Critical, CVSS 9.8
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in ${tag} Placeholder
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44024 · GHSA-44hj-4m45-frj3
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
101–113 of 113 matching · newest first
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in
- Medium, CVSS 5.9
ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53462 · GHSA-px7q-ggqj-hcf2
- Medium, CVSS 5.4
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
Go github.com/mattermost/mattermost/server/public · Upgrade to 0.1.22 or later · < 0.1.22 · CVE-2026-13426 · GHSA-72v2-v53v-4qmm · amended
- Medium, CVSS 6.7
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
Maven org.jetbrains.kotlin:kotlin-gradle-plugin · Upgrade to 2.4.20-Beta1 (pre-release) or later · < 2.4.20-Beta1 · CVE-2026-53914 · GHSA-r937-wjx7-w2jp
- High, CVSS 7.3
Apache Kerby has a bypass the Kerberos pre-authentication check
Maven org.apache.kerby:kerb-server · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-57915 · GHSA-262p-fj3f-xh7v · amended
- Critical, CVSS 9.1
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.6 or 1.3.6 by release line · >= 2.0.0, < 2.0.6; >= 1.0.0, < 1.3.6 · CVE-2025-55017 · GHSA-xrvj-h9w2-3q69 · amended
- Critical, CVSS 9.1
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.7 or 1.3.6 by release line · >= 1.0.0, < 1.3.6; >= 2.0.0, < 2.0.7 · CVE-2025-64152 · GHSA-h548-jhj8-q85h · amended
- Medium, CVSS 6.5
Apache Kerby vulnerable to denial of service
Maven org.apache.kerby:kerby-asn1 · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-57914 · GHSA-x6vc-x4v4-hjhr · amended
- High, CVSS 7.5
Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
PyPI apache-airflow-providers-ftp · Upgrade to 3.15.1 or later · < 3.15.1 · CVE-2026-49486 · GHSA-fgch-86x8-fv43 · amended
- Medium, CVSS 6.4
KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
Go kubevirt.io/kubevirt · Upgrade to 1.10.0-rc.0 (pre-release) or later · < 1.10.0-rc.0 · CVE-2026-13318 · GHSA-cgm6-wvp9-4g5h
- Medium, CVSS 6.5
Apicurio Registry is vulnerable to denial of service through XML entity expansion
Maven io.apicurio:apicurio-registry-schema-util-xml · Upgrade to 3.3.1 or 3.2.6 by release line · >= 3.3.0, < 3.3.1; < 3.2.6 · CVE-2026-12993 · GHSA-748j-wm96-4wh5 · amended
- High, CVSS 8.5
Apicurio Registry utilities allow SSRF and denial of service through XML parsing
Maven io.apicurio:apicurio-registry-schema-util-common · Upgrade to 3.3.1 or 3.2.6 by release line · >= 3.3.0, < 3.3.1; < 3.2.6 · CVE-2026-12975 · GHSA-7g64-f2hm-vjxp · amended
- High, CVSS 7.4
Apicurio Registry allows upload of WSDL raising HTTP request
Maven io.apicurio:apicurio-registry-schema-util-wsdl · Upgrade to 3.3.1 or 3.2.6 by release line · >= 3.3.0, < 3.3.1; < 3.2.6 · CVE-2026-12992 · GHSA-rcmh-vfq7-8gf4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.