Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
PyPI hermes-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53869 · GHSA-4pqm-j46f-795x · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 68 matching · newest first
PyPI hermes-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53869 · GHSA-4pqm-j46f-795x · amended
PyPI hermes-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53870 · GHSA-99f9-j8r3-p853 · amended
Packagist cakephp/authentication · Upgrade to 4.1.1, 3.3.6 or 2.11.1 by release line · >= 4.0.0, < 4.1.1; >= 3.0.0, < 3.3.6; < 2.11.1 · CVE-2026-55590 · GHSA-hhpq-7wg4-36jm
RubyGems avo · Upgrade to 4.0.0.beta.51 or 3.32.1 by release line · <= 3.32.0; >= 4.0.0.beta.1, < 4.0.0.beta.51 · CVE-2026-55518 · GHSA-8fq9-273g-6mrg
crates.io deno · Upgrade to 2.7.5 or later · <= 2.7.4 · CVE-2026-55517 · GHSA-x2qc-cmh9-f4hf
Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities · Upgrade to 6.9.10 or later · <= 6.9.9 · CVE-2026-55471 · GHSA-2f55-g35j-5jmf
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +3 · Upgrade all 4 to 6.9.10 or later · <= 6.9.9 · CVE-2026-55470 · GHSA-fxj4-p9xp-37v5
PyPI langflow · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2026-55450 · GHSA-x223-p2gf-v735 · amended
Maven com.github.jknack:handlebars · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-55760 · GHSA-r4gv-qr8j-p3pg
Packagist filament/forms · Upgrade to 3.3.53 or later · >= 3.0.0, < 3.3.53 · CVE-2026-55409 · GHSA-m9cv-24rx-8mv7 · amended
Maven dev.langchain4j:langchain4j-mariadb +1 · Upgrade all 2 to 1.16.3-beta26 (pre-release), 1.11.8-beta19 (pre-release), 1.5.1-beta11 (pre-release) or 1.2.1-beta8 (pre-release) by release line · <= 1.2.0-beta8; >= 1.3.0-beta9, <= 1.5.0-beta11; >= 1.6.0-beta12, <= 1.11.7-beta19; >= 1.12.1-beta21, <= 1.16.2-beta26 · CVE-2026-55405 · GHSA-2mfg-cc43-9pcj
RubyGems katello · Upgrade to 4.21.0.rc1 or later · < 4.21.0.rc1 · CVE-2026-12515 · GHSA-c43c-rf7g-5xpg
Maven org.apache.shiro:shiro-core · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.1 by release line · < 2.2.1; >= 3.0.0-alpha-0, < 3.0.0-alpha-2 · CVE-2026-49268 · GHSA-x96m-rh44-vgv8
PyPI apache-airflow-providers-sftp · Upgrade to 5.8.1 or later · < 5.8.1 · CVE-2026-50203 · GHSA-qf38-jq28-3ccq · amended
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-47340 · GHSA-694g-j8pj-cjj5
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-42357 · GHSA-wv7f-c794-82v6
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-41280 · GHSA-wh3w-v6gj-fqh2
/v2 experimental interface lacks permission checksMaven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32967 · GHSA-85g9-8j9g-p486
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32966 · GHSA-r989-cjhx-3v49
Go github.com/projectcapsule/capsule · Upgrade to 0.13.6 or later · >= 0.13.0, < 0.13.6 · CVE-2026-55636 · GHSA-gwxr-7h77-7777
npm webpack-dev-server · Upgrade to 5.2.5 or later · < 5.2.5 · CVE-2026-9595 · GHSA-mx8g-39q3-5c79 · amended
npm multer · Upgrade to 3.0.0-alpha.2 (pre-release) or 2.2.0 by release line · >= 1.0.0, < 2.2.0; >= 3.0.0-alpha.1, < 3.0.0-alpha.2 · CVE-2026-5079 · GHSA-72gw-mp4g-v24j · amended
npm multer · Upgrade to 3.0.0-alpha.2 (pre-release) or 2.2.0 by release line · >= 2.0.0-alpha.1, < 2.2.0; >= 3.0.0-alpha.1, < 3.0.0-alpha.2 · CVE-2026-5038 · GHSA-3p4h-7m6x-2hcm · amended
Go github.com/go-gitea/gitea · Upgrade to 1.26.0 or later · <= 1.25.4 · CVE-2026-25779 · GHSA-j5r2-4c8j-xc3m
extensionsRequired in Gitea 3D File ViewerGo code.gitea.io/gitea · Upgrade to 1.26.0 or later · >= 1.25.0, < 1.26.0 · CVE-2026-28737 · GHSA-9cpj-qc93-vw8v
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.