Medium, CVSS 5.1
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.0 or later · < 5.33.0 · CVE-2026-63336 · GHSA-5m9f-rphj-c435 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 81 matching · newest first
- Medium, CVSS 6.3
RabbitMQ Java client malformed body frame triggers raw command assembler exception
Maven com.rabbitmq:amqp-client · Upgrade to 5.31.0 or later · <= 5.30.0 · CVE-2026-63335 · GHSA-qx7j-jv8m-fppr · amended
- High, CVSS 7.5
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.0 or later · < 5.33.0 · CVE-2026-63337 · GHSA-6g32-pxv4-2wfj · amended
- High, CVSS 8.7
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.1 or later · <= 5.33.0 · CVE-2026-69219 · GHSA-68mj-5wr7-6fgg · amended
- High, CVSS 8.7
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.1 or later · <= 5.33.0 · CVE-2026-69220 · GHSA-93j5-89vc-pph4 · amended
- Medium, CVSS 6.8
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
Go github.com/aquasecurity/trivy · Upgrade to 0.72.0 or later · < 0.72.0 · CVE-2026-63328 · GHSA-8rc5-4fr6-64pw · amended
- High, CVSS 8.7
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Maven io.kestra:kestra · Upgrade to 1.3.24 or later · < 1.3.24 · CVE-2026-55839 · GHSA-34pm-923j-7wf8 · amended
- High, CVSS 7.5
@rhinostone/swig: arbitrary local file read via include/extends path traversal
npm @rhinostone/swig +4 · Upgrade all 5 to 2.7.1 or later · < 2.7.1 · GHSA-2mf3-mr2r-r4vf · amended
- Medium, CVSS 4.3
Copyparty vulnerable to file/dirkey confusion
PyPI copyparty · Upgrade to 1.20.17 or later · < 1.20.17 · CVE-2026-70657 · GHSA-x5pq-m9p8-f4vx
- Medium, CVSS 6.1
Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability
Go github.com/apache/answer +1 · Upgrade all 2 to 1.7.2-0.20260206073245-92994b49976b (pre-release) or later · < 1.7.2-0.20260206073245-92994b49976b · CVE-2026-25699 · GHSA-w754-5646-xq9j · amended
- Critical, CVSS 9.6
Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53470 · GHSA-v5m8-5455-qw2x · amended
- High, CVSS 8.2
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
Go github.com/fatedier/frp · Upgrade to 0.70.1 or later · >= 0.53.0, <= 0.70.0 · CVE-2026-73564 · GHSA-26gq-p25f-99cp · amended
- Medium, CVSS 6.5
Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources
Go github.com/zxh326/kite · Upgrade to 0.14.1 or later · >= 0.6.9, <= 0.14.0 · GHSA-c534-2w9c-x7fm · amended
- Medium, CVSS 6.5
Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Go github.com/apache/answer +1 · Upgrade all 2 to 1.7.2-0.20260509071350-11c80384f13a (pre-release) or later · < 1.7.2-0.20260509071350-11c80384f13a · CVE-2026-34905 · GHSA-85r2-pvg8-89r9 · amended
- Medium, CVSS 6.5
Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability
Go github.com/apache/answer +1 · Upgrade all 2 to 1.7.2-0.20260325113131-cfc3e54f30cc (pre-release) or later · < 1.7.2-0.20260325113131-cfc3e54f30cc · CVE-2026-33582 · GHSA-v553-g2w6-295p · amended
- Medium, CVSS 5.3
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
Go github.com/quic-go/webtransport-go · Upgrade to 0.11.1 or later · <= 0.11.0 · CVE-2026-57497 · GHSA-g35j-m5xg-vh3q · amended
- Low, CVSS 1.3
Weaviate has an Improper Authorization issue
Go github.com/weaviate/weaviate · Upgrade to 1.38.0-rc.0 (pre-release) or later · < 1.38.0-rc.0 · CVE-2026-11500 · GHSA-jqpm-wf57-qx5c · amended
- Critical, CVSS 9.6
Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53474 · GHSA-vf2h-7x3w-97fr · amended
- High, CVSS 7.8
Oh My Posh: Arbitrary command execution via template injection in the path segment
Go github.com/jandedobbeleer/oh-my-posh · Upgrade to 29.35.1 or later · <= 29.35.0 · CVE-2026-73505 · GHSA-6xj8-qv9j-xcjq · amended
- Critical, CVSS 9.6
Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution
Go github.com/kubev2v/assisted-migration-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53476 · GHSA-7j4w-x8x8-5mvg · amended
- High, CVSS 8.1
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted
file.createpermissionsPackagist pterodactyl/panel · Upgrade to 1.12.3 or later · < 1.12.3 · +1 more package · CVE-2026-54593 · GHSA-8r6w-3qq5-4p4r · amended
- Medium, CVSS 5.1
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.7 (pre-release) or later · < 1.0.0-rc.7 · CVE-2026-64866 · GHSA-p845-629j-rcj6 · amended
- Critical, CVSS 9.6
Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53471 · GHSA-2fqw-7c6r-2cq6 · amended
- Medium, CVSS 6.1
Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability
Go github.com/apache/answer +1 · Upgrade all 2 to 1.7.2-0.20260525024654-2746bf5b455f (pre-release) or later · < 1.7.2-0.20260525024654-2746bf5b455f · CVE-2026-25688 · GHSA-hmr2-99jm-8x45 · amended
- Critical, CVSS 9.1
Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53469 · GHSA-6xvf-9742-48w2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.