Critical, CVSS 9.0
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
PyPI homeassistant · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-64825 · GHSA-5hxg-r395-fqxx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–86 of 86 matching · newest first
- Medium, CVSS 4.8
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
npm hono · Upgrade to 4.12.27 or later · >= 4.3.3, < 4.12.27 · CVE-2026-59897 · GHSA-xgm2-5f3f-mvvc · amended
- Medium, CVSS 5.9
Node.js Adapter for Hono: Path traversal in
serve-staticon Windows via encoded backslash (%5C)npm @hono/node-server · Upgrade to 2.0.5 or 1.19.15 by release line · >= 2.0.0, < 2.0.5; < 1.19.15 · GHSA-frvp-7c67-39w9 · amended
- High, CVSS 8.2
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
Maven org.postgresql:postgresql · Upgrade to 42.7.12 or later · >= 42.7.4, < 42.7.12 · CVE-2026-54291 · GHSA-j92g-9f8w-j867
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.6, 9.0.15 or 8.0.26 by release line · >= 10.0.0, <= 10.0.5; >= 9.0.0, <= 9.0.14; >= 8.0.0, <= 8.0.25 · CVE-2026-56170 · GHSA-j8gr-8fp3-5q5h
- High, CVSS 7.0
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
NuGet microsoft.net.build.containers · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50526 · GHSA-55jh-fwmh-39m4
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.authentication.negotiate · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-47300 · GHSA-8prm-248r-h957
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.authentication.negotiate · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-47303 · GHSA-2p3q-h3hg-jcqq
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50527 · GHSA-mmjf-rqrv-855v
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50650 · GHSA-2969-4q4w-w5h3 · amended
- Low, CVSS 2.3
Loofah
allowed_uri?does not detectjavascript:URIs split by named whitespace character referencesRubyGems loofah · Upgrade to 2.25.2 or later · >= 2.25.0, < 2.25.2 · CVE-2026-73491 · GHSA-8whx-365g-h9vv
A vendor fix does not resolve your finding until you verify it in your own systems.