Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs
PyPI feast · Upgrade to 0.67.0 or later · < 0.67.0 · CVE-2026-18948 · GHSA-gg2p-37pv-v7fq · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–4 of 4 matching · newest first
PyPI feast · Upgrade to 0.67.0 or later · < 0.67.0 · CVE-2026-18948 · GHSA-gg2p-37pv-v7fq · amended
PyPI apache-airflow-providers-yandex · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2026-68871 · GHSA-qmrf-jrpr-rjx6
PyPI keras · Upgrade to 3.15.0 or later · < 3.15.0 · CVE-2026-12570 · GHSA-74m6-m3xx-3vmj
PyPI nltk · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-12372 · GHSA-2jhm-w3mp-jcwr
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.