Medium, CVSS 5.5
nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · <= 0.3.1 · CVE-2026-47768 · GHSA-9pg3-25fq-p6cc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 61 matching · newest first
- High, CVSS 7.1
PDM wheel installation leads to Path Traversal via overridden write_to_fs
PyPI pdm · Upgrade to 2.27.0 or later · <= 2.22.4 · CVE-2026-47764 · GHSA-78v8-vpjp-cjqh · amended
- Medium, CVSS 6.8
PDM: Project-Local State and Config Writes Follow Symlinks
PyPI pdm · Upgrade to 2.27.0 or later · < 2.27.0 · CVE-2026-47763 · GHSA-ghq2-5c67-fprm · amended
- Medium, CVSS 4.4
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
Go github.com/lxc/incus/v7 · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-47753 · GHSA-8g7m-96c8-8wwc
- Medium, CVSS 5.3
Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
GitHub Actions anthropics/claude-code-action · Upgrade to 1.0.74 or later · < 1.0.74 · CVE-2026-47751 · GHSA-8q5r-mmjf-575q
- Critical, CVSS 9.3
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
npm @whiskeysockets/baileys +1 · Upgrade all 2 to 7.0.0-rc12 (pre-release) or 6.7.22 by release line · < 6.7.22; >= 7.0.0-rc.1, < 7.0.0-rc12 · CVE-2026-48063 · GHSA-qvv5-jq5g-4cgg · amended
- Medium, CVSS 5.9
Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
PyPI litestar · Upgrade to 2.22.0 or later · < 2.22.0 · CVE-2026-48061 · GHSA-3qmc-cj7q-62hv · amended
- High, CVSS 8.1
Litestar has HTML Injection Through its CSRF Token
PyPI litestar · Upgrade to 2.22.0 or later · < 2.22.0 · CVE-2026-48060 · GHSA-542p-wvx7-72m4 · amended
- Medium, CVSS 4.6
nebula-mesh: Session and OIDC state cookies lack the Secure attribute
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · < 0.3.2 · CVE-2026-48058 · GHSA-rqfj-vv8r-xhqc
- Unrated
nebula-mesh: Decrypted CA private key persists in heap after signing
Go github.com/juev/nebula-mesh +1 · Upgrade all 2 to 0.3.7 or later · < 0.3.7 · CVE-2026-48025 · GHSA-8h84-fhqq-q58v
- High, CVSS 7.7
OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
Go github.com/open-telemetry/opentelemetry-operator · Upgrade to 0.152.0 or later · < 0.152.0 · CVE-2026-47701 · GHSA-cxh2-4639-vmc5
- High, CVSS 7.3
Anyquery has Path Traversal through
clear_plugin_cache, Allowing Arbitrary Directory DeletionGo github.com/julien040/anyquery · Upgrade to 0.4.5 or later · <= 0.4.4 · CVE-2026-47253 · GHSA-j9rx-rppg-6hh4
- Medium, CVSS 6.5
vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors
PyPI vllm · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-47155 · GHSA-3ww4-5jv9-j5gm · amended
- High, CVSS 7.5
Acknowledgement extension out of memory
Maven org.cometd.java:cometd-java-server-common · Upgrade to 8.0.9, 7.0.19, 6.0.19 or 5.0.23 by release line · >= 5.0.0, <= 5.0.22; >= 6.0.0, <= 6.0.18; >= 7.0.0, <= 7.0.18; >= 8.0.0, <= 8.0.8 · CVE-2025-53114 · GHSA-cqgj-h8vf-4w59
- Medium, CVSS 4.3
Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · < 2.555.3; >= 2.556, < 2.568 · CVE-2026-53440 · GHSA-92m7-4fpw-2wxm
- High, CVSS 8.8
Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · < 2.555.3; >= 2.556, < 2.568 · CVE-2026-53435 · GHSA-g2xq-2v27-4rh3
- Medium, CVSS 5.3
Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · < 2.555.3; >= 2.556, < 2.568 · CVE-2026-53442 · GHSA-m6wv-wh8g-64xc
- Medium, CVSS 4.3
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · < 2.555.3; >= 2.556, < 2.568 · CVE-2026-53437 · GHSA-463r-5m89-4xfr
- Medium, CVSS 4.3
Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · >= 2.556, < 2.568; < 2.555.3 · CVE-2026-53436 · GHSA-3rqh-hch3-jhpc
- Medium, CVSS 4.3
Jenkins: Missing permission check allows unauthorized cancellation of queue items
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · < 2.555.3; >= 2.556, < 2.568 · CVE-2026-53438 · GHSA-mw82-xcg6-gx79
- Medium, CVSS 4.3
Jenkins exposes other users' timezone and view names to users with Overall/Read permission
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or 2.555.3 by release line · < 2.555.3; >= 2.556, < 2.568 · CVE-2026-53439 · GHSA-g28p-6mcc-v4rv
- High, CVSS 8.0
Jenkins: Stored XSS vulnerability in node offline cause description
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.568 or later · >= 2.483, <= 2.567 · CVE-2026-53441 · GHSA-93qh-vwrm-c5pw
- High, CVSS 8.7
image-size: ICNS parser allows denial of service through an infinite loop
npm image-size · Upgrade to 2.0.3 or later · >= 0.6.3, <= 2.0.2 · CVE-2025-71330 · GHSA-w3rx-r6r6-pgpr · amended
- High, CVSS 8.7
image-size: JXL and HEIF parsers allow denial of service through infinite loops
npm image-size · Upgrade to 2.0.3 or later · >= 1.2.0, <= 2.0.2 · CVE-2025-71329 · GHSA-5p2g-fcmc-qvqq · amended
- Medium, CVSS 5.3
Nezha's private services (
EnableShowInService: false) are enumerable via per-server endpoints, leaking name and timing dataGo github.com/nezhahq/nezha · Upgrade to 2.0.14 or later · >= 2.0.0, < 2.0.14 · CVE-2026-49397 · GHSA-vrmh-5mmx-hjwx
A vendor fix does not resolve your finding until you verify it in your own systems.