High, CVSS 7.0
Heimdall: IP Spoofing via Unvalidated Forwarding Headers in github.com/dadrus/heimdall
Go github.com/dadrus/heimdall · Upgrade to 0.17.17 or later · < 0.17.17 · CVE-2026-57210 · GHSA-38x9-25wx-7fg2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–14 of 14 matching · newest first
- High, CVSS 7.8
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
Go github.com/traefik/traefik/v3 · Upgrade to 3.7.3 or later · >= 3.7.0, < 3.7.3 · +1 more package · CVE-2026-48491 · GHSA-5r4w-85f3-pw66 · amended
- Medium, CVSS 6.5
Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62902 · GHSA-9mrh-pw7c-9mqm · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62871 · GHSA-vg44-h755-9hw7 · amended
- High, CVSS 7.0
Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62897 · GHSA-fx4q-gjrx-2jw6 · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-70354 · GHSA-gg8c-3338-xw2f · amended
- Medium, CVSS 6.7
Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62909 · GHSA-9mr8-pwpw-3j2w · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62886 · GHSA-jqhp-238x-qhgf · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +10 · Upgrade all 11 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62901 · GHSA-m93f-wj8c-rp8p · amended
- Medium, CVSS 5.9
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62899 · GHSA-r6mh-95jw-g7qg · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62898 · GHSA-c494-m2fq-59mx · amended
- Critical, CVSS 9.3
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171120-69da20bdaec9 (pre-release) or later · < 0.0.0-20260512171120-69da20bdaec9 · CVE-2026-73080 · GHSA-87fv-vqqr-m4jr · amended
- Unrated
Panic-safety unsoundness in
truncate_back,truncate_front,clear, andextend_from_slice(use-after-free / double-free)crates.io circular-buffer · Upgrade to 2.0.1 or later · >= 0.0.0-0, < 2.0.1
- High, CVSS 7.0
SAP Approuter has an Information Disclosure vulnerability
npm @sap/approuter · Upgrade to 23.0.0 or later · < 23.0.0 · CVE-2026-58230 · GHSA-vhh6-v828-x62f
A vendor fix does not resolve your finding until you verify it in your own systems.