jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.1.0, < 3.1.4 · +1 more package · CVE-2026-54515 · GHSA-5jmj-h7xm-6q6v
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
26–50 of 61 matching · newest first
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.1.0, < 3.1.4 · +1 more package · CVE-2026-54515 · GHSA-5jmj-h7xm-6q6v
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54514 · GHSA-hgj6-7826-r7m5 · amended
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54513 · GHSA-rmj7-2vxq-3g9f
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54512 · GHSA-j3rv-43j4-c7qm · amended
Maven com.fasterxml.jackson.core:jackson-databind · Upgrade to 2.14.0 or later · >= 2.10.0, <= 2.13.5 · CVE-2026-50193 · GHSA-3wrr-7qpf-2prh
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-54518 · GHSA-rcqc-6cw3-h962
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · GHSA-phv5-334h-mxcw · amended
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · GHSA-qxvg-h7q2-hcxh · amended
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-55863 · GHSA-j67x-q29f-qcvv · amended
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-55488 · GHSA-rw9q-97r9-8gvh · amended
PyPI swift · Upgrade to 2.37.2 or later · < 2.37.2 · CVE-2026-50221 · GHSA-h8rc-w822-q8vq · amended
crates.io mise · Upgrade to 2026.6.4 or later · >= 2026.3.15, < 2026.6.4 · CVE-2026-55448 · GHSA-29hf-rm4x-xxph · amended
crates.io mise · Upgrade to 2026.6.4 or later · < 2026.6.4 · CVE-2026-55441 · GHSA-77g9-363w-rccq
crates.io mise · Upgrade to 2026.6.1 or later · <= 2026.5.16 · CVE-2026-54557 · GHSA-f94h-j2qg-fxw3
PyPI octoprint · Upgrade to 2.0.0rc3 (pre-release) or 1.11.8 by release line · <= 1.11.7; >= 2.0.0rc1, <= 2.0.0rc2 · CVE-2026-54134 · GHSA-j4h9-pm27-4rfw · amended
secure_popen redirection and chaining operators in AMP command configurationPyPI glances · Upgrade to 4.5.5 or later · >= 4.0.8, < 4.5.5 · CVE-2026-53925 · GHSA-3vwc-qwhc-3mj7 · amended
npm @budibase/server · Upgrade to 3.39.12 or later · < 3.39.12 · CVE-2026-54350 · GHSA-8qv3-p479-cj62 · amended
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52816 · GHSA-3w28-36p9-w929
Maven org.openidentityplatform.openam:openam-federation · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45049 · GHSA-r9pv-5rpp-vm8g · amended
Maven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45048 · GHSA-vvhj-w2jq-263q · amended
PyPI octoprint · Upgrade to 2.0.0rc3 (pre-release) or 1.11.8 by release line · <= 1.11.7; >= 2.0.0rc1, <= 2.0.0rc2 · CVE-2026-35163 · GHSA-p6qx-ghxm-389h · amended
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52815 · GHSA-744x-3838-5r56
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52814 · GHSA-xp79-5mx3-jx52
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52813 · GHSA-c39w-43gm-34h5
Go gogs.io/gogs · Upgrade to 0.14.3 or later · < 0.14.3 · CVE-2026-52812 · GHSA-6p9m-q3jp-47h4
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.