High, CVSS 7.1
Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents
Go github.com/nezhahq/nezha · Upgrade to 2.0.14 or later · >= 1.0.0, < 2.0.14 · CVE-2026-49396 · GHSA-8qhj-4f8c-j8qg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 61 matching · newest first
- Critical, CVSS 9.1
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
Go github.com/dhax/go-base · Upgrade to 0.0.0-20260517152733-cc82b9740fa6 (pre-release) or later · < 0.0.0-20260517152733-cc82b9740fa6 · CVE-2026-48031 · GHSA-mqq6-462x-jxmm
- Low, CVSS 3.5
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
npm @papra/webhooks · Upgrade to 0.3.3 or later · < 0.3.3 · CVE-2026-48051 · GHSA-5g86-85rp-f9hx · amended
- Medium, CVSS 6.3
@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
npm @hulumi/baseline · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48037 · GHSA-cj8g-prcm-mfg5 · amended
- High, CVSS 8.4
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
npm @hulumi/drift · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48036 · GHSA-32g3-35g9-wc9g · amended
- High, CVSS 7.1
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
npm @hulumi/baseline · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48035 · GHSA-2mxr-p26x-mj73 · amended
- High, CVSS 8.5
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48034 · GHSA-9vc9-4jv3-rf86 · amended
- High, CVSS 8.4
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48033 · GHSA-rhgj-6g2c-frmm · amended
- High, CVSS 8.3
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48032 · GHSA-g759-4pxw-6692 · amended
- High, CVSS 8.4
Concrete CMS: PHP Object Injection via unserialize() calls
Packagist concrete5/concrete5 · Upgrade to 9.5.2 or later · < 9.5.2 · CVE-2026-10721 · GHSA-g82f-9pw7-773w
- Medium, CVSS 6.8
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Maven org.springframework.security:spring-security-web · Upgrade to 6.5.11; some affected versions have no fix yet · >= 6.5.0, <= 6.5.10; >= 6.4.0, <= 6.4.13; >= 6.0.0, <= 6.3.10; >= 5.8.0, <= 5.8.16; <= 5.7.14 · CVE-2026-47838 · GHSA-293q-567p-wmwq
- High, CVSS 8.6
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Packagist buddypress/buddypress · Upgrade to 14.5.0 or later · < 14.5.0 · CVE-2026-53673 · GHSA-j3j5-5m8v-7gvc
- High, CVSS 8.1
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41729 · GHSA-j388-8rm5-p97f
- Medium, CVSS 5.3
Spring Data REST potentially exposes persistence-layer internals to HTTP clients
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41730 · GHSA-p5mm-xwgq-whfr
- High, CVSS 8.1
Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
Maven org.springframework.pulsar:spring-pulsar · Upgrade to 2.0.6 or 1.2.18 by release line; some affected versions have no fix yet · >= 2.0.0, <= 2.0.5; >= 1.2.0, <= 1.2.17; <= 1.1.17 · CVE-2026-41732 · GHSA-gg69-9wwp-6jx2
- High, CVSS 8.1
In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
Maven org.springframework.kafka:spring-kafka · Upgrade to 4.0.6 or 3.3.16 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.3.0, <= 3.3.15; >= 3.2.0, <= 3.2.13; >= 2.9.0, <= 2.9.13; <= 2.8.11 · CVE-2026-41731 · GHSA-xq69-5h5v-x9x4
- Medium, CVSS 6.4
Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries
Maven org.springframework.data:spring-data-keyvalue · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.14; >= 3.0.0, <= 3.3.16; <= 2.7.19 · CVE-2026-41719 · GHSA-xg2j-3hj6-pc24
- High, CVSS 7.5
Spring Data REST has Improper Access Control in its JSON Patch Implementation
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41728 · GHSA-cv39-x4c6-hhp2
- Medium, CVSS 5.3
Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41837 · GHSA-mwpv-rg79-863c
- Medium, CVSS 5.9
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Maven org.springframework.data:spring-data-commons · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.14; >= 3.0.0, <= 3.3.16; <= 2.7.19 · CVE-2026-41721 · GHSA-5m4m-73w9-8433
- Medium, CVSS 6.5
In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
Maven org.springframework.kafka:spring-kafka · Upgrade to 4.0.6 or 3.3.16 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.3.0, <= 3.3.15; >= 3.2.0, <= 3.2.13; >= 2.9.0, <= 2.9.13; <= 2.8.11 · CVE-2026-41726 · GHSA-xvfq-4q6q-gxx7
- Medium, CVSS 6.5
Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation
Maven org.springframework.kafka:spring-kafka · Upgrade to 4.0.6 or 3.3.16 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.3.0, <= 3.3.15; >= 3.2.0, <= 3.2.13; >= 2.9.0, <= 2.9.13; <= 2.8.11 · CVE-2026-41727 · GHSA-53w6-v7cv-fc9h
- Medium, CVSS 4.0
Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean
Maven org.springframework.amqp:spring-amqp · Upgrade to 4.0.4 or 3.2.11 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.3; >= 3.2.0, <= 3.2.10; >= 3.1.0, <= 3.1.15; <= 2.4.17 · CVE-2026-41714 · GHSA-p8qj-fj6r-w7q9
- High, CVSS 8.1
Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection
Maven org.springframework.data:spring-data-mongodb · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.0.0, <= 4.3.16; <= 3.4.19 · CVE-2026-41717 · GHSA-5whc-4q84-fj73
- High, CVSS 7.5
Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys
Maven org.springframework.data:spring-data-commons · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.14; >= 3.3.0, <= 3.3.16; <= 2.7.19 · CVE-2026-41716 · GHSA-9fw2-h3hf-293r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.