Critical, CVSS 9.3
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
PyPI stata-mcp · Upgrade to 1.17.3 or later · < 1.17.3 · CVE-2026-47708 · GHSA-4p62-hqp5-g644 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 46 matching · newest first
- Medium, CVSS 6.9
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
Go github.com/AdguardTeam/dnsproxy · Upgrade to 0.81.3 or later · < 0.81.3 · +1 more package · CVE-2026-47703 · GHSA-xgx4-4h9w-53pv
- Critical, CVSS 9.6
Supply chain compromise via malicious @cap-js/openapi
npm @cap-js/openapi · Upgrade to 1.4.2 or later · >= 1.4.1, <= 1.4.1 · GHSA-jpvj-wpmj-h7rv · amended
- Medium, CVSS 4.1
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or later · >= 6.7.0.0, < 6.7.10.1 · CVE-2026-48013 · GHSA-gq96-5pfx-f4vc
- Medium, CVSS 4.9
Shopware: Stored XSS via SVG file upload — no SVG sanitization
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or 6.6.10.18 by release line · >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 · CVE-2026-48015 · GHSA-xvhc-gm7j-mhmc
- Medium, CVSS 4.3
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or 6.6.10.18 by release line · >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 · CVE-2026-48016 · GHSA-9v5m-39wh-5chq
- Medium, CVSS 6.5
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or 6.6.10.18 by release line · >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 · CVE-2026-48014 · GHSA-f8q6-3g5w-jjr6
- Medium, CVSS 4.3
Shopware SSO referer trust leading to an arbitrary redirect target
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or later · >= 6.7.3.0, < 6.7.10.1 · CVE-2026-48012 · GHSA-4x3x-869w-xx3m
- Low, CVSS 3.7
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or 6.6.10.18 by release line · >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 · CVE-2026-48011 · GHSA-7w52-7jvm-m9vw
- Medium, CVSS 6.5
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or 6.6.10.18 by release line · >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 · CVE-2026-48010 · GHSA-v39m-97p8-gqg7
- Medium, CVSS 6.8
Shopware: Admin Account Takeover via User Recovery Hash Exposure
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or 6.6.10.18 by release line · >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 · CVE-2026-48009 · GHSA-8v9p-g828-v98f
- Medium, CVSS 6.5
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Packagist shopware/core +1 · Upgrade all 2 to 6.7.10.1 or 6.6.10.18 by release line · >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 · CVE-2026-48008 · GHSA-gv8p-48fr-4fxg
- Medium, CVSS 5.2
Spree: CSV Formula Injection in Customer Export
RubyGems spree · Upgrade to 5.4.3, 5.3.6 or 5.2.8 by release line · >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.6; >= 5.4.0, < 5.4.3 · GHSA-xf4v-w5x5-pv79
- Medium, CVSS 5.3
OpenMeter: SQL injection through meter creation
Go github.com/openmeterio/openmeter · Upgrade to 1.0.0-beta.228 (pre-release) or later · < 1.0.0-beta.228 · CVE-2026-8462 · GHSA-wc3v-3457-c8cm
- Critical, CVSS 9.1
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
Maven org.apache.fory:fory-core · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-50076 · GHSA-8f39-v287-78jf
- Low, CVSS 2.2
OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
PyPI neutron · Upgrade to 28.0.1 or later · < 28.0.1 · CVE-2026-50266 · GHSA-qmc5-gv6v-8p22 · amended
- Low, CVSS 1.1
milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery
Go github.com/milvus-io/milvus · Upgrade to 0.10.3-0.20260602041816-3d932f1c3e06 (pre-release) or later · < 0.10.3-0.20260602041816-3d932f1c3e06 · CVE-2026-10814 · GHSA-jh6h-v6mp-h22v
- Medium, CVSS 5.3
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47676 · GHSA-2gcr-mfcq-wcc3 · amended
- Medium, CVSS 5.3
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47674 · GHSA-xrhx-7g5j-rcj5 · amended
- Medium, CVSS 4.3
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47675 · GHSA-3hrh-pfw6-9m5x · amended
- Medium, CVSS 4.8
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47673 · GHSA-f577-qrjj-4474 · amended
- Medium, CVSS 5.4
Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
Go github.com/nhost/nhost · Upgrade to 0.0.0-20260518172022-e407511627d2 (pre-release) or later · < 0.0.0-20260518172022-e407511627d2 · CVE-2026-47671 · GHSA-64cj-qvx5-m4f3
- High, CVSS 7.5
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)
Go github.com/klever-io/klever-go · Upgrade to 1.7.17 or later · < 1.7.17 · GHSA-74m6-4hjp-7226
- Low, CVSS 2.1
kas's late signature validation may allow unnoticed repository manipulations
PyPI kas · Upgrade to 5.3 or later · >= 4.8, < 5.3 · CVE-2026-47192 · GHSA-4vqc-wpwg-vh7j · amended
- High, CVSS 7.5
React Router vulnerable to Denial of Service via reflected user input in single-fetch
npm react-router · Upgrade to 7.14.0 or later · >= 7.0.0, < 7.14.0 · +1 more package · CVE-2026-34077 · GHSA-rxv8-25v2-qmq8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.