High, CVSS 8.4
AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
PyPI bedrock-agentcore · Upgrade to 1.18.1 or later · < 1.18.1 · CVE-2026-16796 · GHSA-j6g5-3hh3-pgw8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
crates.io aws-smithy-http-server · Upgrade to 0.66.5 or later · <= 0.66.4 · CVE-2026-16756 · GHSA-jvxp-qmx7-gjpx
- High, CVSS 7.5
OmniFaces: Forged combined-resource IDs and related output/push boundaries
Maven org.omnifaces:omnifaces · Upgrade to 5.4.2, 4.7.12, 3.14.23 or 2 more by release line · < 1.14.3; >= 2.0.0, < 2.7.33; >= 3.0.0, < 3.14.23; >= 4.0.0, < 4.7.12; >= 5.0.0, < 5.4.2 · CVE-2026-102695 · GHSA-fp43-vj7g-pg92
- High, CVSS 8.7
Shescape: Quadratic-time denial of service in the flag-protection
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · >= 2.1.11, < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73413 · GHSA-gm3r-q2wp-hw87 · amended
- Critical, CVSS 9.2
Shescape: Shell injection via unescaped parentheses on Windows with CMD
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73414 · GHSA-w4hw-qcx7-56pr · amended
- High, CVSS 7.3
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
PyPI awslabs-aws-api-mcp-server · Upgrade to 1.3.47 or later · >= 0.2.13, < 1.3.47 · CVE-2026-16584 · GHSA-29w2-fq35-v728 · amended
- High, CVSS 7.5
blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
Maven org.http4s:http4s-blaze-server_2.12 · Upgrade to 0.23.18 or later · < 0.23.18 · +2 more packages · CVE-2026-73493 · GHSA-7ppr-r889-mcf2
- High, CVSS 7.4
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
Maven org.http4s:blaze-http_3 · Upgrade to 1.0.0-M42 (pre-release) or 0.23.18 by release line · <= 0.23.17; >= 1.0.0-M1, < 1.0.0-M42 · +2 more packages · CVE-2026-73495 · GHSA-46q4-43ph-c6fr
- High, CVSS 7.4
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Maven org.http4s:blaze-http_3 · Upgrade to 1.0.0-M42 (pre-release) or 0.23.18 by release line · <= 0.23.17; >= 1.0.0-M1, <= 1.0.0-M41 · +2 more packages · CVE-2026-73494 · GHSA-mhvj-jhpq-885v
- High, CVSS 8.1
Poweradmin: OIDC
subcollation bypass in Poweradmin leading to account takeoverPackagist poweradmin/poweradmin · Upgrade to 4.3.4 or 4.2.5 by release line · >= 4.1.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-cmwh-g2h8-c222
- High, CVSS 8.1
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own
Packagist poweradmin/poweradmin · Upgrade to 4.3.4, 4.2.5 or 3.9.11 by release line · >= 3.0.0, < 3.9.11; >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-rm67-g9ch-vxff
- High, CVSS 8.8
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
Packagist poweradmin/poweradmin · Upgrade to 4.3.4 or 4.2.5 by release line · >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-h4hf-v6w5-897x
- Critical, CVSS 10.0
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
Packagist pheditor/pheditor · Upgrade to 2.0.8 or later · < 2.0.8 · GHSA-f25v-x6vr-962g
- High, CVSS 7.5
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
npm brace-expansion · Upgrade to 5.0.8, 3.0.3, 2.1.3 or 1.1.17 by release line · >= 4.0.0, < 5.0.8; >= 3.0.0, < 3.0.3; >= 2.0.0, < 2.1.3; < 1.1.17 · CVE-2026-14257 · GHSA-mh99-v99m-4gvg · amended
- Critical, CVSS 9.1
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
npm sm-crypto · Upgrade to 0.5.0 or later · < 0.5.0 · CVE-2026-73567 · GHSA-vh45-f885-3848 · amended
- High, CVSS 7.5
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
npm @anephenix/hub · Upgrade to 0.2.16 or later · < 0.2.16 · CVE-2026-73561 · GHSA-g5vv-q72c-7j78 · amended
- Critical, CVSS 9.6
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 5.1.2 or later · <= 5.1.1 · CVE-2026-73644 · GHSA-p279-2cqp-84jg
- Critical, CVSS 9.4
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
Maven org.openidentityplatform.opendj:opendj-dsml-servlet · Upgrade to 5.1.2 or later · <= 5.1.1 · GHSA-68r5-9hpg-7qw9
- High, CVSS 8.8
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
Packagist pheditor/pheditor · Upgrade to 2.0.7 or later · <= 2.0.6 · GHSA-g3hq-hphg-8fhh
- High, CVSS 8.7
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
PyPI gitpython · Upgrade to 3.1.55 or later · < 3.1.55 · CVE-2026-73622 · GHSA-94p4-4cq8-9g67 · amended
- High, CVSS 7.5
react-server-dom: Denial of Service in Server Functions
npm react-server-dom-turbopack · Upgrade to 19.2.8, 19.1.9 or 19.0.8 by release line · >= 19.0.0, < 19.0.8; >= 19.1.0, < 19.1.9; >= 19.2.0, < 19.2.8 · +2 more packages · CVE-2026-44907 · GHSA-wx67-qw84-cm4g · amended
- Critical, CVSS 9.8
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
Maven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.2 or later · <= 16.1.1 · CVE-2026-62379 · GHSA-wg5r-wc3x-39vc
- Critical, CVSS 9.2
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Maven org.openidentityplatform.openam:openam-auth-webauthn · Upgrade to 16.1.2 or later · <= 16.1.1 · CVE-2026-62263 · GHSA-gf8h-gq53-288j
- High, CVSS 7.7
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
PyPI open-webui · Upgrade to 0.10.0 or later · >= 0.9.6, < 0.10.0 · CVE-2026-59221 · GHSA-frvj-c5qp-xj4w · amended
- High, CVSS 8.0
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
PyPI open-webui · Upgrade to 0.10.0 or later · < 0.10.0 · CVE-2026-59224 · GHSA-j657-m4c4-24jq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.