High, CVSS 7.8
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
PyPI recce · Upgrade to 1.50.0 or later · <= 1.49.0 · CVE-2026-49360 · GHSA-rh62-j648-g5qc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 117 matching · newest first
- High, CVSS 7.5
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
Go golang.org/x/image · Upgrade to 0.41.0 or later · < 0.41.0 · CVE-2026-46599 · GHSA-q675-qj96-32m9
- Critical, CVSS 9.8
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
npm 9router · Upgrade to 0.4.45 or later · >= 0.2.21, <= 0.4.41 · CVE-2026-49352 · GHSA-jphh-m39h-6gwx · amended
- High, CVSS 7.1
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned
Response/InResponseTois combined with a signed assertion lackingSubjectConfirmationData/InResponseToPackagist simplesamlphp/simplesamlphp · Upgrade to 2.5.2 or 2.4.7 by release line · >= 2.5.0, <= 2.5.1; <= 2.4.6 · CVE-2026-49284 · GHSA-q8r6-xj3f-wrrm
- High, CVSS 8.7
Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename
Go github.com/xyproto/algernon · Upgrade to 1.17.9 or later · <= 1.17.8 · CVE-2026-52792 · GHSA-mm6c-5j6x-hq8m
- High, CVSS 7.3
jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
crates.io jxl-grid · Upgrade to 0.6.2 or later · <= 0.6.1 · CVE-2026-52834 · GHSA-5pmv-rx8r-wmv5
- Medium, CVSS 6.2
jxl-oxide:
FrameBuffer::newcreates out-of-bounds slices on overflowcrates.io jxl-oxide · Upgrade to 0.12.6 or later · <= 0.12.5 · GHSA-66m8-c62j-h6v5
- Medium, CVSS 6.2
jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)
crates.io jxl-modular · Upgrade to 0.11.3 or later · <= 0.11.2 · GHSA-2v8p-fqpx-2q3w
- Low, CVSS 1.3
Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
Packagist kimai/kimai · Upgrade to 2.57.0 or later · <= 2.56.0 · GHSA-j5mc-p8qg-39j7
- High, CVSS 7.7
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Maven org.keycloak:keycloak-services · Upgrade to 26.5.5; some affected versions have no fix yet · <= 26.2.5; >= 26.3.0, <= 26.4.7; >= 26.5.0, < 26.5.5 · CVE-2026-2092 · GHSA-794g-x443-36f7 · amended
- Critical, CVSS 9.4
fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
PyPI fast-mcp-telegram · Upgrade to 0.19.1 or later · <= 0.19.0 · CVE-2026-52830 · GHSA-rxw2-pc8j-vxwm · amended
- Low, CVSS 1.9
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
NuGet steeltoe.configuration.encryption · Upgrade to 4.2.0 or later · >= 4.0.0, <= 4.1.0 · CVE-2026-50268 · GHSA-4j9m-h44m-2hv8
- Medium, CVSS 4.7
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
NuGet steeltoe.configuration.abstractions · Upgrade to 4.2.0 or later · >= 4.0.0, <= 4.1.0 · CVE-2026-50267 · GHSA-rxrh-4j9h-xgg9
- Medium, CVSS 5.9
Steeltoe's static JWKS cache shared across schemes and never invalidated
NuGet steeltoe.security.authentication.cloudfoundrybase · Upgrade to 3.4.0 or later · <= 3.3.0 · +2 more packages · CVE-2026-50202 · GHSA-7fqc-p256-7pwj
- Medium, CVSS 6.5
Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
NuGet steeltoe.management.endpoint · Upgrade to 4.2.0 or later · <= 4.1.0 · +1 more package · CVE-2026-50201 · GHSA-227r-jm2g-7cp4
- High, CVSS 7.5
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
NuGet steeltoe.management.endpoint · Upgrade to 4.2.0 or later · <= 4.1.0 · +1 more package · CVE-2026-50200 · GHSA-q62h-354g-5r85
- High, CVSS 7.5
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
NuGet steeltoe.discovery.eureka · Upgrade to 4.2.0 or 3.4.0 by release line · >= 4.0.0, <= 4.1.0; <= 3.3.0 · CVE-2026-50196 · GHSA-j8ph-6fxj-g533
- High, CVSS 8.2
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
NuGet steeltoe.management.endpoint · Upgrade to 4.2.0 or later · <= 4.1.0 · +1 more package · CVE-2026-50194 · GHSA-58f6-6rj2-3v8r
- High, CVSS 7.5
SimpleSAMLphp has Possible DoS via XPath Transform
Packagist simplesamlphp/saml2-legacy +1 · Upgrade all 2 to 4.20.3 or 4.19.3 by release line · >= 4.20.0, <= 4.20.2; <= 4.19.2 · CVE-2026-49289 · GHSA-5cjr-mxj5-wmrx
- High, CVSS 7.5
Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update
crates.io zebra-network · Upgrade to 7.0.0 or later · <= 6.0.0 · +1 more package · CVE-2026-52829 · GHSA-63wg-wjjj-7cp8
- High, CVSS 8.7
SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
Packagist simplesamlphp/saml2-legacy · Upgrade to 4.20.2 or 4.19.3 by release line · >= 4.20.0, < 4.20.2; < 4.19.3 · +1 more package · CVE-2026-49283 · GHSA-6929-8p9f-26jx
- High, CVSS 7.0
Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments
PyPI linuxfabrik-lib · Upgrade to 5.1.0 or later · <= 5.0.0 · CVE-2026-52817 · GHSA-8w6w-23mq-h8rg · amended
- Medium, CVSS 6.9
@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
npm @asymmetric-effort/nogginlessdom · Upgrade to 0.0.22 or later · <= 0.0.21 · GHSA-x4hg-hfwf-p9mw · amended
- High, CVSS 8.7
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
npm @asymmetric-effort/nogginlessdom · Upgrade to 0.0.22 or later · <= 0.0.21 · GHSA-322x-v876-g883 · amended
- Critical, CVSS 9.2
9router: Missing Authorization and OS Command Injection
npm 9router · Upgrade to 0.4.44 or later · < 0.4.44 · CVE-2026-59800 · GHSA-g6g7-pvmx-m74p · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.