High, CVSS 7.5
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
RubyGems puma · Upgrade to 8.0.2 or 7.2.1 by release line · >= 8.0.0, < 8.0.2; >= 5.5.0, < 7.2.1 · CVE-2026-47736 · GHSA-qpgp-93vx-g8v8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
Go github.com/basekick-labs/arc · Upgrade to 0.0.0-20260520141557-91bdc29d1a02 (pre-release) or later · < 0.0.0-20260520141557-91bdc29d1a02 · CVE-2026-47735 · GHSA-p2j4-c4g6-rpf5
- High, CVSS 7.1
nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · <= 0.3.1 · CVE-2026-47726 · GHSA-qm33-p5p9-f8vg
- High, CVSS 7.0
nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
Go github.com/juev/nebula-mesh · Upgrade to 0.3.3 or later · <= 0.3.2 · CVE-2026-47725 · GHSA-273q-qgh5-wrj6
- Critical, CVSS 9.9
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
Go github.com/juev/nebula-mesh · Upgrade to 0.3.4 or later · < 0.3.4 · CVE-2026-47724 · GHSA-598g-h2vc-h5vg
- High, CVSS 7.1
nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
Go github.com/juev/nebula-mesh · Upgrade to 0.3.1 or later · <= 0.3.0 · CVE-2026-47723 · GHSA-w7w5-5gcp-38rw
- High, CVSS 8.7
nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · < 0.3.2 · CVE-2026-47722 · GHSA-7hp6-g3pq-3pc3
- Critical, CVSS 9.0
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
Go github.com/julien040/anyquery/plugins/chrome +3 · Upgrade all 4 to 0.0.0-20240826075852-c651df0b8767 (pre-release) or later · < 0.0.0-20240826075852-c651df0b8767 · CVE-2026-47252 · GHSA-hrj8-hjv8-mgwc
- High, CVSS 8.7
Netty has Insufficient Bailiwick Validation for NS Records
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-47691 · GHSA-5pvg-856g-cp85
- High, CVSS 7.5
Netty: SCTP reassembly nests buffers without bound
Maven io.netty:netty-transport-sctp · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-46340 · GHSA-5xrh-qmmq-w6ch
- High, CVSS 8.7
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45674 · GHSA-676x-f7gg-47vc
- High, CVSS 7.5
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh
- Critical, CVSS 9.2
PHPSpreadsheet has a patch bypass for CVE-2026-34084
Packagist phpoffice/phpspreadsheet · Upgrade to 1.30.5 or later · <= 1.30.4 · CVE-2026-45034 · GHSA-87m4-826x-3crx
- High, CVSS 7.5
Netty's Default QUIC token handler accepts any client-supplied token
Maven io.netty:netty-codec-classes-quic · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44894 · GHSA-cmm3-54f8-px4j
- High, CVSS 7.5
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44893 · GHSA-cc37-9q2j-3hfv
- High, CVSS 7.5
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44892 · GHSA-c2rx-5r8w-8xr2
- High, CVSS 7.5
Netty has Unbounded Direct Memory Consumption in its RedisDecoder
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44890 · GHSA-6ghj-frrj-jjj3
- High, CVSS 7.5
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44250 · GHSA-3244-j874-rhc2
- High, CVSS 8.1
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44249 · GHSA-3qp7-7mw8-wx86
- High, CVSS 8.2
Routinator crashes when sending a maliciously crafted select-asn query parameter
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49234 · GHSA-gc6q-cwcj-3vh9
- High, CVSS 8.7
Routinator crashes when encountering maliciously crafted RRDP XML files
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49235 · GHSA-5qf9-cf9c-hjc6
- High, CVSS 8.3
Routinator has cache path traversal when processing the module component of rsync URIs
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49233 · GHSA-33mj-99mg-8g73
- Critical, CVSS 9.5
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
npm cordova-plugin-inappbrowser · Upgrade to 6.0.1 or later · < 6.0.1 · CVE-2026-47430 · GHSA-q42j-x8rq-pjg6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.