Medium, CVSS 6.9
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
PyPI zoo-kcl +1 · Upgrade all 2 to 0.3.129 or later · < 0.3.129 · GHSA-jgvr-6x5w-hx5w · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–63 of 63 matching · newest first
- High, CVSS 8.7
jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations
Maven org.jsoup:jsoup · Upgrade to 1.23.2 or later · < 1.23.2 · CVE-2026-75140 · GHSA-65r4-943x-97jj · amended
- Medium, CVSS 6.3
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
PyPI stigmem-node · Upgrade to 0.9.0a11 (pre-release) or later · < 0.9.0a11 · GHSA-5p3m-vhh6-9236
- Medium, CVSS 6.7
NocoBase backup restore schema name allows command injection
npm @nocobase/plugin-backups · Upgrade to 2.1.19 or later · < 2.1.19 · CVE-2026-55410 · GHSA-p853-83gj-wjj3
- High, CVSS 7.7
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
PyPI langgraph-store-mongodb · Upgrade to 0.4.0 or later · < 0.4.0 · +1 more package · CVE-2026-55253 · GHSA-533j-2v4q-mw5h
- Medium, CVSS 5.0
asteval has a Sandbox Escape via BaseException Subclasses
PyPI asteval · Upgrade to 1.0.9 or later · < 1.0.9 · CVE-2026-55244 · GHSA-89v8-rhwq-hf77
- Medium, CVSS 5.5
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
PyPI asteval · Upgrade to 1.0.9 or later · < 1.0.9 · GHSA-9w56-46f6-3qhx
- High, CVSS 7.5
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
Go github.com/vouch/vouch-proxy · Upgrade to 0.48.0 or later · <= 0.47.2 · CVE-2026-55149 · GHSA-qqff-5854-px68 · amended
- Medium, CVSS 5.9
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Go go.opentelemetry.io/otel/bridge/opentracing · Upgrade to 1.45.0 or later · >= 0.11.0, < 1.45.0 · CVE-2026-45404 · GHSA-42cj-99w8-cp2p · amended
- Medium, CVSS 6.9
Velero vulnerable to file path traversal when extracting from backup's tarball
Go github.com/vmware-tanzu/velero · Upgrade to 1.18.1 or later · < 1.18.1 · CVE-2026-32637 · GHSA-j2g6-362q-6qc6 · amended
- Medium, CVSS 6.9
Guest controlled-size host heap allocation through WASIp3 streams
crates.io wasmtime · Upgrade to 47.0.4 or 46.0.3 by release line · >= 46.0.0, < 46.0.3; >= 47.0.0, < 47.0.4 · CVE-2026-115391 · GHSA-x84v-gj2h-g759 · amended
- High, CVSS 8.8
Filesystem sandbox escape when paths or symlinks contain trailing slashes
crates.io wasmtime · Upgrade to 47.0.4, 46.0.3, 36.0.14 or 24.0.13 by release line · >= 0.0.0-0, < 24.0.13; >= 25.0.0, < 36.0.14; >= 37.0.0, < 46.0.3; >= 47.0.0, < 47.0.4 · CVE-2026-115392 · GHSA-vqjp-4c8c-hfgg · amended
- Unrated
append-only-vec0.1.9 was removed from crates.io due to a malicious dependencycrates.io append-only-vec · Upgrade to 0.1.10-0 (pre-release) or later · >= 0.1.9, < 0.1.10-0
A vendor fix does not resolve your finding until you verify it in your own systems.