVSS 7.1
HAXcms createSite SSRF Enables Arbitrary File Read
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.0 or later · <= 25.0.0 · CVE-2026-46393 · GHSA-q862-gcgq-5m6g · amended
- Medium, CVSS 5.3
Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication
Go github.com/xyproto/algernon · Upgrade to 1.17.7 or later · <= 1.17.6 · GHSA-9v4j-7g44-qcqw
- Critical, CVSS 9.0
Algernon: handler.lua discovery walks parent directories above the server root
Go github.com/xyproto/algernon · Upgrade to 1.17.7 or later · <= 1.17.6 · CVE-2026-45721 · GHSA-xwcr-wm99-g9jc
- High, CVSS 7.5
Algernon: Single-file mode unconditionally enables debug mode
Go github.com/xyproto/algernon · Upgrade to 1.17.7 or later · <= 1.17.6 · CVE-2026-45728 · GHSA-fwqx-8365-9983
- High, CVSS 8.7
Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString
NuGet scriban +1 · Upgrade all 2 to 7.2.0 or later · <= 7.1.0 · GHSA-24c8-4792-22hx
- Medium, CVSS 6.9
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
PyPI idna · Upgrade to 3.15 or later · < 3.15 · CVE-2026-45409 · GHSA-65pc-fj4g-8rjx · amended
- High, CVSS 8.1
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7504 · GHSA-rp95-xpg9-c2cq
- High, CVSS 7.1
Keycloak: Access token disclosure and implicit flow bypass via forged client data
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7571 · GHSA-hq3p-w4xv-x7vp
- High, CVSS 7.5
Keycloak: Session fixation in OIDC login flow that can lead to account takeover
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7507 · GHSA-hf67-5vvq-fm3r
- Medium, CVSS 6.8
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-4630 · GHSA-c739-f6xw-6pv2
- High, CVSS 7.5
Keycloak: Denial of Service via specially crafted SAML input
Maven org.keycloak:keycloak-saml-core · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-7307 · GHSA-p5mv-gj8j-xqgf
- Medium, CVSS 6.8
Keycloak: Unauthorized account takeover via WebAuthn token replay
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-37982 · GHSA-w4p5-rfh6-cwrv
- Medium, CVSS 4.3
Keycloak Account Resources user lookup contains broken access control
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or 26.4.12 by release line · < 26.4.12; >= 26.5.0, < 26.6.2 · CVE-2026-37981 · GHSA-933f-rg6j-f46p
- Medium, CVSS 6.5
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Maven org.keycloak:keycloak-services · Upgrade to 26.6.2 or later · < 26.6.2 · CVE-2026-37979 · GHSA-4x37-hw65-52w8
- Medium, CVSS 5.9
TYPO3 ke_search path traversal from arbitrary table configuration input
Packagist tpwd/ke_search · Upgrade to 7.0.1, 6.6.1, 5.6.2 or 4.6.7 by release line · >= 7.0.0, < 7.0.1; >= 6.0.0, < 6.6.1; >= 5.0.0, < 5.6.2; < 4.6.7 · CVE-2026-46723 · GHSA-67j3-jmm3-32xc
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.