High, CVSS 7.5
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.0 or later · < 5.33.0 · CVE-2026-63337 · GHSA-6g32-pxv4-2wfj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.1 or later · <= 5.33.0 · CVE-2026-69219 · GHSA-68mj-5wr7-6fgg · amended
- High, CVSS 8.7
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.1 or later · <= 5.33.0 · CVE-2026-69220 · GHSA-93j5-89vc-pph4 · amended
- High, CVSS 8.7
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Maven io.kestra:kestra · Upgrade to 1.3.24 or later · < 1.3.24 · CVE-2026-55839 · GHSA-34pm-923j-7wf8 · amended
- High, CVSS 7.5
@rhinostone/swig: arbitrary local file read via include/extends path traversal
npm @rhinostone/swig +4 · Upgrade all 5 to 2.7.1 or later · < 2.7.1 · GHSA-2mf3-mr2r-r4vf · amended
- Critical, CVSS 9.6
Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53470 · GHSA-v5m8-5455-qw2x · amended
- High, CVSS 8.2
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
Go github.com/fatedier/frp · Upgrade to 0.70.1 or later · >= 0.53.0, <= 0.70.0 · CVE-2026-73564 · GHSA-26gq-p25f-99cp · amended
- Critical, CVSS 9.6
Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53474 · GHSA-vf2h-7x3w-97fr · amended
- High, CVSS 7.8
Oh My Posh: Arbitrary command execution via template injection in the path segment
Go github.com/jandedobbeleer/oh-my-posh · Upgrade to 29.35.1 or later · <= 29.35.0 · CVE-2026-73505 · GHSA-6xj8-qv9j-xcjq · amended
- Critical, CVSS 9.6
Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution
Go github.com/kubev2v/assisted-migration-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53476 · GHSA-7j4w-x8x8-5mvg · amended
- High, CVSS 8.1
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted
file.createpermissionsPackagist pterodactyl/panel · Upgrade to 1.12.3 or later · < 1.12.3 · +1 more package · CVE-2026-54593 · GHSA-8r6w-3qq5-4p4r · amended
- Critical, CVSS 9.6
Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53471 · GHSA-2fqw-7c6r-2cq6 · amended
- Critical, CVSS 9.1
Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53469 · GHSA-6xvf-9742-48w2 · amended
- Critical, CVSS 9.3
Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication
Go github.com/kubev2v/assisted-migration-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53475 · GHSA-8g5p-jxp9-457c · amended
- High, CVSS 7.2
Apache Answer: AdminToken not invalidated after admin deactivation
Go github.com/apache/answer +1 · Upgrade all 2 to 2.0.1 or later · <= 1.7.1 · CVE-2026-25700 · GHSA-4gw2-vg4x-7p29 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.