High, CVSS 7.5
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
RubyGems puma · Upgrade to 8.0.2 or 7.2.1 by release line · >= 8.0.0, < 8.0.2; >= 5.5.0, < 7.2.1 · CVE-2026-47736 · GHSA-qpgp-93vx-g8v8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 33 matching · newest first
- High, CVSS 7.1
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
Go github.com/basekick-labs/arc · Upgrade to 0.0.0-20260520141557-91bdc29d1a02 (pre-release) or later · < 0.0.0-20260520141557-91bdc29d1a02 · CVE-2026-47735 · GHSA-p2j4-c4g6-rpf5
- Medium, CVSS 5.7
Dulwich has unbounded memory allocation in receive-pack from crafted thin packs
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.1.0, < 1.2.5 · CVE-2026-47734 · GHSA-xrvj-v92f-53gj · amended
- High, CVSS 7.1
nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · <= 0.3.1 · CVE-2026-47726 · GHSA-qm33-p5p9-f8vg
- High, CVSS 7.0
nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
Go github.com/juev/nebula-mesh · Upgrade to 0.3.3 or later · <= 0.3.2 · CVE-2026-47725 · GHSA-273q-qgh5-wrj6
- Critical, CVSS 9.9
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
Go github.com/juev/nebula-mesh · Upgrade to 0.3.4 or later · < 0.3.4 · CVE-2026-47724 · GHSA-598g-h2vc-h5vg
- High, CVSS 7.1
nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
Go github.com/juev/nebula-mesh · Upgrade to 0.3.1 or later · <= 0.3.0 · CVE-2026-47723 · GHSA-w7w5-5gcp-38rw
- High, CVSS 8.7
nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · < 0.3.2 · CVE-2026-47722 · GHSA-7hp6-g3pq-3pc3
- Low, CVSS 3.3
Dulwich doesn't sanitize commit subjects in
porcelain.format_patchPyPI dulwich · Upgrade to 1.2.5 or later · >= 0.24.0, < 1.2.5 · CVE-2026-47712 · GHSA-555p-6grf-mh7f · amended
- Medium, CVSS 6.9
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
Packagist poweradmin/poweradmin · Upgrade to 4.3.3 or 4.2.4 by release line · < 4.2.4; >= 4.3.0, < 4.3.3 · CVE-2026-47693 · GHSA-3h6h-67x3-cv5x
- Critical, CVSS 9.0
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
Go github.com/julien040/anyquery/plugins/chrome +3 · Upgrade all 4 to 0.0.0-20240826075852-c651df0b8767 (pre-release) or later · < 0.0.0-20240826075852-c651df0b8767 · CVE-2026-47252 · GHSA-hrj8-hjv8-mgwc
- High, CVSS 8.7
Netty has Insufficient Bailiwick Validation for NS Records
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-47691 · GHSA-5pvg-856g-cp85
- Medium, CVSS 5.3
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-47244 · GHSA-5x3r-wrvg-rp6q
- High, CVSS 7.5
Netty: SCTP reassembly nests buffers without bound
Maven io.netty:netty-transport-sctp · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-46340 · GHSA-5xrh-qmmq-w6ch
- High, CVSS 8.7
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45674 · GHSA-676x-f7gg-47vc
- Medium, CVSS 6.8
Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45673 · GHSA-xmv7-r254-6q78
- Medium, CVSS 4.0
Netty: Unix-socket fd receive leaks descriptors when peer sends two at once
Maven io.netty:netty-transport-native-epoll +1 · Upgrade all 2 to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45536 · GHSA-w573-9ffj-6ff9
- High, CVSS 7.5
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh
- Critical, CVSS 9.2
PHPSpreadsheet has a patch bypass for CVE-2026-34084
Packagist phpoffice/phpspreadsheet · Upgrade to 1.30.5 or later · <= 1.30.4 · CVE-2026-45034 · GHSA-87m4-826x-3crx
- High, CVSS 7.5
Netty's Default QUIC token handler accepts any client-supplied token
Maven io.netty:netty-codec-classes-quic · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44894 · GHSA-cmm3-54f8-px4j
- High, CVSS 7.5
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44893 · GHSA-cc37-9q2j-3hfv
- High, CVSS 7.5
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44892 · GHSA-c2rx-5r8w-8xr2
- High, CVSS 7.5
Netty has Unbounded Direct Memory Consumption in its RedisDecoder
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44890 · GHSA-6ghj-frrj-jjj3
- High, CVSS 7.5
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44250 · GHSA-3244-j874-rhc2
- High, CVSS 8.1
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44249 · GHSA-3qp7-7mw8-wx86
A vendor fix does not resolve your finding until you verify it in your own systems.