Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
PyPI hermes-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53869 · GHSA-4pqm-j46f-795x · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
PyPI hermes-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53869 · GHSA-4pqm-j46f-795x · amended
RubyGems avo · Upgrade to 4.0.0.beta.51 or 3.32.1 by release line · <= 3.32.0; >= 4.0.0.beta.1, < 4.0.0.beta.51 · CVE-2026-55518 · GHSA-8fq9-273g-6mrg
Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities · Upgrade to 6.9.10 or later · <= 6.9.9 · CVE-2026-55471 · GHSA-2f55-g35j-5jmf
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +3 · Upgrade all 4 to 6.9.10 or later · <= 6.9.9 · CVE-2026-55470 · GHSA-fxj4-p9xp-37v5
PyPI langflow · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2026-55450 · GHSA-x223-p2gf-v735 · amended
Maven com.github.jknack:handlebars · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-55760 · GHSA-r4gv-qr8j-p3pg
Packagist filament/forms · Upgrade to 3.3.53 or later · >= 3.0.0, < 3.3.53 · CVE-2026-55409 · GHSA-m9cv-24rx-8mv7 · amended
Maven dev.langchain4j:langchain4j-mariadb +1 · Upgrade all 2 to 1.16.3-beta26 (pre-release), 1.11.8-beta19 (pre-release), 1.5.1-beta11 (pre-release) or 1.2.1-beta8 (pre-release) by release line · <= 1.2.0-beta8; >= 1.3.0-beta9, <= 1.5.0-beta11; >= 1.6.0-beta12, <= 1.11.7-beta19; >= 1.12.1-beta21, <= 1.16.2-beta26 · CVE-2026-55405 · GHSA-2mfg-cc43-9pcj
Maven org.apache.shiro:shiro-core · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.1 by release line · < 2.2.1; >= 3.0.0-alpha-0, < 3.0.0-alpha-2 · CVE-2026-49268 · GHSA-x96m-rh44-vgv8
PyPI apache-airflow-providers-sftp · Upgrade to 5.8.1 or later · < 5.8.1 · CVE-2026-50203 · GHSA-qf38-jq28-3ccq · amended
/v2 experimental interface lacks permission checksMaven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32967 · GHSA-85g9-8j9g-p486
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32966 · GHSA-r989-cjhx-3v49
npm multer · Upgrade to 3.0.0-alpha.2 (pre-release) or 2.2.0 by release line · >= 1.0.0, < 2.2.0; >= 3.0.0-alpha.1, < 3.0.0-alpha.2 · CVE-2026-5079 · GHSA-72gw-mp4g-v24j · amended
extensionsRequired in Gitea 3D File ViewerGo code.gitea.io/gitea · Upgrade to 1.26.0 or later · >= 1.25.0, < 1.26.0 · CVE-2026-28737 · GHSA-9cpj-qc93-vw8v
/api/v1/user self routesGo code.gitea.io/gitea · Upgrade to 1.26.2 or later · >= 1.22.3, <= 1.26.1 · CVE-2026-24791 · GHSA-wrr5-99h5-gq57
Go code.gitea.io/gitea · Upgrade to 1.26.0 or later · < 1.26.0 · CVE-2026-22555 · GHSA-fhx7-m96w-mv29
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54018 · GHSA-jrfp-m64g-pcwv · amended
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54017 · GHSA-r2wg-2mcr-66rv · amended
npm openclaw · Upgrade to 2026.5.12 or later · < 2026.5.12 · CVE-2026-53840 · GHSA-rjxq-qqhf-8hwh · amended
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54013 · GHSA-v2qm-5wxj-qhj7 · amended
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54012 · GHSA-vjqm-6gcc-62cr · amended
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54011 · GHSA-v8qj-hxv7-mgvv · amended
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54010 · GHSA-vrhc-3fr6-pc3c · amended
_process_picture_url (incomplete-fix sibling of CVE-2026-45401)PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54008 · GHSA-226f-f24g-524w · amended
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54007 · GHSA-3vv5-8xxp-4f55 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.