High, CVSS 7.5
json_repair: Circular JSON Schema $ref causes unbounded CPU DoS
PyPI json-repair · Upgrade to 0.60.1 or later · < 0.60.1 · GHSA-xf7x-x43h-rpqh · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
json_repair: Circular JSON Schema
- Critical, CVSS 9.3
FacturaScripts: Account takeover of any 2FA-enabled user
Packagist facturascripts/facturascripts · Upgrade to 2026.3 or later · <= 2026.2 · CVE-2026-47677 · GHSA-c67f-gmxw-mj93
- High, CVSS 8.7
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
Packagist plank/laravel-mediable · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-49970 · GHSA-xv8g-76mx-2rxc
- High, CVSS 8.5
DIRAC: SQL injection and lack of access control in PilotManager service
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · GHSA-7xw9-549r-8jrc · amended
- High, CVSS 8.1
DIRAC: Pilot code downloaded over unverified HTTPS connection
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6.20.1, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · CVE-2026-61668 · GHSA-vg99-gr89-qhw9 · amended
- Critical, CVSS 9.9
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · CVE-2026-61667 · GHSA-m4m7-4cw8-62j6 · amended
- High, CVSS 7.2
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
Packagist nukeviet/nukeviet · Upgrade to 4.6.00 or later · < 4.6.00 · CVE-2026-55372 · GHSA-4chg-4752-w88r
- High, CVSS 8.7
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
Packagist nukeviet/nukeviet · Upgrade to 4.6.00 or later · < 4.6.00 · CVE-2026-54065 · GHSA-c9xg-64p9-f2jj
- High, CVSS 8.7
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
Packagist nukeviet/nukeviet · Upgrade to 4.6.00 or later · < 4.6.00 · CVE-2026-54064 · GHSA-465g-4q99-5x86
- Critical, CVSS 9.9
DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · CVE-2026-45579 · GHSA-9jpv-c7p4-997x · amended
- High, CVSS 8.5
Decidim: JWT-backed authentication can be replayed across organizations
RubyGems decidim · Upgrade to 0.32.0 or 0.31.5 by release line · < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45414 · GHSA-r3v7-5x4c-c69q
- High, CVSS 7.5
Decidim: Verification documents can be downloaded through reusable links
RubyGems decidim-verifications · Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line · < 0.30.9; >= 0.31.0.rc1, < 0.31.5; >= 0.32.0.rc1, < 0.32.0 · CVE-2026-45378 · GHSA-3mvf-82qp-8qh5
- Critical, CVSS 9.1
PYSEC-2026-3441
PyPI apache-gravitino · Upgrade to 1.2.1 or later · >= 1.0.0, < 1.2.1 · CVE-2026-41041
A vendor fix does not resolve your finding until you verify it in your own systems.