High, CVSS 7.1
mkfifo: permissions of an existing file are changed after FIFO creation fails
crates.io uu_mkfifo · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35341 · GHSA-pmf6-rcx4-v53v
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.3
Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write
Go github.com/coder/coder/v2 · Upgrade to 2.34.4, 2.33.10, 2.32.9 or 2.29.19 by release line · >= 2.34.0, < 2.34.4; >= 2.33.0, < 2.33.10; >= 2.30.0, < 2.32.9; >= 2.27.0, < 2.29.19 · GHSA-qrwj-vh9x-gw5v
- High, CVSS 7.2
OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
Maven io.openremote:openremote-manager · Upgrade to 1.26.0 or later · < 1.26.0 · CVE-2026-62238 · GHSA-cgfv-jrfp-2r7v · amended
- High, CVSS 7.3
9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
npm 9router · Upgrade to 0.4.77 or later · <= 0.4.71 · CVE-2026-55501 · GHSA-7cfm-pqrj-xgq7 · amended
- High, CVSS 8.7
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Packagist craftcms/cms · Upgrade to 5.10.0 or later · >= 5.9.0, < 5.10.0 · CVE-2026-55794 · GHSA-f74w-488g-8x5r
- Critical, CVSS 9.3
Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
crates.io halo2_gadgets · Upgrade to 0.5.0 or later · < 0.5.0 · +3 more packages · CVE-2026-54496 · GHSA-ww9q-8r59-xv46
- Critical, CVSS 9.2
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
PyPI langroid · Upgrade to 0.65.5 or later · <= 0.65.4 · CVE-2026-55615 · GHSA-2pq5-3q89-j7cc · amended
- High, CVSS 7.8
Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command
PyPI linuxfabrik-lib · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-55426 · GHSA-798h-hpph-m24j · amended
- High, CVSS 7.4
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8 or 2.32.7 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7 · CVE-2026-55436 · GHSA-84rm-42xw-mx52
- High, CVSS 7.7
Coder's session token leaked to arbitrary hosts via
coder open appfor external workspace appsGo github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55431 · GHSA-v54h-cp2w-9x4g
- High, CVSS 8.2
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55428 · GHSA-wrq8-fcv5-8hvp
- High, CVSS 8.7
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55429 · GHSA-9rjw-3gwp-f59v
- High, CVSS 8.3
Coder vulnerable to SSH config injection via unsanitized server-supplied values in
coder config-sshGo github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55427 · GHSA-mcqq-fqgf-rxwm
- High, CVSS 7.2
Coder: User-admin role can reset owner account password
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55077 · GHSA-29xf-69gq-m9jx
- High, CVSS 7.4
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55075 · GHSA-9r87-mvcw-x35f
- High, CVSS 7.4
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55076 · GHSA-75vm-6w67-gwvp
- High, CVSS 7.6
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Maven io.openremote:openremote-agent · Upgrade to 1.24.2 or later · <= 1.24.1 · CVE-2026-54640 · GHSA-7v6w-c3f4-9wpq
- High, CVSS 7.7
OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
Maven io.openremote:openremote-manager · Upgrade to 1.24.2 or later · < 1.24.2 · CVE-2026-54641 · GHSA-xqr9-4wvv-gvch
- High, CVSS 8.1
Langroid: handle_message() executes user-supplied tool JSON without sender verification
PyPI langroid · Upgrade to 0.65.3 or later · <= 0.65.2 · CVE-2026-54771 · GHSA-gjgq-w2m6-wr5q · amended
- Critical, CVSS 10.0
Langroid: Sandbox Escape to Remote Code Execution via Incomplete
eval()Mitigation in TableChatAgentPyPI langroid · Upgrade to 0.65.2 or later · <= 0.65.1 · CVE-2026-54769 · GHSA-q9p7-wqxg-mrhc · amended
- Critical, CVSS 9.3
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
PyPI langroid · Upgrade to 0.65.1 or later · <= 0.65.0 · CVE-2026-54760 · GHSA-6xc5-4r68-67fc · amended
- High, CVSS 7.3
chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
crates.io uu_chmod · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35338 · GHSA-4c7q-4928-8445
- High, CVSS 8.4
flyto-core has Unauthenticated Command Execution via HTTP MCP
execute_modulePyPI flyto-core · Upgrade to 2.26.4 or later · >= 2.26.2, < 2.26.4 · CVE-2026-55786 · GHSA-h9f9-h6gm-wc85 · amended
- High, CVSS 7.1
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
PyPI flyto-core · Upgrade to 2.26.3 or later · <= 2.26.2 · CVE-2026-55787 · GHSA-794r-5rp2-fpg8 · amended
- High, CVSS 7.7
Scriban: Template Writes to Arbitrary CLR Properties via
TypedObjectAccessor(Mass Assignment +private/init/internalSetter Bypass)NuGet scriban · Upgrade to 7.2.2 or later · <= 7.2.1 · GHSA-7jvp-hj45-2f2m
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.