Critical, CVSS 9.9
Langflow: Code Injection Vulnerability in Code Validation Endpoint
PyPI langflow · Upgrade to 1.10.1rc0 (pre-release) or later · >= 1.0.0, < 1.10.1rc0 · CVE-2026-7873 · GHSA-v798-mcc6-2m3m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 42 matching · newest first
- High, CVSS 7.8
Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2025-10996 · GHSA-j35x-w4gj-pf7w · amended
- Low, CVSS 1.9
Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2025-10995 · GHSA-8j3x-m868-cpw8 · amended
- Medium, CVSS 5.3
Paymenter has race condition in payWithCredit() that enables credit double-spend
Packagist paymenter/paymenter · Upgrade to 1.5.5 or later · <= 1.5.4 · CVE-2026-55219 · GHSA-pgcq-8grm-5rx9
- Low, CVSS 1.9
Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2025-10994 · GHSA-pp85-5j63-xpq3 · amended
- Low, CVSS 2.1
Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-3408 · GHSA-rxpr-wq63-jr7p · amended
- Low, CVSS 2.1
Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-2705 · GHSA-4w5w-4fhm-q483 · amended
- Low, CVSS 2.1
Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-2704 · GHSA-6xw4-2g22-26h8 · amended
- Unrated
Twig: Sandbox property allowlist bypass via the
columnfilter underSourcePolicyInterfacePackagist twig/twig · Upgrade to 3.27.0 or later · <= 3.26.0 · CVE-2026-48808 · GHSA-h8vq-8gpg-mhcg
- Unrated
Twig: Sandbox
__toString()policy bypass viaTraversableinjoinandreplacefiltersPackagist twig/twig · Upgrade to 3.27.0 or later · <= 3.26.0 · CVE-2026-48807 · GHSA-8x9c-rmqh-456c
- Unrated
Twig: Sandbox
__toString()policy bypass via dynamic mapping keysPackagist twig/twig · Upgrade to 3.27.0 or later · <= 3.26.0 · CVE-2026-48806 · GHSA-5v5v-ww74-355v
- Unrated
Twig: Sandbox state regression in deprecated internal wrappers in
src/Resources/core.phpPackagist twig/twig · Upgrade to 3.27.0 or later · <= 3.26.0 · CVE-2026-48805 · GHSA-p42q-9prx-q5wq
- High, CVSS 8.7
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
Go github.com/sigstore/fulcio · Upgrade to 1.8.6 or later · <= 1.8.5 · CVE-2026-49478 · GHSA-f5mr-q85p-6hh6
- Medium, CVSS 5.3
CefSharp.Common:
FolderSchemeHandlerFactorypath boundary check can expose files outside the configured root folderNuGet cefsharp.common · Upgrade to 148.0.90 or later · < 148.0.90 · CVE-2026-48796 · GHSA-85jm-cwp2-mvpv
- High, CVSS 8.6
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
npm @adonisjs/bodyparser · Upgrade to 11.0.3 or 10.1.5 by release line · >= 10.1.3, <= 10.1.4; >= 11.0.0-next.9, <= 11.0.1 · CVE-2026-48795 · GHSA-qcm7-3vpr-hj5h · amended
- Medium, CVSS 4.7
Probo has an open redirect bypass via path normalization
Go go.probo.inc/probo · Upgrade to 0.204.0 or later · < 0.204.0 · CVE-2026-49820 · GHSA-x7qq-m748-8p2c
- High, CVSS 7.7
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
PyPI deeptutor · Upgrade to 1.4.10 or later · < 1.4.10 · CVE-2026-58168 · GHSA-jg88-rvpc-qvxj · amended
- Critical, CVSS 9.9
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50566 · GHSA-m63v-2g9w-2w6v
- Medium, CVSS 4.9
Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50565 · GHSA-8wcj-mfrc-jx5q
- Critical, CVSS 9.9
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50564 · GHSA-gx55-f84r-v3r7
- Critical, CVSS 9.9
Fission Container Executor Function PodSpec Injection Leading to Node Escape
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50563 · GHSA-v455-mv2v-5g92
- Critical, CVSS 9.9
Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50545 · GHSA-wmgg-3p4h-48x7
- High, CVSS 8.5
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49824 · GHSA-cvw6-gfvv-953q
- High, CVSS 7.7
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49823 · GHSA-3r8v-2xmj-5c39
- High, CVSS 7.7
Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49822 · GHSA-gc3j-79f2-7vvw
A vendor fix does not resolve your finding until you verify it in your own systems.