High, CVSS 7.8
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
PyPI recce · Upgrade to 1.50.0 or later · <= 1.49.0 · CVE-2026-49360 · GHSA-rh62-j648-g5qc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
Go golang.org/x/image · Upgrade to 0.41.0 or later · < 0.41.0 · CVE-2026-46599 · GHSA-q675-qj96-32m9
- Critical, CVSS 9.8
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
npm 9router · Upgrade to 0.4.45 or later · >= 0.2.21, <= 0.4.41 · CVE-2026-49352 · GHSA-jphh-m39h-6gwx · amended
- High, CVSS 7.1
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned
Response/InResponseTois combined with a signed assertion lackingSubjectConfirmationData/InResponseToPackagist simplesamlphp/simplesamlphp · Upgrade to 2.5.2 or 2.4.7 by release line · >= 2.5.0, <= 2.5.1; <= 2.4.6 · CVE-2026-49284 · GHSA-q8r6-xj3f-wrrm
- High, CVSS 8.7
Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename
Go github.com/xyproto/algernon · Upgrade to 1.17.9 or later · <= 1.17.8 · CVE-2026-52792 · GHSA-mm6c-5j6x-hq8m
- High, CVSS 7.3
jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
crates.io jxl-grid · Upgrade to 0.6.2 or later · <= 0.6.1 · CVE-2026-52834 · GHSA-5pmv-rx8r-wmv5
- High, CVSS 7.7
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Maven org.keycloak:keycloak-services · Upgrade to 26.5.5; some affected versions have no fix yet · <= 26.2.5; >= 26.3.0, <= 26.4.7; >= 26.5.0, < 26.5.5 · CVE-2026-2092 · GHSA-794g-x443-36f7 · amended
- Critical, CVSS 9.4
fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
PyPI fast-mcp-telegram · Upgrade to 0.19.1 or later · <= 0.19.0 · CVE-2026-52830 · GHSA-rxw2-pc8j-vxwm · amended
- High, CVSS 7.5
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
NuGet steeltoe.management.endpoint · Upgrade to 4.2.0 or later · <= 4.1.0 · +1 more package · CVE-2026-50200 · GHSA-q62h-354g-5r85
- High, CVSS 7.5
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
NuGet steeltoe.discovery.eureka · Upgrade to 4.2.0 or 3.4.0 by release line · >= 4.0.0, <= 4.1.0; <= 3.3.0 · CVE-2026-50196 · GHSA-j8ph-6fxj-g533
- High, CVSS 8.2
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
NuGet steeltoe.management.endpoint · Upgrade to 4.2.0 or later · <= 4.1.0 · +1 more package · CVE-2026-50194 · GHSA-58f6-6rj2-3v8r
- High, CVSS 7.5
SimpleSAMLphp has Possible DoS via XPath Transform
Packagist simplesamlphp/saml2-legacy +1 · Upgrade all 2 to 4.20.3 or 4.19.3 by release line · >= 4.20.0, <= 4.20.2; <= 4.19.2 · CVE-2026-49289 · GHSA-5cjr-mxj5-wmrx
- High, CVSS 7.5
Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update
crates.io zebra-network · Upgrade to 7.0.0 or later · <= 6.0.0 · +1 more package · CVE-2026-52829 · GHSA-63wg-wjjj-7cp8
- High, CVSS 8.7
SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
Packagist simplesamlphp/saml2-legacy · Upgrade to 4.20.2 or 4.19.3 by release line · >= 4.20.0, < 4.20.2; < 4.19.3 · +1 more package · CVE-2026-49283 · GHSA-6929-8p9f-26jx
- High, CVSS 7.0
Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments
PyPI linuxfabrik-lib · Upgrade to 5.1.0 or later · <= 5.0.0 · CVE-2026-52817 · GHSA-8w6w-23mq-h8rg · amended
- High, CVSS 8.7
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
npm @asymmetric-effort/nogginlessdom · Upgrade to 0.0.22 or later · <= 0.0.21 · GHSA-322x-v876-g883 · amended
- Critical, CVSS 9.2
9router: Missing Authorization and OS Command Injection
npm 9router · Upgrade to 0.4.44 or later · < 0.4.44 · CVE-2026-59800 · GHSA-g6g7-pvmx-m74p · amended
- High, CVSS 7.5
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
npm jsonata · Upgrade to 2.2.0 or 1.8.9 by release line · >= 2.0.0, < 2.2.0; < 1.8.9 · CVE-2026-52746 · GHSA-86vw-mfpg-wwv9 · amended
- High, CVSS 7.1
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
Packagist craftcms/cms · Upgrade to 5.9.21 or 4.17.14 by release line · >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, < 4.17.14 · CVE-2026-50282 · GHSA-3w32-23wj-rxg3
- High, CVSS 7.1
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Packagist craftcms/cms · Upgrade to 5.9.21 or later · >= 5.7.0, < 5.9.21 · CVE-2026-50281 · GHSA-x5m4-g2cq-52pq
- High, CVSS 7.6
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
Packagist mautic/core · Upgrade to 7.1.2 or later · >= 7.0.0, < 7.1.2 · CVE-2026-9809 · GHSA-7h65-whp7-rgqf
- High, CVSS 7.1
Mautic has an Authorization Bypass in API v2 Endpoints
Packagist mautic/core · Upgrade to 7.1.2 or later · >= 7.0.0, < 7.1.2 · CVE-2026-9808 · GHSA-2jrw-c95w-h43g
- Critical, CVSS 9.9
Mautic vulnerable to Path Traversal via Campaign Import
Packagist mautic/core · Upgrade to 7.1.2 or later · >= 7.0.0, < 7.1.2 · CVE-2026-9559 · GHSA-6r9h-4h75-7q4x
- Critical, CVSS 9.3
zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser
crates.io zebrad · Upgrade to 4.5.0 or later · <= 4.4.1 · +1 more package · CVE-2026-52735 · GHSA-gf9r-m956-97qx
- High, CVSS 8.7
Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache
crates.io zebra-state · Upgrade to 7.0.0 or later · <= 6.0.0 · +1 more package · CVE-2026-52736 · GHSA-4m69-67m6-prqp
A vendor fix does not resolve your finding until you verify it in your own systems.