Critical, CVSS 9.9
Langflow: Code Injection Vulnerability in Code Validation Endpoint
PyPI langflow · Upgrade to 1.10.1rc0 (pre-release) or later · >= 1.0.0, < 1.10.1rc0 · CVE-2026-7873 · GHSA-v798-mcc6-2m3m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.8
Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2025-10996 · GHSA-j35x-w4gj-pf7w · amended
- High, CVSS 8.7
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
Go github.com/sigstore/fulcio · Upgrade to 1.8.6 or later · <= 1.8.5 · CVE-2026-49478 · GHSA-f5mr-q85p-6hh6
- High, CVSS 8.6
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
npm @adonisjs/bodyparser · Upgrade to 11.0.3 or 10.1.5 by release line · >= 10.1.3, <= 10.1.4; >= 11.0.0-next.9, <= 11.0.1 · CVE-2026-48795 · GHSA-qcm7-3vpr-hj5h · amended
- High, CVSS 7.7
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
PyPI deeptutor · Upgrade to 1.4.10 or later · < 1.4.10 · CVE-2026-58168 · GHSA-jg88-rvpc-qvxj · amended
- Critical, CVSS 9.9
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50566 · GHSA-m63v-2g9w-2w6v
- Critical, CVSS 9.9
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50564 · GHSA-gx55-f84r-v3r7
- Critical, CVSS 9.9
Fission Container Executor Function PodSpec Injection Leading to Node Escape
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50563 · GHSA-v455-mv2v-5g92
- Critical, CVSS 9.9
Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50545 · GHSA-wmgg-3p4h-48x7
- High, CVSS 8.5
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49824 · GHSA-cvw6-gfvv-953q
- High, CVSS 7.7
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49823 · GHSA-3r8v-2xmj-5c39
- High, CVSS 7.7
Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49822 · GHSA-gc3j-79f2-7vvw
- High, CVSS 7.7
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49821 · GHSA-vjhc-cf4p-72q4
- High, CVSS 8.1
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · GHSA-7m8x-qg2j-4m3v
- High, CVSS 8.8
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
npm @cedar-policy/authorization-for-expressjs · Upgrade to 0.3.0 or later · <= 0.2.0 · CVE-2026-49473 · GHSA-g4w6-vmgf-xqvx · amended
- High, CVSS 8.5
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Packagist paymenter/paymenter · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-47198 · GHSA-5q4q-834j-g8g4
- High, CVSS 7.5
Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
NuGet microsoft.openapi · Upgrade to 3.5.4 or 2.7.5 by release line · >= 3.0.0, <= 3.5.3; >= 2.0.0-preview.11, <= 2.7.4 · CVE-2026-49451 · GHSA-v5pm-xwqc-g5wc
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-54475 · GHSA-mhp6-f224-j2c3 · amended
- High, CVSS 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
Bitnami activemq +4 · Upgrade all 5 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-53917 · GHSA-f77w-px59-cqf5 · amended
- High, CVSS 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49432 · GHSA-xjwq-9jw5-jf7w · amended
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49434 · GHSA-h5gm-rvw6-2xpx · amended
- High, CVSS 8.1
Apache ActiveMQ Improper Authorization vulnerability
Bitnami activemq +1 · Upgrade all 2 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49877 · GHSA-f892-4h9f-j7g9 · amended
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · >= 5.19.7, < 5.19.8; >= 6.2.6, < 6.2.7 · CVE-2026-50750 · GHSA-9qj4-v6r6-3wmx · amended
- High, CVSS 7.5
Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-50734 · GHSA-7259-vf48-52q3 · amended
- High, CVSS 7.5
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
PyPI nltk · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-12243 · GHSA-m42h-3232-vpv3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.