High, CVSS 7.7
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49821 · GHSA-vjhc-cf4p-72q4
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–42 of 42 matching · newest first
- High, CVSS 8.1
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · GHSA-7m8x-qg2j-4m3v
- Low, CVSS 2.0
Sigstore Java has a vulnerability with bundle verification of integratedTime
Maven dev.sigstore:sigstore-java · Upgrade to 2.1.0 or later · >= 2.0.0, <= 2.0.0 · CVE-2026-48791 · GHSA-qqw8-7c2r-jxch
- High, CVSS 8.8
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
npm @cedar-policy/authorization-for-expressjs · Upgrade to 0.3.0 or later · <= 0.2.0 · CVE-2026-49473 · GHSA-g4w6-vmgf-xqvx · amended
- Unrated
Kahi has privilege-drop and socket/log permission issues
Go github.com/kahiteam/kahi · Upgrade to 0.1.0-alpha.9 (pre-release) or later · <= 0.1.0-alpha.8 · GHSA-55f6-4pr5-c7m5
- High, CVSS 8.5
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Packagist paymenter/paymenter · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-47198 · GHSA-5q4q-834j-g8g4
- High, CVSS 7.5
Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
NuGet microsoft.openapi · Upgrade to 3.5.4 or 2.7.5 by release line · >= 3.0.0, <= 3.5.3; >= 2.0.0-preview.11, <= 2.7.4 · CVE-2026-49451 · GHSA-v5pm-xwqc-g5wc
- Medium, CVSS 5.4
Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation
Maven org.apache.gravitino:catalog-jdbc-common · Upgrade to 1.0.0 or later · >= 0.5.0, < 1.0.0 · CVE-2025-53648 · GHSA-7ph3-grqh-pv9v · amended
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-54475 · GHSA-mhp6-f224-j2c3 · amended
- High, CVSS 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
Bitnami activemq +4 · Upgrade all 5 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-53917 · GHSA-f77w-px59-cqf5 · amended
- High, CVSS 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49432 · GHSA-xjwq-9jw5-jf7w · amended
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49434 · GHSA-h5gm-rvw6-2xpx · amended
- High, CVSS 8.1
Apache ActiveMQ Improper Authorization vulnerability
Bitnami activemq +1 · Upgrade all 2 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49877 · GHSA-f892-4h9f-j7g9 · amended
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · >= 5.19.7, < 5.19.8; >= 6.2.6, < 6.2.7 · CVE-2026-50750 · GHSA-9qj4-v6r6-3wmx · amended
- High, CVSS 7.5
Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-50734 · GHSA-7259-vf48-52q3 · amended
- Medium, CVSS 6.1
Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting
Bitnami activemq +2 · Upgrade all 3 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-52760 · GHSA-j548-68g5-9j7x · amended
- High, CVSS 7.5
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
PyPI nltk · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-12243 · GHSA-m42h-3232-vpv3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.