High, CVSS 8.1
praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47412 · GHSA-g8rr-7rj2-f627 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.3
praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47415 · GHSA-xwq8-frcg-77q8 · amended
- Critical, CVSS 9.6
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47413 · GHSA-8g2p-pqm3-fcfh · amended
- High, CVSS 8.1
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47417 · GHSA-cp4f-5m9r-5jc2 · amended
- High, CVSS 8.1
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47418 · GHSA-943m-6wx2-rc2j · amended
- Critical, CVSS 9.6
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
npm @vitest/browser · Upgrade to 5.0.0-beta.3 (pre-release) or 4.1.6 by release line · >= 4.0.17, < 4.1.6; >= 5.0.0-beta.0, < 5.0.0-beta.3 · CVE-2026-47428 · GHSA-2h32-95rg-cppp · amended
- Critical, CVSS 9.8
When Vitest UI server is listening, arbitrary file can be read and executed
npm vitest · Upgrade to 4.1.0 or 3.2.6 by release line · >= 4.0.0, < 4.1.0; < 3.2.6 · CVE-2026-47429 · GHSA-5xrq-8626-4rwp · amended
- High, CVSS 8.2
DOMPurify XSS via selectedcontent re-clone
npm dompurify · Upgrade to 3.4.5 or later · >= 3.4.4, <= 3.4.4 · CVE-2026-47423 · GHSA-87xg-pxx2-7hvx · amended
- High, CVSS 8.7
@agenticmail/mcp Missing Authentication for Critical Function
npm @agenticmail/mcp · Upgrade to 0.9.27 or later · < 0.9.27 · CVE-2026-50287 · GHSA-63gr-g7jc-v8rg · amended
- High, CVSS 7.1
Apache MINA SSHD bundle sshd-git has a path traversal vulnerability
Maven org.apache.sshd:sshd-git · Upgrade to 3.0.0-M4 (pre-release) or 2.18.0 by release line · < 2.18.0; >= 3.0.0-M1, < 3.0.0-M4 · CVE-2026-48827 · GHSA-mw4m-qhpg-j82m
- High, CVSS 8.8
Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args
PyPI apache-airflow-core · Upgrade to 3.2.2 or later · < 3.2.2 · CVE-2026-49298 · GHSA-5j6p-jrrm-6x94 · amended
- High, CVSS 8.8
Apache ActiveMQ has an Incorrect Default Permissions vulnerability
Maven org.apache.activemq:apache-activemq · Upgrade to 6.2.6 or 5.19.7 by release line · < 5.19.7; >= 6.0.0, < 6.2.6 · CVE-2026-49157 · GHSA-99qx-5qqr-4j95
- High, CVSS 7.5
Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer
Maven org.apache.fluss:fluss-common · Upgrade to 0.9.1-incubating (pre-release) or later · >= 0.8.0-incubating-rc1, < 0.9.1-incubating · CVE-2026-49361 · GHSA-4c39-fwgj-4vq7
- High, CVSS 7.3
Apache Airflow Vulnerable to Deserialization of Untrusted Data
PyPI apache-airflow · Upgrade to 3.2.2 or later · >= 3.2.0, < 3.2.2 · CVE-2026-45360 · GHSA-2r5m-76wx-56gx · amended
- High, CVSS 7.5
Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key
PyPI apache-airflow · Upgrade to 3.2.2 or later · >= 3.2.0, < 3.2.2 · CVE-2026-41084 · GHSA-mxq5-f9c5-w4p5 · amended
- Critical, CVSS 9.1
Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine
PyPI apache-airflow · Upgrade to 3.2.2 or later · >= 3.0.0, < 3.2.2 · CVE-2026-42252 · GHSA-c85c-g9wv-pph2 · amended
- High, CVSS 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
Maven org.apache.activemq:activemq-broker +2 · Upgrade all 3 to 6.2.6 or 5.19.7 by release line · < 5.19.7; >= 6.0.0, < 6.2.6 · CVE-2026-45505 · GHSA-v853-w46p-fv2h
- High, CVSS 8.1
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
Maven org.apache.activemq:activemq-broker +2 · Upgrade all 3 to 6.2.6 or 5.19.7 by release line · < 5.19.7; >= 6.0.0, < 6.2.6 · CVE-2026-42588 · GHSA-hg6c-8mvr-jqc9
- High, CVSS 8.8
Apache Airflow has a Deserialization of Untrusted Data vulnerability
PyPI apache-airflow · Upgrade to 3.2.2 or later · >= 3.2.0, < 3.2.2 · CVE-2026-42359 · GHSA-wr76-29cr-67w8 · amended
- High, CVSS 7.2
Apache Airflow: Authenticated users can bypass the
is_safe_urlcheckPyPI apache-airflow · Upgrade to 3.2.2 or later · >= 3.0.0b3, < 3.2.2 · CVE-2026-40961 · GHSA-6hcw-qqr8-pjj8 · amended
- High, CVSS 8.8
Apache Directory LDAP API lacks server certificate verification for LDAP hostnames
Maven org.apache.directory.api:api-ldap-client-api · Upgrade to 2.1.8 or later · >= 2.0.0, < 2.1.8 · CVE-2026-35563 · GHSA-85rw-g4f4-jprr
A vendor fix does not resolve your finding until you verify it in your own systems.