High, CVSS 7.5
python-socketio: Binary attachment accumulation can cause denial of service
PyPI python-socketio · Upgrade to 5.16.2 or later · <= 5.16.1 · CVE-2026-48804 · GHSA-5w7q-77mv-v69f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
python-engineio has unbound thread allocation that can cause denial of service
PyPI python-engineio · Upgrade to 4.13.2 or later · <= 4.13.1 · CVE-2026-48802 · GHSA-cgwc-pv48-fhj5 · amended
- High, CVSS 7.5
python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
PyPI python-engineio · Upgrade to 4.13.2 or later · <= 4.13.1 · CVE-2026-48809 · GHSA-m9gh-vj53-gvh9 · amended
- High, CVSS 8.7
LinkifyIt#match scan loop has quadratic algorithmic complexity
npm linkify-it · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-48801 · GHSA-22p9-wv53-3rq4 · amended
- Critical, CVSS 9.3
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
npm @mcptoolshop/backpropagate +1 · Upgrade all 2 to 1.2.0 or later · >= 1.1.0, < 1.2.0 · CVE-2026-48797 · GHSA-f65r-h4g3-3h9h · amended
- High, CVSS 7.5
Hysteria: http large header with sniff cause server DoS
Go github.com/apernet/hysteria · Upgrade to 2.9.2 or later · < 2.9.2 · GHSA-jqc5-2p7q-fqfc
- High, CVSS 7.5
Hysteria vulnerable to server crash when max_datagram_frame_size very small
Go github.com/apernet/hysteria · Upgrade to 2.9.2 or later · < 2.9.2 · GHSA-qh5x-rfwf-rvfv
- High, CVSS 7.4
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
Go github.com/apernet/hysteria/core/v2 · Upgrade to 2.9.2 or later · >= 2.0.0, <= 2.9.1 · GHSA-vgrc-hq28-p3xp
- High, CVSS 8.2
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Go github.com/umputun/remark42 · Upgrade to 1.16.0 or later · >= 1.6.0, < 1.16.0 · CVE-2026-48788 · GHSA-4c8j-mgm4-qqvp
- Critical, CVSS 9.9
Incus has an arbitrary file write on its client due to trusted image hash
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48769 · GHSA-f6m5-xw2g-xc4x · amended
- Critical, CVSS 9.9
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48755 · GHSA-v6mj-8pf4-hhw4 · amended
- Critical, CVSS 9.9
Incus has an arbitrary file write via path traversal in S3 multipart upload
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-48753 · GHSA-ccjc-4qc3-jxqc
- Critical, CVSS 9.9
Incus has arbitrary file read+write on host via templates/ symlink in malicious image
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48752 · GHSA-vxp5-584q-c479 · amended
- Critical, CVSS 9.9
Incus has a restricted project bypass leading to arbitrary command execution
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48751 · GHSA-48q5-w887-33wv · amended
- Critical, CVSS 9.9
Incus has an arbitrary file write on host via
exec-outputsymlink in crafted imageGo github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48750 · GHSA-73hr-m85f-64v9 · amended
- Critical, CVSS 9.9
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48749 · GHSA-2q3f-q5pq-g8wv · amended
- High, CVSS 8.7
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
Maven org.openidentityplatform.openam:openam-auth-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46623 · GHSA-gf57-4mp6-m85x · amended
- High, CVSS 8.7
OpenAM Authentication Bypass via MSISDN LDAP Injection
Maven org.openidentityplatform.openam:openam-auth-msisdn · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46619 · GHSA-xq73-fvmr-jvmm · amended
- High, CVSS 7.2
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in
out_httpRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44161 · GHSA-72f5-rr8c-r6gr
- High, CVSS 7.5
Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in
in_httpandin_forwardRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44160 · GHSA-j9cw-hwqf-85w7
- High, CVSS 7.5
Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44025 · GHSA-pr7j-96cj-549h
- Critical, CVSS 9.8
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in
${tag}PlaceholderRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44024 · GHSA-44hj-4m45-frj3
- High, CVSS 7.3
Apache Kerby has a bypass the Kerberos pre-authentication check
Maven org.apache.kerby:kerb-server · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-57915 · GHSA-262p-fj3f-xh7v · amended
- Critical, CVSS 9.1
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.6 or 1.3.6 by release line · >= 2.0.0, < 2.0.6; >= 1.0.0, < 1.3.6 · CVE-2025-55017 · GHSA-xrvj-h9w2-3q69 · amended
- Critical, CVSS 9.1
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.7 or 1.3.6 by release line · >= 1.0.0, < 1.3.6; >= 2.0.0, < 2.0.7 · CVE-2025-64152 · GHSA-h548-jhj8-q85h · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.