Critical, CVSS 9.9
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Packagist pheditor/pheditor · Upgrade to 2.0.4 or later · >= 2.0.1, <= 2.0.3 · CVE-2026-48030 · GHSA-jvc5-6g7q-c843
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 33 matching · newest first
- High, CVSS 8.7
Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
Go github.com/dexidp/dex · Upgrade to 0.0.0-20260303131938-204dbb2e3ff7 (pre-release) or later · < 0.0.0-20260303131938-204dbb2e3ff7 · GHSA-7qjx-gp9h-65qj
- Medium, CVSS 6.9
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line · >= 5.4.46, < 5.4.52; >= 6.4.14, < 6.4.40; >= 7.1.7, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-47767 · GHSA-fqc7-9xjw-jrh3
- Medium, CVSS 5.8
Net::IMAP: Command Injection via ID command argument
RubyGems net-imap · Upgrade to 0.6.4.1 or 0.5.15 by release line · >= 0.6.0, <= 0.6.4; <= 0.5.14 · CVE-2026-47242 · GHSA-46q3-7gv7-qmgg
- Low, CVSS 2.1
Net::IMAP: Denial of Service via incomplete raw argument validation
RubyGems net-imap · Upgrade to 0.6.4.1 or 0.5.15 by release line · >= 0.6.0, <= 0.6.4; <= 0.5.14 · CVE-2026-47241 · GHSA-c4fp-cxrr-mj66
- Medium, CVSS 5.8
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
RubyGems net-imap · Upgrade to 0.6.4.1 or 0.5.15 by release line · >= 0.6.0, <= 0.6.4; <= 0.5.14 · CVE-2026-47240 · GHSA-8p34-64r3-mwg8
- Critical, CVSS 9.2
shell-quote quote() does not escape newlines in object .op values
npm shell-quote · Upgrade to 1.8.4 or later · >= 1.1.0, <= 1.8.3 · CVE-2026-9277 · GHSA-w7jw-789q-3m8p · amended
- Medium, CVSS 6.5
Apache Airflow has a Path Traversal issue
PyPI apache-airflow-providers-samba · Upgrade to 4.12.6 or later · < 4.12.6 · CVE-2026-49818 · GHSA-f6vj-48fm-hmvx · amended
- High, CVSS 7.4
degit has a Command Injection issue
npm degit · Upgrade to 3.3.1 or 2.8.6 by release line · < 2.8.6; >= 3.0.0, < 3.3.1 · CVE-2026-11572 · GHSA-77c7-pq4r-6mcq · amended
- Medium, CVSS 5.3
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41853 · GHSA-cjpg-rgq5-fr37
- Medium, CVSS 4.2
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
Maven org.springframework:spring-web · Upgrade to 7.0.8 or 6.2.19 by release line · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18 · CVE-2026-41854 · GHSA-7m2p-62gw-p8qq
- High, CVSS 7.5
Spring Framework Algorithmic Denial of Service via SpEL Expressions
Maven org.springframework:spring-expression · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41850 · GHSA-r5w3-xv2f-j59q
- Low, CVSS 3.7
Spring Framework Denial of Service via AntPathMatcher
Maven org.springframework:spring-core · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41848 · GHSA-659m-px2c-25wj
- Medium, CVSS 5.9
Spring Framework Cross-site Scripting via JSP Form Tags
Maven org.springframework:spring-webmvc · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41846 · GHSA-957g-f97v-vppc
- High, CVSS 8.1
Spring Framework Unsafe Deserialization via Jackson JMS Converters
Maven org.springframework:spring-jms · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · <= 5.3.39; >= 6.0.0, <= 6.1.21; >= 6.2.0, <= 6.2.18; >= 7.0.0-M1, <= 7.0.7 · CVE-2026-41855 · GHSA-x863-p983-p4f7
- Medium, CVSS 5.3
Spring Framework Denial of Service via Unbounded Cache in SpEL
Maven org.springframework:spring-expression · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41851 · GHSA-wxpp-56q6-5pcg
- Low, CVSS 3.7
Spring Framework Arbitrary Method Invocation in SpEL Expressions
Maven org.springframework:spring-expression · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41852 · GHSA-9f52-rjqv-25qv
- High, CVSS 7.5
Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Maven org.springframework.hateoas:spring-hateoas · Upgrade to 3.0.4 or 2.5.3 by release line; some affected versions have no fix yet · >= 3.0.0, <= 3.0.3; >= 2.5.0, <= 2.5.2; >= 2.3.0, <= 2.3.4; <= 1.5.6; >= 2.4.0, <= 2.4.1 · CVE-2026-41006 · GHSA-7fxc-486f-32q9
- High, CVSS 7.4
Spring LDAP has Authentication Bypass with Empty Password
Maven org.springframework.ldap:spring-ldap-core · Upgrade to 4.0.4 or 3.3.8 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.3; >= 3.3.0, <= 3.3.7; >= 3.2.0, <= 3.2.16; <= 2.4.4 · CVE-2026-41720 · GHSA-jrv5-8w28-4265
- Medium, CVSS 4.2
Spring Framework Escalation via Session Fixation in WebFlux
Maven org.springframework:spring-webflux · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41839 · GHSA-4hfh-6x8g-gwpp
- High, CVSS 7.1
Spring Framework Cross-site Scripting via JavaScriptUtils
Maven org.springframework:spring-webmvc · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41845 · GHSA-3chg-m5w7-qfv5
- Medium, CVSS 5.9
Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service
Maven org.springframework.retry:spring-retry · Upgrade to 2.0.13; some affected versions have no fix yet · >= 2.0.0, <= 2.0.12; <= 1.3.4 · CVE-2026-41710 · GHSA-2827-2mxx-j8pv
- Medium, CVSS 4.2
Spring Framework Open Redirect in Spring MVC and WebFlux
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41844 · GHSA-h3qp-gqrc-q736
- High, CVSS 7.5
Spring HATEOAS heap exhaustion through unbounded internal caching
Maven org.springframework.hateoas:spring-hateoas · Upgrade to 3.0.4 or 2.5.3 by release line; some affected versions have no fix yet · >= 3.0.0, <= 3.0.3; >= 2.5.0, <= 2.5.2; >= 2.3.0, <= 2.3.4; <= 1.5.6; >= 2.4.0, <= 2.4.1 · CVE-2026-41007 · GHSA-439x-6767-44cv
- Medium, CVSS 4.8
Spring Framework Predictable Session ID in WebSocket Module
Maven org.springframework:spring-websocket · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.27; <= 5.3.48 · CVE-2026-41838 · GHSA-q723-847q-5g8g
A vendor fix does not resolve your finding until you verify it in your own systems.