High, CVSS 7.5
pytonapi has a Webhook Custom Path Authentication Bypass
PyPI pytonapi · Upgrade to 2.2.1 or later · >= 2.0.0, < 2.2.1 · CVE-2026-54635 · GHSA-3fcr-jvgp-7f58
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 56 matching · newest first
- High, CVSS 7.5
SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)
NuGet sipsorcery · Upgrade to 10.0.9 or later · <= 10.0.8 · CVE-2026-54632 · GHSA-28gm-jrmw-xx93 · amended
- Critical, CVSS 9.6
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Packagist poweradmin/poweradmin · Upgrade to 4.3.3 or 4.2.4 by release line · < 4.2.4; >= 4.3.0, < 4.3.3 · CVE-2026-54588 · GHSA-3735-5339-xfwx · amended
- High, CVSS 8.6
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
RubyGems oauth2 · Upgrade to 2.0.22 or later · >= 0.4.0, <= 2.0.21 · CVE-2026-54603 · GHSA-pp92-crg2-gfv9 · amended
- High, CVSS 7.2
OAuth: Cross-origin token-request redirects can expose signed request metadata
RubyGems oauth · Upgrade to 1.1.6 or later · >= 0.5.5, <= 1.1.5 · CVE-2026-54605 · GHSA-prq8-7wvh-44qh · amended
- Low, CVSS 2.0
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
RubyGems sqlite3-ruby +1 · Upgrade all 2 to 2.9.5 or later · >= 2.1.0, <= 2.9.4 · CVE-2026-54620 · GHSA-j7fr-3v8c-3qc3 · amended
- Low, CVSS 2.0
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
RubyGems sqlite3-ruby +1 · Upgrade all 2 to 2.9.5 or later · <= 2.9.4 · CVE-2026-54619 · GHSA-28hh-pr2h-2w89 · amended
- Medium, CVSS 6.9
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
Go github.com/gopacket/gopacket · Upgrade to 1.6.1 or later · <= 1.6.0 · CVE-2026-54332 · GHSA-g6v3-7xmc-w563 · amended
- Medium, CVSS 6.9
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
Go github.com/gopacket/gopacket · Upgrade to 1.6.1 or later · <= 1.6.0 · CVE-2026-54345 · GHSA-6r28-9ppf-4hj5 · amended
- Medium, CVSS 6.6
nono-cli'scregistry pack verification can fail open when provenance metadata is absent
crates.io nono-cli · Upgrade to 0.61.3 or later · <= 0.61.2 · GHSA-hc4m-q9jh-xw4j · amended
- Medium, CVSS 6.8
@novu/application-generic:
validateUrlSsrfpermits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter conditionnpm @novu/application-generic · Upgrade to 3.17.0 or later · < 3.17.0 · CVE-2026-125115 · GHSA-vg6v-j97m-h5xq · amended
- High, CVSS 7.5
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
Packagist pterodactyl/panel · Upgrade to 1.13.0 or later · >= 1.7.0, <= 1.12.4 · CVE-2026-61609 · GHSA-xvc3-826v-xf47 · amended
- High, CVSS 8.8
Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities
Maven com.cedarpolicy:cedar-java · Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line · < 2.3.6; >= 3.1.2, < 3.4.1; >= 4.0.0, < 4.9.0 · CVE-2026-55771 · GHSA-4r9r-4425-74p7 · amended
- High, CVSS 7.1
@wakaru/cli arbitrary file write during bundle unpack
npm @wakaru/cli · Upgrade to 1.4.0 or later · >= 1.0.0, < 1.4.0 · CVE-2026-54545 · GHSA-7wpj-vvmv-pgm8
- High, CVSS 7.5
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
Go github.com/github/github-mcp-server · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-47427 · GHSA-w4q6-qw23-4rg7 · amended
- Critical, CVSS 9.1
lettre has TLS hostname verification disabled when using Boring TLS backend
crates.io lettre · Upgrade to 0.11.22 or later · >= 0.10.1, < 0.11.22 · CVE-2026-46428 · GHSA-4pj9-g833-qx53 · amended
- High, CVSS 8.6
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
Packagist wp-coding-standards/wpcs · Upgrade to 3.4.1 or later · >= 0.14.1, < 3.4.1 · CVE-2026-45293 · GHSA-3pwp-g2mj-5p3v · amended
- High, CVSS 8.2
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Maven io.appium:java-client · Upgrade to 10.1.1 or later · >= 8.2.1, <= 10.1.0 · CVE-2026-43910 · GHSA-28f5-38xr-jh2w · amended
- Medium, CVSS 6.0
Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260419162744-978ac87deffe (pre-release) or later · < 0.0.0-20260419162744-978ac87deffe · GHSA-hp74-gm6m-2qm5 · amended
- High, CVSS 8.5
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260419162744-978ac87deffe (pre-release) or later · < 0.0.0-20260419162744-978ac87deffe · CVE-2026-43983 · GHSA-w6p7-2fxx-4f44 · amended
- Unrated
HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
runtime node · Upgrade to 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1 · CVE-2026-56846
- Unrated
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58045
- Unrated
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58043
- Unrated
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58042
- Unrated
Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58039
A vendor fix does not resolve your finding until you verify it in your own systems.