Critical, CVSS 9.3
amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection
PyPI redshift-connector · Upgrade to 2.1.14 or later · <= 2.1.13 · CVE-2026-8838 · GHSA-29h4-r29x-hchv · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 87 matching · newest first
- Unrated
uv is vulnerable to arbitrary file write through entry point names
crates.io uv +1 · Upgrade all 2 to 0.11.15 or later · < 0.11.15 · CVE-2026-114109 · GHSA-4gg8-gxpx-9rph · amended
- Unrated
AgenticMail API/storage and outbound relay hardening fixes
npm @agenticmail/api · Upgrade to 0.9.32 or later · <= 0.9.31 · +1 more package · CVE-2026-47255 · GHSA-wjjv-3mj2-39hf · amended
- Medium, CVSS 6.9
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers
npm parse-server · Upgrade to 9.9.1-alpha.2 (pre-release) or 8.6.78 by release line · >= 9.0.0, < 9.9.1-alpha.2; < 8.6.78 · CVE-2026-47248 · GHSA-8cph-rgr4-g5vj · amended
- Unrated
tar has a PAX header desynchronization issue
crates.io tar · Upgrade to 0.4.46 or later · <= 0.4.45 · GHSA-3pv8-6f4r-ffg2
- Medium, CVSS 6.9
astral-tokio-tar has a PAX Header Desynchronization issue
crates.io astral-tokio-tar · Upgrade to 0.6.2 or later · <= 0.6.1 · GHSA-3cv2-h65g-fgmm
- Medium, CVSS 5.5
CAPM3 vulnerable to Cross-Namespace resource access
Go github.com/metal3-io/cluster-api-provider-metal3 · Upgrade to 1.12.5 or 1.11.8 by release line · <= 1.11.7; >= 1.12.0, <= 1.12.4 · GHSA-rf84-wr5g-m3rp
- High, CVSS 8.7
xiaomusic contains an unauthenticated path traversal vulnerability
PyPI xiaomusic · Upgrade to 0.5.8 or later · < 0.5.8 · CVE-2026-10108 · GHSA-5j8p-5rrj-8wjg · amended
- Medium, CVSS 4.4
IPAM controller service account granted unnecessary full access to Secrets
Go github.com/metal3-io/ip-address-manager · Upgrade to 1.12.4 or 1.11.7 by release line · <= 1.11.6; >= 1.12.0, <= 1.12.3 · CVE-2026-47190 · GHSA-49pm-43hf-6xfq
- Medium, CVSS 4.3
Ironic Standalone Operator's controller modifies user-owned resources without consent
Go github.com/metal3-io/ironic-standalone-operator · Upgrade to 0.8.2 or 0.7.3 by release line · <= 0.7.2; >= 0.8.0, <= 0.8.1 · GHSA-hfc8-w5f4-3x6m
- Medium, CVSS 4.3
Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces
Go github.com/metal3-io/ironic-standalone-operator · Upgrade to 0.9.0 or later · < 0.9.0 · GHSA-7cwm-fpfh-rrch
- Medium, CVSS 4.6
NodeVM observability builtins leak host process and HTTP request data
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47141 · GHSA-9g8x-92q2-p28f · amended
- High, CVSS 8.6
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47139 · GHSA-r9pm-gxmw-wv6p · amended
- Critical, CVSS 10.0
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47140 · GHSA-rp36-8xq3-r6c4 · amended
- High, CVSS 7.7
ExifReader is vulnerable to denial of service via crafted ICC
mluctagnpm exifreader · Upgrade to 4.39.0 or later · >= 2.10.0, < 4.39.0 · CVE-2026-8813 · GHSA-h64w-w9pr-82m4 · amended
- Medium, CVSS 5.5
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata
npm exifreader · Upgrade to 4.39.0 or later · >= 4.20.0, < 4.39.0 · CVE-2026-8814 · GHSA-rr89-w3h9-m66j · amended
- Critical, CVSS 9.8
vm2 sandbox escape via JSPI-backed Promise
.finally()species bypassnpm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47210 · GHSA-6j2x-vhqr-qr7q · amended
- Critical, CVSS 10.0
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47137 · GHSA-m4wx-m65x-ghrr · amended
- High, CVSS 8.6
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47209 · GHSA-c4cf-2hgv-2qv6 · amended
- High, CVSS 8.7
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47135 · GHSA-m5q2-4fm3-vfqp · amended
- Critical, CVSS 10.0
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47208 · GHSA-76w7-j9cq-rx2j · amended
- Low, CVSS 2.1
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-92962 · GHSA-q3fm-4wcw-g57x · amended
- Critical, CVSS 10.0
vm2 has a Sandbox Escape issue
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47131 · GHSA-v6mx-mf47-r5wg · amended
- Medium, CVSS 6.3
Nuxt's route middleware is not enforced when rendering
.server.vuepages via/__nuxt_island/page_*npm nuxt +1 · Upgrade all 2 to 4.4.6 or 3.21.6 by release line · >= 3.11.0, <= 3.21.5; >= 4.0.0-alpha.1, <= 4.4.5 · CVE-2026-47200 · GHSA-hg3f-28rg-4jxj · amended
- High, CVSS 7.5
Gotenberg has a Race Condition via Multipart
downloadFromHandlingGo github.com/gotenberg/gotenberg/v8 · Upgrade to 8.33.0 or later · >= 8.10.0, <= 8.32.0 · CVE-2026-45742 · GHSA-vp73-vjw8-8f32
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.