High, CVSS 7.7
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
PyPI ansible-jailexec · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2026-55074 · GHSA-cxgv-hp74-jj7r
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 30 matching · newest first
- High, CVSS 7.5
SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)
NuGet sipsorcery · Upgrade to 10.0.14 or later · >= 10.0.5, <= 10.0.13 · GHSA-pfvm-w89x-94jw · amended
- High, CVSS 7.5
SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing
NuGet sipsorcery · Upgrade to 10.0.14 or later · < 10.0.14 · CVE-2026-123805 · GHSA-jwjp-4649-v8jp · amended
- High, CVSS 8.4
MCP-for-Stata: Stata Command Injection via Unsanitized
packageinado_package_installPyPI stata-mcp · Upgrade to 1.19.0 or later · < 1.19.0 · CVE-2026-55071 · GHSA-49m4-vp58-wgc9
- High, CVSS 7.8
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260526080459-dd1b4287899e (pre-release) or later · < 0.0.0-20260526080459-dd1b4287899e · CVE-2026-54917 · GHSA-w62w-66v9-vvgv · amended
- Medium, CVSS 6.5
Apache Airflow missing team context permits cross-team Dag actions and XCom reads
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68971 · GHSA-5247-m8w9-2v4m
- Medium, CVSS 6.5
Apache Airflow Task SDK fails to mask list-shaped JSON Variables
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68970 · GHSA-f3c2-j7g8-vpp8
- Medium, CVSS 6.5
Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68969 · GHSA-cjv4-7hp2-2x9h
- Medium, CVSS 5.4
Apache Airflow XCom API permits unsafe deserialization through JSON string literals
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-59242 · GHSA-fcmm-42r9-mmmm
- High, CVSS 7.5
Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68968 · GHSA-j4jc-cq9h-xrhr
- High, CVSS 7.3
Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-67260 · GHSA-q4c3-7575-55j2
- Medium, CVSS 6.5
Apache Airflow Config API exposes team-scoped sensitive configuration values
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-65017 · GHSA-c56v-8w4g-3mfm
- Medium, CVSS 5.4
Apache Airflow environment-variable secrets backend permits cross-team credential use
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68076 · GHSA-75mg-c62r-v95g
- High, CVSS 8.8
Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-67587 · GHSA-2qjv-p2gc-mjg2
- Medium, CVSS 4.3
Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-54183 · GHSA-g4qj-5vxv-wggf
- Medium, CVSS 6.5
Apache Airflow exposes dict-valued var.json secrets in Rendered Templates
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-59244 · GHSA-f643-3rc2-j27w
- High, CVSS 8.8
Apache Airflow exception-node deserialization permits arbitrary callable execution
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-58076 · GHSA-8prw-8m6x-8w6f
- High, CVSS 8.6
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
PyPI compliance-trestle · Upgrade to 4.1.0 or later · < 4.1.0 · CVE-2026-52776 · GHSA-h47f-gmjp-m7rr
- High, CVSS 7.1
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
NuGet ssh.net · Upgrade to 2026.0.0 or later · <= 2025.1.0 · CVE-2026-48798 · GHSA-q939-rpr3-3284 · amended
- Medium, CVSS 6.5
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.87.0 or later · < 4.87.0 · CVE-2026-48786 · GHSA-88p2-jj8w-j8qg · amended
- Medium, CVSS 5.4
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Packagist thorsten/phpmyfaq · Upgrade to 4.2.0-alpha (pre-release) or later · < 4.2.0-alpha · CVE-2026-47132 · GHSA-6pvm-2vjj-rx4w · amended
- High, CVSS 7.5
nimiq-blockchain: Validity store off by one error
crates.io nimiq-blockchain · Upgrade to 1.5.1 or later · <= 1.5.0 · CVE-2026-46369 · GHSA-3763-qp59-59vf · amended
- Medium, CVSS 5.4
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
Packagist librenms/librenms · Upgrade to 26.5.0 or later · <= 26.4.0 · CVE-2026-45694 · GHSA-jmqm-f8q4-v7wx · amended
- High, CVSS 7.1
Winter: Authenticated backend users can bypass Users controller permission checks
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-35445 · GHSA-j5jq-cr68-v2xx · amended
- Medium, CVSS 6.8
Winter: Broken access control in
Cms\Controllers\Indexallows cross-template actions and unauthorized asset uploadsPackagist winter/wn-cms-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-32639 · GHSA-5c4f-9pq9-6c77 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.