Unrated
Nokogiri: Possible Use-After-Free in XInclude Processing
RubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-wfpw-mmfh-qq69
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
126–150 of 162 matching · newest first
- Low, CVSS 1.7
Nokogiri: Possible Use-After-Free when directly using
NokogirI::XML::XPathContextbeyond document lifetimeRubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-p67v-3w7g-wjg7
- Low, CVSS 1.7
Nokogiri: Possible Use-After-Free when setting
Document#root=to an invalid node typeRubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-wjv4-x9w8-wm3h
- Medium, CVSS 6.3
Nokogiri: Possible Out-of-Bounds Read in
Nokogiri::XML::NodeSet#[]RubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-5prr-v3j2-97mh
- Low, CVSS 1.7
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
RubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-9cv2-cfxc-v4v2
- Low, CVSS 2.6
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
RubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-8678-w3jw-xfc2
- Low, CVSS 1.7
Nokogiri: Possible Use-After-Free when
Nokogiri::XML::Document#encoding=raises an exceptionRubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-5v8h-3h3q-446p
- High, CVSS 7.5
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
Go github.com/opentofu/opentofu · Upgrade to 1.12.3 or 1.11.10 by release line · < 1.11.10; >= 1.12.0-beta1, < 1.12.3 · GHSA-q7j3-v8qv-22vq
- High, CVSS 8.8
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
npm agentic-flow · Upgrade to 2.0.14 or later · <= 2.0.13 · CVE-2026-58195 · GHSA-vcv2-r9jh-99m5 · amended
- High, CVSS 8.6
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
PyPI ouroboros-ai · Upgrade to 0.42.1 or later · <= 0.42.0 · CVE-2026-66065 · GHSA-jv2h-4p9v-wf5w · amended
- Medium, CVSS 5.1
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
PyPI jupyterlab · Upgrade to 4.5.9 or later · <= 4.5.8 · CVE-2026-67338 · GHSA-vmhf-c436-hxj4 · amended
- High, CVSS 8.6
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
PyPI agent-coderag · Upgrade to 1.3.1 or later · <= 1.3.0 · CVE-2026-57586 · GHSA-wg5p-8h9p-3mr7 · amended
- Medium, CVSS 6.2
Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind
Go github.com/entireio/cli · Upgrade to 0.7.7 or later · <= 0.7.6 · GHSA-2h46-9x5w-4wf7
- High, CVSS 8.7
parse-server: Denial of service via exponential-time processing of deeply nested query operators
npm parse-server · Upgrade to 9.9.1-alpha.12 (pre-release) or 8.6.82 by release line · >= 9.0.0, < 9.9.1-alpha.12; < 8.6.82 · CVE-2026-57480 · GHSA-cgxm-vr2f-6fj8 · amended
- High, CVSS 8.4
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
PyPI bedrock-agentcore · Upgrade to 1.6.1 or later · >= 1.1.3, < 1.6.1 · CVE-2026-12530 · GHSA-6rfw-mq36-jm8h · amended
- Medium, CVSS 6.1
tract: Arbitrary file read via unsanitized ONNX external_data
location(path traversal) on model load in tract-onnxcrates.io tract-onnx · Upgrade to 0.23.2, 0.22.3 or 0.21.17 by release line · < 0.21.17; >= 0.22.0, < 0.22.3; >= 0.23.0, < 0.23.2 · CVE-2026-55832 · GHSA-h668-6x6g-f8r5
- High, CVSS 8.8
CedarJava has policy injection vulnerability
Maven com.cedarpolicy:cedar-java · Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line · < 2.3.6; >= 3.1.2, < 3.4.1; >= 4.0.0, < 4.9.0 · CVE-2026-55773 · GHSA-qmch-v2q9-wg4p
- High, CVSS 8.8
CedarJava has type confusion vulnerability
Maven com.cedarpolicy:cedar-java · Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line · < 2.3.6; >= 3.1.2, < 3.4.1; >= 4.0.0, < 4.9.0 · CVE-2026-55772 · GHSA-93g4-m6xv-cmvr
- Medium, CVSS 5.8
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
Packagist guzzlehttp/guzzle · Upgrade to 7.12.1 or later · < 7.12.1 · CVE-2026-55767 · GHSA-cwxw-98qj-8qjx
- Medium, CVSS 4.8
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Packagist guzzlehttp/psr7 · Upgrade to 2.12.1 or later · < 2.12.1 · CVE-2026-55766 · GHSA-vm85-hxw5-5432
- Medium, CVSS 6.8
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
Go github.com/openfga/openfga · Upgrade to 1.18.0 or later · <= 1.17.1 · CVE-2026-55689 · GHSA-hcxc-wf8j-23hv
- Low, CVSS 3.7
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
npm undici · Upgrade to 8.5.0, 7.28.0 or 6.27.0 by release line · < 6.27.0; >= 7.0.0, < 7.28.0; >= 8.0.0, < 8.5.0 · CVE-2026-11525 · GHSA-g8m3-5g58-fq7m · amended
- High, CVSS 7.5
undici WebSocket client vulnerable to denial of service via fragment count bypass
npm undici · Upgrade to 8.5.0, 7.28.0 or 6.27.0 by release line · < 6.27.0; >= 7.0.0, < 7.28.0; >= 8.0.0, < 8.5.0 · CVE-2026-12151 · GHSA-vxpw-j846-p89q · amended
- Medium, CVSS 5.9
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
npm undici · Upgrade to 8.5.0, 7.28.0 or 6.27.0 by release line · < 6.27.0; >= 7.0.0, < 7.28.0; >= 8.0.0, < 8.5.0 · CVE-2026-9679 · GHSA-p88m-4jfj-68fv · amended
- High, CVSS 7.5
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
npm undici · Upgrade to 8.2.0 or 7.28.0 by release line · >= 7.23.0, < 7.28.0; >= 8.0.0, < 8.2.0 · CVE-2026-6734 · GHSA-hm92-r4w5-c3mj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.