Unrated
CrateDB's Blob HTTP handler bypasses authorization
Maven io.crate:crate · Upgrade to 6.3.2 or 6.2.8 by release line · < 6.2.8; >= 6.3.0, < 6.3.2 · CVE-2026-49989 · GHSA-2xv8-gjwh-fv8p
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 86 matching · newest first
- Low, CVSS 1.2
Kimai Password Reset Link Remains Valid After Password Change
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · GHSA-m492-gv72-xvxj
- Medium, CVSS 6.9
repomix: attach_packed_output can bypass file-read secret scanning for supported local files
npm repomix · Upgrade to 1.14.1 or later · <= 1.14.0 · CVE-2026-49988 · GHSA-hwpp-h97w-2h3j · amended
- Unrated
Concourse login flow has an open redirect issue
Go github.com/concourse/concourse · Upgrade to 1.6.1-0.20260526150512-ac60be5f0435 (pre-release) or later · < 1.6.1-0.20260526150512-ac60be5f0435 · CVE-2026-49826 · GHSA-8w27-c4vc-88q9
- High, CVSS 8.8
repomix Vulnerable to Command Injection (RCE) via
--remote-branchArgument Injectionnpm repomix · Upgrade to 1.14.1 or later · < 1.14.1 · CVE-2026-49987 · GHSA-9mm9-rqhj-j5mx · amended
- High, CVSS 8.7
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached
TemplatePackagist twig/twig · Upgrade to 3.27.0 or later · <= 3.26.0 · CVE-2026-49981 · GHSA-529h-vh3j-85hq
- Medium, CVSS 4.3
Constrata's coordinator transit engine
ciphertextContainer.UnmarshalJSONpanics on attacker-controlled short ciphertextsGo github.com/edgelesssys/contrast · Upgrade to 1.21.0 or later · <= 1.20.0 · GHSA-3ccm-4qq2-5wrp
- Low, CVSS 3.7
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries
Go github.com/edgelesssys/contrast · Upgrade to 1.21.0 or later · <= 1.20.0 · GHSA-6c87-g9pw-78fx
- High, CVSS 7.1
Cortex has Untrusted Project Bootstrap Code Execution via
CLAUDE_PROJECT_DIRPyPI neuro-cortex-memory · Upgrade to 3.18.0 or later · <= 3.17.0 · CVE-2026-49986 · GHSA-gvpp-v77h-5w8g · amended
- Low, CVSS 1.3
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
Packagist spatie/schema-org · Upgrade to 4.0.2 or 3.23.2 by release line · >= 3.23.1, < 3.23.2; >= 4.0.0, < 4.0.2 · GHSA-hwmc-r6mf-jh83
- High, CVSS 7.5
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Maven org.apache.httpcomponents.core5:httpcore5-h2 · Upgrade to 5.5-beta2 (pre-release) or 5.4.3 by release line · < 5.4.3; >= 5.5-alpha1, < 5.5-beta2 · CVE-2026-54428 · GHSA-v3jc-474w-2wm6
- High, CVSS 7.5
Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service
Maven org.apache.httpcomponents.core5:httpcore5 · Upgrade to 5.5-beta2 (pre-release) or 5.4.3 by release line · < 5.4.3; >= 5.5-alpha1, < 5.5-beta2 · CVE-2026-54399 · GHSA-hf6x-8p5f-cgmf
- Medium, CVSS 5.5
Keras: HDF5 virtual datasets can disclose local files
PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-12480 · GHSA-26c4-7vv6-867j · amended
- High, CVSS 8.6
wetty vulnerable to DOM XSS via file-download filename
npm wetty · Upgrade to 3.0.4 or later · < 3.0.4 · CVE-2026-49864 · GHSA-p26j-h7wj-r568 · amended
- Medium, CVSS 5.3
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Packagist easycorp/easyadmin-bundle · Upgrade to 5.0.10 or 4.29.10 by release line · >= 4.0.0, < 4.29.10; >= 5.0.0, < 5.0.10 · GHSA-2wwr-9x6f-88gp
- High, CVSS 7.4
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
npm auth-fetch-mcp · Upgrade to 3.0.2 or later · <= 3.0.1 · CVE-2026-49857 · GHSA-pvrj-8cg3-j5f8 · amended
- Medium, CVSS 4.3
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
npm @jshookmcp/jshook · Upgrade to 0.3.2 or later · >= 0.3.1, <= 0.3.1 · CVE-2026-49856 · GHSA-c5r6-m4mr-8q5j · amended
- High, CVSS 7.5
GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field
Maven org.geonetwork-opensource:geonetwork · Upgrade to 4.4.11 or 4.2.16 by release line; some affected versions have no fix yet · >= 4.0.0-alpha.1, <= 4.0.6-0; >= 4.2.0, <= 4.2.15; >= 4.4.0, <= 4.4.10-0 · CVE-2026-46487 · GHSA-582q-v28r-7cxr
- High, CVSS 7.1
GeoNetwork has reflected XSS through client-side template injection
Maven org.geonetwork-opensource:geonetwork · Upgrade to 4.4.10 or 4.2.15 by release line; some affected versions have no fix yet · >= 3.0.0, <= 3.12.12; >= 4.0.0-alpha.1, <= 4.0.6; >= 4.2.0, <= 4.2.14; >= 4.4.0, <= 4.4.9 · CVE-2026-39379 · GHSA-2v4m-fw6c-g78f
- High, CVSS 7.8
Open Babel has out-of-bounds write in MSI translationVectors[]
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46295 · GHSA-f8h2-c479-vqxf · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46294 · GHSA-mjmg-352j-f456 · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46293 · GHSA-7h6r-6p76-68c9 · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in Gaussian translationVectors[]
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46291 · GHSA-jg3h-pv7c-4f9c · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46290 · GHSA-5rff-8f7c-8jmw · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in ORCA nAtoms parser
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46289 · GHSA-rj4c-r689-cm87 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.