High, CVSS 7.1
PDM wheel installation leads to Path Traversal via overridden write_to_fs
PyPI pdm · Upgrade to 2.27.0 or later · <= 2.22.4 · CVE-2026-47764 · GHSA-78v8-vpjp-cjqh · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
npm @whiskeysockets/baileys +1 · Upgrade all 2 to 7.0.0-rc12 (pre-release) or 6.7.22 by release line · < 6.7.22; >= 7.0.0-rc.1, < 7.0.0-rc12 · CVE-2026-48063 · GHSA-qvv5-jq5g-4cgg · amended
- High, CVSS 8.1
Litestar has HTML Injection Through its CSRF Token
PyPI litestar · Upgrade to 2.22.0 or later · < 2.22.0 · CVE-2026-48060 · GHSA-542p-wvx7-72m4 · amended
- High, CVSS 7.7
OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
Go github.com/open-telemetry/opentelemetry-operator · Upgrade to 0.152.0 or later · < 0.152.0 · CVE-2026-47701 · GHSA-cxh2-4639-vmc5
- High, CVSS 7.3
Anyquery has Path Traversal through
clear_plugin_cache, Allowing Arbitrary Directory DeletionGo github.com/julien040/anyquery · Upgrade to 0.4.5 or later · <= 0.4.4 · CVE-2026-47253 · GHSA-j9rx-rppg-6hh4
- High, CVSS 7.5
Acknowledgement extension out of memory
Maven org.cometd.java:cometd-java-server-common · Upgrade to 8.0.9, 7.0.19, 6.0.19 or 5.0.23 by release line · >= 5.0.0, <= 5.0.22; >= 6.0.0, <= 6.0.18; >= 7.0.0, <= 7.0.18; >= 8.0.0, <= 8.0.8 · CVE-2025-53114 · GHSA-cqgj-h8vf-4w59
- High, CVSS 8.8
Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · < 2.555.3; >= 2.556, < 2.568 · CVE-2026-53435 · GHSA-g2xq-2v27-4rh3
- High, CVSS 8.0
Jenkins: Stored XSS vulnerability in node offline cause description
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or later · >= 2.483, <= 2.567 · CVE-2026-53441 · GHSA-93qh-vwrm-c5pw
- High, CVSS 8.7
image-size: ICNS parser allows denial of service through an infinite loop
npm image-size · Upgrade to 2.0.3 or later · >= 0.6.3, <= 2.0.2 · CVE-2025-71330 · GHSA-w3rx-r6r6-pgpr · amended
- High, CVSS 8.7
image-size: JXL and HEIF parsers allow denial of service through infinite loops
npm image-size · Upgrade to 2.0.3 or later · >= 1.2.0, <= 2.0.2 · CVE-2025-71329 · GHSA-5p2g-fcmc-qvqq · amended
- High, CVSS 7.1
Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents
Go github.com/nezhahq/nezha · Upgrade to 2.0.14 or later · >= 1.0.0, < 2.0.14 · CVE-2026-49396 · GHSA-8qhj-4f8c-j8qg
- Critical, CVSS 9.1
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
Go github.com/dhax/go-base · Upgrade to 0.0.0-20260517152733-cc82b9740fa6 (pre-release) or later · < 0.0.0-20260517152733-cc82b9740fa6 · CVE-2026-48031 · GHSA-mqq6-462x-jxmm
- High, CVSS 8.4
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
npm @hulumi/drift · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48036 · GHSA-32g3-35g9-wc9g · amended
- High, CVSS 7.1
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
npm @hulumi/baseline · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48035 · GHSA-2mxr-p26x-mj73 · amended
- High, CVSS 8.5
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48034 · GHSA-9vc9-4jv3-rf86 · amended
- High, CVSS 8.4
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48033 · GHSA-rhgj-6g2c-frmm · amended
- High, CVSS 8.3
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48032 · GHSA-g759-4pxw-6692 · amended
- High, CVSS 8.4
Concrete CMS: PHP Object Injection via unserialize() calls
Packagist concrete5/concrete5 · Upgrade to 9.5.2 or later · < 9.5.2 · CVE-2026-10721 · GHSA-g82f-9pw7-773w
- High, CVSS 8.6
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Packagist buddypress/buddypress · Upgrade to 14.5.0 or later · < 14.5.0 · CVE-2026-53673 · GHSA-j3j5-5m8v-7gvc
- High, CVSS 8.1
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41729 · GHSA-j388-8rm5-p97f
- High, CVSS 8.1
Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
Maven org.springframework.pulsar:spring-pulsar · Upgrade to 2.0.6 or 1.2.18 by release line; some affected versions have no fix yet · >= 2.0.0, <= 2.0.5; >= 1.2.0, <= 1.2.17; <= 1.1.17 · CVE-2026-41732 · GHSA-gg69-9wwp-6jx2
- High, CVSS 8.1
In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
Maven org.springframework.kafka:spring-kafka · Upgrade to 4.0.6 or 3.3.16 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.3.0, <= 3.3.15; >= 3.2.0, <= 3.2.13; >= 2.9.0, <= 2.9.13; <= 2.8.11 · CVE-2026-41731 · GHSA-xq69-5h5v-x9x4
- High, CVSS 7.5
Spring Data REST has Improper Access Control in its JSON Patch Implementation
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41728 · GHSA-cv39-x4c6-hhp2
- High, CVSS 8.1
Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection
Maven org.springframework.data:spring-data-mongodb · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.0.0, <= 4.3.16; <= 3.4.19 · CVE-2026-41717 · GHSA-5whc-4q84-fj73
- High, CVSS 7.5
Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys
Maven org.springframework.data:spring-data-commons · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.14; >= 3.3.0, <= 3.3.16; <= 2.7.19 · CVE-2026-41716 · GHSA-9fw2-h3hf-293r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.