High, CVSS 7.1
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
npm mlflow · Upgrade to 3.15.0 or later · < 3.15.0 · CVE-2026-69148 · GHSA-gqch-g4w5-7qcw
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3Exploited · CISA KEV
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
PyPI mlflow · Upgrade to 3.15.0 or later · >= 3.3.0, < 3.15.0 · CVE-2026-64849 · GHSA-7gwp-5pfp-969j · amended
- High, CVSS 8.1
http4k:
DigestAuthProvider.verifydid not bind to request URIMaven org.http4k:http4k-security-digest · Upgrade to 6.50.0.0, 5.42.0.0 or 4.51.0.0 by release line · >= 6.0.0.0, < 6.50.0.0; >= 5.0.0.0, < 5.42.0.0; >= 4.0.0.0, < 4.51.0.0 · CVE-2026-54148 · GHSA-p28p-j94q-pg32 · amended
- High, CVSS 7.5
docx4j: Stack Overflow via Cyclic
w:basedOnStyle Chain leads to Denial of ServiceMaven org.docx4j:docx4j-core · Upgrade to 11.5.14 or later · <= 11.5.13 · CVE-2026-53752 · GHSA-gc95-3vw8-vg43 · amended
- High, CVSS 7.5
http4k: Unbounded gzip decompression in
ServerFilters.GZip/RequestFilters.GunZipallowed memory-exhaustion DoSMaven org.http4k:http4k-core · Upgrade to 6.49.0.0 or 5.42.0.0 by release line; some affected versions have no fix yet · >= 5.0.0.0, < 5.42.0.0; <= 4.48.2.0; >= 6.0.0.0, < 6.49.0.0 · CVE-2026-53659 · GHSA-g4w2-6h2r-3m3w
- High, CVSS 8.7
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
PyPI atomic-agents-stack · Upgrade to 1.1.0 or later · <= 1.0.0 · GHSA-j659-8xh6-5pq5
- High, CVSS 8.7
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
PyPI atomic-agents-stack · Upgrade to 1.1.0 or later · <= 1.0.0 · GHSA-xhcr-cqfr-m3hv
- High, CVSS 7.5
Netty: Memory Exhaustion in SctpMessageCompletionHandler
Maven io.netty:netty-transport-sctp · Upgrade to 4.2.17.Final or 4.1.137.Final by release line · >= 4.2.0.Final, <= 4.2.16.Final; <= 4.1.136.Final · CVE-2026-59902 · GHSA-2qj4-mmr9-4v2f · amended
- High, CVSS 7.8
uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set
Go gitlab.com/uniget-org/cli · Upgrade to 0.28.9 or later · >= 0.27.4, < 0.28.9 · GHSA-fhgh-wq4q-r37x · amended
- High, CVSS 7.5
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.6.dev0 · CVE-2026-59893 · GHSA-prg7-hcfm-mfcr
- High, CVSS 8.7
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-54284 · GHSA-pwgv-4x5q-6m9f
- High, CVSS 8.7
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
npm ep_etherpad-lite · Upgrade to 3.3.0 or later · <= 1.8.14 · CVE-2026-55090 · GHSA-2jp7-wwpg-3p9w · amended
- High, CVSS 7.5
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · GHSA-v836-6xw4-9cx3
- Critical, CVSS 10.0
vm2: NodeVM
builtin: ['*']exposesosanddns— process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)npm vm2 · Upgrade to 3.11.6 or later · < 3.11.6 · CVE-2026-92960 · GHSA-m5w8-4gq2-6f8x · amended
- Critical, CVSS 9.8
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47698 · GHSA-cfcw-xp6x-25gj · amended
- Critical, CVSS 9.9
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47686 · GHSA-m283-3h24-438v · amended
- High, CVSS 8.7
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47683 · GHSA-gmc2-2x9w-cgh9
- High, CVSS 8.7
sqlparse: Quadratic O(n²) DoS in group_comments
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-71491 · GHSA-f2ff-p2ww-7p4p
- High, CVSS 7.1
Glances:
--disable-config-execdoes not cover on-alert action commands (incomplete fix of CVE-2026-53925)PyPI glances · Upgrade to 4.5.6 or later · <= 4.5.5 · CVE-2026-68519 · GHSA-59fj-m2j6-hcxh
- High, CVSS 8.8
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
PyPI glances · Upgrade to 4.5.6 or later · >= 4.5.2, < 4.5.6 · CVE-2026-62982 · GHSA-73wf-9vmv-5pv9
- High, CVSS 8.8
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
PyPI glances · Upgrade to 4.5.6 or later · <= 4.5.5 · CVE-2026-68518 · GHSA-qcpp-8x79-hhp3
- Critical, CVSS 9.1
New API: Integer overflow in quota billing yields negative charges (self-crediting)
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.18 (pre-release) or later · <= 1.0.0-rc.17 · CVE-2026-71479 · GHSA-8r8v-xf7q-rcpr · amended
- High, CVSS 7.5
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.11 (pre-release) or later · < 1.0.0-rc.11 · CVE-2026-64868 · GHSA-v828-m3pf-vq9q · amended
- Critical, CVSS 9.1
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.7 (pre-release) or later · < 1.0.0-rc.7 · CVE-2026-64859 · GHSA-6x2c-phff-wx57 · amended
- High, CVSS 7.1
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
npm @medplum/core · Upgrade to 5.1.6 or later · <= 5.1.5 · CVE-2026-53728 · GHSA-m44r-7c5h-m6mj
A vendor fix does not resolve your finding until you verify it in your own systems.