Low, CVSS 3.3
cut: -s (only-delimited) ignored when delimiter is a newline
crates.io uu_cut · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-35343 · GHSA-wv33-5pxh-r7j7
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 102 matching · newest first
- Medium, CVSS 6.3
install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite
crates.io uu_install · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35355 · GHSA-239g-2685-54x3
- Low, CVSS 3.3
ln: rejects non-UTF-8 source filenames in target-directory mode
crates.io uu_ln · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35373 · GHSA-jcjr-rh8q-7xqf
- Low, CVSS 3.3
comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output
crates.io uu_comm · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35346 · GHSA-6gcw-w7cp-94g9
- Low, CVSS 3.3
mktemp: empty TMPDIR creates temp files in CWD instead of /tmp
crates.io uu_mktemp · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35342 · GHSA-2w8r-9xj7-69j5
- Medium, CVSS 5.5
chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)
crates.io uu_chmod · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35339 · GHSA-4x34-chg5-mwjj
- High, CVSS 7.3
chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
crates.io uu_chmod · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35338 · GHSA-4c7q-4928-8445
- High, CVSS 8.4
flyto-core has Unauthenticated Command Execution via HTTP MCP
execute_modulePyPI flyto-core · Upgrade to 2.26.4 or later · >= 2.26.2, < 2.26.4 · CVE-2026-55786 · GHSA-h9f9-h6gm-wc85 · amended
- High, CVSS 7.1
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
PyPI flyto-core · Upgrade to 2.26.3 or later · <= 2.26.2 · CVE-2026-55787 · GHSA-794r-5rp2-fpg8 · amended
- High, CVSS 7.7
Scriban: Template Writes to Arbitrary CLR Properties via
TypedObjectAccessor(Mass Assignment +private/init/internalSetter Bypass)NuGet scriban · Upgrade to 7.2.2 or later · <= 7.2.1 · GHSA-7jvp-hj45-2f2m
- Critical, CVSS 9.2
Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access
Go github.com/cilium/cilium · Upgrade to 1.19.2, 1.18.8 or 1.17.14 by release line · >= 1.19.0, < 1.19.2; >= 1.18.0, < 1.18.8; < 1.17.14 · CVE-2026-49445 · GHSA-3fcv-jvfp-m4q9
- Medium, CVSS 4.3
OpenRemote read-only asset users can write predicted datapoints
Maven io.openremote:openremote-manager · Upgrade to 1.24.1 or later · < 1.24.1 · CVE-2026-49439 · GHSA-xj53-j257-hxvg
- Critical, CVSS 9.8
Formie Hidden field defaults vulnerable to Server-Side Template Injection
Packagist verbb/formie · Upgrade to 3.1.27 or later · < 3.1.27 · CVE-2026-52889 · GHSA-565m-g33j-jq96
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46292 · GHSA-55f6-pf8r-c2f4 · amended
- High, CVSS 7.3
Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
Maven org.apache.camel:camel-couchbase · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46587 · GHSA-46jf-c9vx-hh79
- High, CVSS 8.1
Apache Airflow Google provider allows path traversal through GCS object names
PyPI apache-airflow-providers-google · Upgrade to 22.2.1 or later · < 22.2.1 · CVE-2026-49297 · GHSA-v3mh-27qj-w836 · amended
- High, CVSS 7.3
Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
Maven org.apache.camel:camel-couchdb · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46588 · GHSA-5g68-f6xg-vf2r
- High, CVSS 7.3
Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters
Maven org.apache.camel:camel-langchain4j-tools +2 · Upgrade all 3 to 4.21.0 or 4.18.3 by release line · >= 4.8.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49042 · GHSA-hh8r-75r6-qrg9
- Medium, CVSS 5.3
Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
Maven org.apache.camel:camel-undertow · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-56139 · GHSA-hjg2-f45w-c566
- Medium, CVSS 5.3
Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter
Maven org.apache.camel:camel-salesforce · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49099 · GHSA-gcc7-c8mp-34qx
- Critical, CVSS 9.1
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
Maven org.apache.camel:camel-dns · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48205 · GHSA-hcm8-x79p-wx2w
- Medium, CVSS 6.5
Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter
Maven org.apache.camel:camel-irc · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49097 · GHSA-463m-2hr2-q2j7
- Critical, CVSS 9.8
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
Maven org.apache.camel:camel-keycloak · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-53913 · GHSA-qvc3-6q9x-95pj
- Medium, CVSS 6.5
Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers
Maven org.apache.camel:camel-dapr · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.12.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49086 · GHSA-583r-f84w-33g7
- Medium, CVSS 5.3
Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter
Maven org.apache.camel:camel-jira · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48206 · GHSA-64gv-6cq2-45jr
A vendor fix does not resolve your finding until you verify it in your own systems.