Low, CVSS 2.3
Django: has_vary_header may expose cached responses when Vary values contain whitespace
PyPI django · Upgrade to 6.0.6 or 5.2.15 by release line · < 5.2.15; >= 6.0.0, < 6.0.6 · CVE-2026-48587 · GHSA-923m-gv2p-w5qp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–37 of 37 matching · newest first
- High, CVSS 8.0
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
PyPI transformers · Upgrade to 5.5.0 or later · < 5.5.0 · CVE-2026-5241 · GHSA-fgcw-684q-jj6r · amended
- Low, CVSS 3.7
daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators
PyPI daphne · Upgrade to 4.2.2 or later · < 4.2.2 · CVE-2026-44546 · GHSA-xh68-hfp5-5x5m · amended
- Low, CVSS 2.3
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
PyPI django · Upgrade to 6.0.6 or 5.2.15 by release line · < 5.2.15; >= 6.0.0, < 6.0.6 · CVE-2026-8404 · GHSA-8cjm-8mp7-r2xf · amended
- Low, CVSS 2.3
Django: signed cookies are vulnerable to salt namespace collisions
PyPI django · Upgrade to 6.0.6 or 5.2.15 by release line · < 5.2.15; >= 6.0.0, < 6.0.6 · CVE-2026-6873 · GHSA-h7pc-vwp9-298g · amended
- Low, CVSS 2.3
Django fails to prevent reuse of a partially-initialized connection after a failed
STARTTLShandshakePyPI django · Upgrade to 6.0.6 or 5.2.15 by release line · >= 5.2, < 5.2.15; >= 6.0, < 6.0.6 · CVE-2026-7666 · GHSA-mm6v-q8q9-pgcf · amended
- Medium, CVSS 5.3
daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames
PyPI daphne · Upgrade to 4.2.2 or later · < 4.2.2 · CVE-2026-44545 · GHSA-rrc9-mx66-ffcm · amended
- Low, CVSS 2.3
Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary
PyPI django · Upgrade to 6.0.6 or 5.2.15 by release line · >= 5.2.0, < 5.2.15; >= 6.0.0, < 6.0.6 · CVE-2026-35193 · GHSA-qpc8-7fxc-cm4p · amended
- Critical, CVSS 9.8
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass
Maven org.apache.mina:mina-core · Upgrade to 2.2.8, 2.1.13 or 2.0.29 by release line · >= 2.2.0, < 2.2.8; >= 2.1.0, < 2.1.13; < 2.0.29 · CVE-2026-47065 · GHSA-v3pr-hxpr-mfm8
- Critical, CVSS 9.1
MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
PyPI mlflow · Upgrade to 3.11.0 or later · < 3.11.0 · CVE-2026-4035 · GHSA-g35p-px32-whv6 · amended
- Low, CVSS 2.1
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption
npm @wonderwhy-er/desktop-commander · Upgrade to 0.2.39 or later · < 0.2.39 · CVE-2026-10691 · GHSA-r87g-78mx-3wg4 · amended
- Low, CVSS 2.1
Code Index MCP is vulnerable to Uncontrolled Resource Consumption
PyPI code-index-mcp · Upgrade to 2.14.1 or later · < 2.14.1 · CVE-2026-10692 · GHSA-647r-72hf-4vmh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.