High, CVSS 7.5
Hysteria: http large header with sniff cause server DoS
Go github.com/apernet/hysteria · Upgrade to 2.9.2 or later · < 2.9.2 · GHSA-jqc5-2p7q-fqfc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–100 of 113 matching · newest first
- High, CVSS 7.5
Hysteria vulnerable to server crash when max_datagram_frame_size very small
Go github.com/apernet/hysteria · Upgrade to 2.9.2 or later · < 2.9.2 · GHSA-qh5x-rfwf-rvfv
- High, CVSS 7.4
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
Go github.com/apernet/hysteria/core/v2 · Upgrade to 2.9.2 or later · >= 2.0.0, <= 2.9.1 · GHSA-vgrc-hq28-p3xp
- Medium, CVSS 6.9
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
npm @cyclonedx/cdxgen · Upgrade to 12.4.3 or later · < 12.4.3 · GHSA-5vwr-qchf-q4pf · amended
- High, CVSS 8.2
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Go github.com/umputun/remark42 · Upgrade to 1.16.0 or later · >= 1.6.0, < 1.16.0 · CVE-2026-48788 · GHSA-4c8j-mgm4-qqvp
- Medium, CVSS 4.8
Apptainer has incorrect path matching for 'limit container paths' directive
Go github.com/apptainer/apptainer · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-48785 · GHSA-cr2j-534f-mf3g
- Medium, CVSS 6.8
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
PyPI pydantic-ai +1 · Upgrade all 2 to 2.0.0b3 (pre-release) or 1.102.0 by release line · >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3 · CVE-2026-48782 · GHSA-cg7w-rg45-pc59 · amended
- Critical, CVSS 9.9
Incus has an arbitrary file write on its client due to trusted image hash
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48769 · GHSA-f6m5-xw2g-xc4x · amended
- Medium, CVSS 5.4
@sigstore/core has DSSE payloadType type-binding failure
npm @sigstore/core · Upgrade to 3.2.1 or later · <= 3.2.0 · CVE-2026-48758 · GHSA-jfc7-64v2-mr8c · amended
- Low, CVSS 2.1
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-48756 · GHSA-xhqx-mgh3-3h7q
- Critical, CVSS 9.9
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48755 · GHSA-v6mj-8pf4-hhw4 · amended
- Low, CVSS 2.1
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-48754 · GHSA-4xg6-52mh-fpw8
- Critical, CVSS 9.9
Incus has an arbitrary file write via path traversal in S3 multipart upload
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.1.0 or later · < 7.1.0 · CVE-2026-48753 · GHSA-ccjc-4qc3-jxqc
- Critical, CVSS 9.9
Incus has arbitrary file read+write on host via templates/ symlink in malicious image
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48752 · GHSA-vxp5-584q-c479 · amended
- Critical, CVSS 9.9
Incus has a restricted project bypass leading to arbitrary command execution
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48751 · GHSA-48q5-w887-33wv · amended
- Critical, CVSS 9.9
Incus has an arbitrary file write on host via
exec-outputsymlink in crafted imageGo github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48750 · GHSA-73hr-m85f-64v9 · amended
- Critical, CVSS 9.9
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48749 · GHSA-2q3f-q5pq-g8wv · amended
- Medium, CVSS 4.3
ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53463 · GHSA-p9rq-q46c-g4x6
- High, CVSS 8.7
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
Maven org.openidentityplatform.openam:openam-auth-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46623 · GHSA-gf57-4mp6-m85x · amended
- High, CVSS 8.7
OpenAM Authentication Bypass via MSISDN LDAP Injection
Maven org.openidentityplatform.openam:openam-auth-msisdn · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46619 · GHSA-xq73-fvmr-jvmm · amended
- Medium, CVSS 5.3
fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in
in_opentelemetryRubyGems fluent-plugin-opentelemetry · Upgrade to 0.5.3 or later · <= 0.5.2 · CVE-2026-44163 · GHSA-2jc5-xhx8-qj6h
- Low, CVSS 2.7
fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in
in_s3RubyGems fluent-plugin-s3 · Upgrade to 1.8.5 or later · >= 0.7.0, <= 1.8.4 · CVE-2026-44162 · GHSA-xv9w-7v6q-hpjh
- High, CVSS 7.2
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in
out_httpRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44161 · GHSA-72f5-rr8c-r6gr
- High, CVSS 7.5
Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in
in_httpandin_forwardRubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44160 · GHSA-j9cw-hwqf-85w7
- High, CVSS 7.5
Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44025 · GHSA-pr7j-96cj-549h
A vendor fix does not resolve your finding until you verify it in your own systems.