High, CVSS 7.1
Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema
npm @genql/cli · Upgrade to 6.3.4 or later · < 6.3.4 · CVE-2026-63397 · GHSA-w757-xvvv-vgfw · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 26 matching · newest first
- High, CVSS 7.1
ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization
Maven com.arcadedb:arcadedb-server · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-x8mg-6r4p-87pf
- High, CVSS 8.7
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-vwjc-v7x7-cm6g
- High, CVSS 8.6
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-x9f9-r4m8-9xc2
- High, CVSS 7.6
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
PyPI mcp · Upgrade to 1.28.1 or later · < 1.28.1 · CVE-2026-59950 · GHSA-vj7q-gjh5-988w · amended
- High, CVSS 7.7
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
Maven com.arcadedb:arcadedb-server · Upgrade to 26.7.1 or later · < 26.7.1 · GHSA-48qw-824m-86pr
- Critical, CVSS 9.8
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Packagist pheditor/pheditor · Upgrade to 2.0.6 or later · >= 2.0.1, < 2.0.6 · CVE-2026-55579 · GHSA-p4h7-p9rj-2pq2
- High, CVSS 8.8
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Packagist pheditor/pheditor · Upgrade to 2.0.6 or later · >= 2.0.1, < 2.0.6 · CVE-2026-55578 · GHSA-wg4w-wr5q-6vjc
- High, CVSS 8.1
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.6.1 or later · < 26.6.1 · CVE-2026-54076 · GHSA-vg6x-6pg9-6qwg
- High, CVSS 7.1
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.6.1 or later · < 26.6.1 · CVE-2026-54077 · GHSA-8w86-m9h8-hvqg
- Low, CVSS 3.7
nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof
crates.io nimiq-primitives · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-54542 · GHSA-5rg2-xv9j-gv5p
- Low, CVSS 3.7
nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys
crates.io nimiq-primitives · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-54541 · GHSA-46wq-28cx-mhw4
- High, CVSS 8.8
Pheditor has an authenticated terminal command whitelist bypass
Packagist pheditor/pheditor · Upgrade to 2.0.5 or later · <= 2.0.4 · CVE-2026-54540 · GHSA-9643-6xjp-vx57
- High, CVSS 7.1
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
PyPI mcp · Upgrade to 1.27.2 or later · <= 1.27.1 · CVE-2026-52869 · GHSA-jpw9-pfvf-9f58 · amended
- High, CVSS 7.6
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
PyPI mcp · Upgrade to 1.27.2 or later · >= 1.23.0, <= 1.27.1 · CVE-2026-52870 · GHSA-hvrp-rf83-w775 · amended
- Medium, CVSS 4.9
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
Go github.com/nuclio/nuclio · Upgrade to 1.16.5 or later · < 1.16.5 · CVE-2026-52832 · GHSA-wpcj-rmv4-86qg
- High, CVSS 8.0
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
Go github.com/nuclio/nuclio · Upgrade to 1.16.5 or later · < 1.16.5 · CVE-2026-52833 · GHSA-3v79-m2cg-89ww
- High, CVSS 7.4
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53714 · GHSA-22xc-xg2r-9j7v
- Medium, CVSS 6.9
Diesel has possible use after free when deserializing a SQLite database via
SqliteConnection::deserialize_readonly_databasecrates.io diesel · Upgrade to 2.3.10 or later · < 2.3.10 · GHSA-ggxf-9f6j-w742
- Critical, CVSS 9.1
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53713 · GHSA-wcrf-9vrr-854f
- Medium, CVSS 5.3
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53715 · GHSA-8fv2-88gg-hm7q
- Medium, CVSS 6.5
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53717 · GHSA-h7pq-86h8-rp5x
- Medium, CVSS 6.5
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53719 · GHSA-m2v6-2jmh-4c68
- Medium, CVSS 6.5
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53716 · GHSA-cxpq-8v7q-cg56
- Medium, CVSS 6.4
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53718 · GHSA-fcrp-7gc2-93g7
A vendor fix does not resolve your finding until you verify it in your own systems.