High, CVSS 8.2
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53501 · GHSA-mw3h-qjxj-6xg9
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 55 matching · newest first
- High, CVSS 8.2
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53500 · GHSA-6x26-6r6f-m537
- High, CVSS 7.3
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
npm @phun-ky/defaults-deep · Upgrade to 2.0.5 or later · < 2.0.5 · CVE-2026-54737 · GHSA-mj3g-7xcc-x4vh
- Critical, CVSS 9.6
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
Go github.com/bank-vaults/vault-secrets-webhook · Upgrade to 1.23.1 or later · <= 1.22.2 · CVE-2026-54725 · GHSA-r2v3-8gwf-7ghm · amended
- High, CVSS 8.7
hashi-vault-js has a path traversal and query parameter injection
npm hashi-vault-js · Upgrade to 0.5.2 or later · <= 0.5.1 · CVE-2026-55100 · GHSA-g956-2f74-rmv7
- High, CVSS 8.7
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
npm dssrf · Upgrade to 1.0.5 or later · <= 1.0.4 · CVE-2026-54729 · GHSA-5846-7qm3-r52j
- Medium, CVSS 6.6
Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
Go github.com/projectcapsule/capsule · Upgrade to 0.13.8 or later · >= 0.13.0, <= 0.13.7 · CVE-2026-65835 · GHSA-jr6p-8pjj-mfx6 · amended
- Medium, CVSS 6.8
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
Go github.com/projectcapsule/capsule · Upgrade to 0.13.8 or later · <= 0.13.7 · CVE-2026-65834 · GHSA-68cj-mvg9-rgm2 · amended
- Medium, CVSS 5.7
re2: Out-of-bounds heap read in
exec/test/matchvia attacker-influencedlastIndexon a non-ASCII subject → uncatchable process crash (DoS)npm re2 · Upgrade to 1.25.2 or later · <= 1.25.1 · CVE-2026-67550 · GHSA-ff84-5f28-78qj
- Medium, CVSS 6.2
re2: Global
String.prototype.matchwith an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)npm re2 · Upgrade to 1.25.2 or later · <= 1.25.1 · CVE-2026-68499 · GHSA-6hxr-mr5r-9836
- Medium, CVSS 6.5
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
Packagist sylius/mollie-plugin · Upgrade to 3.3.1, 3.2.4 or 2.2.8 by release line · < 2.2.8; >= 3.0.0, < 3.2.4; >= 3.3.0, < 3.3.1 · CVE-2026-68501 · GHSA-x83g-979r-f5fh · amended
- High, CVSS 7.5
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
Packagist sylius/mollie-plugin · Upgrade to 3.3.1, 3.2.4 or 2.2.8 by release line · < 2.2.8; >= 3.0.0, < 3.2.4; >= 3.3.0, < 3.3.1 · CVE-2026-68500 · GHSA-rc52-c4hv-w89p · amended
- High, CVSS 7.5
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-56819 · GHSA-93wv-jw9v-4972 · amended
- High, CVSS 8.6
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12075 · GHSA-qvv7-cg9c-w4x3
- High, CVSS 7.5
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12061 · GHSA-fg7f-2386-8897
- High, CVSS 7.5
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12072 · GHSA-6hm5-jgcp-p838
- High, CVSS 7.5
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12074 · GHSA-xh95-f55m-82fw
- Medium, CVSS 5.9
nx graphdev server permissive CORS policynpm nx · Upgrade to 23.0.0-beta.2 (pre-release) or 22.7.2 by release line · >= 17.0.4, < 22.7.2; >= 23.0.0-beta.0, < 23.0.0-beta.2 · CVE-2026-54753 · GHSA-g2r8-wvmj-jf5w
- High, CVSS 7.5
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
Maven org.springframework.data:spring-data-commons · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.13 · CVE-2026-41695 · GHSA-88fw-v6x4-3f58 · amended
- Medium, CVSS 4.8
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
PyPI onionshare-cli · Upgrade to 2.6.4 or later · < 2.6.4 · CVE-2026-54706 · GHSA-22p9-r2f5-22mf
- Medium, CVSS 5.4
OnionShare Receive mode writes uploaded files even when file uploads are disabled
PyPI onionshare-cli · Upgrade to 2.6.4 or later · < 2.6.4 · CVE-2026-54707 · GHSA-v833-3823-cmhp
- High, CVSS 7.5
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
Go github.com/pterodactyl/wings · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-52856 · GHSA-ghrq-5wpp-hxx5 · amended
- Critical, CVSS 9.9
Wings exposes node configuration secrets through egg configuration-file templating
Go github.com/pterodactyl/wings · Upgrade to 1.12.3 or later · < 1.12.3 · CVE-2026-52855 · GHSA-pfvc-3p5h-x7h6 · amended
- Medium, CVSS 5.5
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Go github.com/pterodactyl/wings · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-52857 · GHSA-q6hh-gp44-4hcm · amended
- High, CVSS 7.5
@dynatrace-oss/dynatrace-mcp-serverhas Unauthenticated HTTP MCP Tool Invocationnpm @dynatrace-oss/dynatrace-mcp-server · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2026-123811 · GHSA-p7w7-4929-vpj5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.