Critical, CVSS 9.3
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
npm jsonata · Upgrade to 2.2.1 or 1.8.8 by release line · >= 2.0.0, < 2.2.1; < 1.8.8 · CVE-2026-77415 · GHSA-66mm-25pp-rfff · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
npm jsonata · Upgrade to 2.2.1 or 1.8.8 by release line · >= 2.0.0, < 2.2.1; < 1.8.8 · CVE-2026-77414 · GHSA-2943-5xfg-gq5f · amended
- High, CVSS 7.8
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
PyPI hydra-core · Upgrade to 1.3.4 or later · <= 1.3.3 · CVE-2026-68508 · GHSA-2cp2-2r3c-7p7r
- High, CVSS 8.2
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Packagist yourls/yourls · Upgrade to 1.10.4 or later · >= 1.5.1, <= 1.10.3 · CVE-2026-63135 · GHSA-5h77-88j3-r659 · amended
- Critical, CVSS 9.3
JSONata: Arbitrary Code Execution via crafted JSONata expressions
npm jsonata · Upgrade to 2.2.0 or 1.8.8 by release line · <= 1.8.7; >= 2.0.0, < 2.2.0 · CVE-2026-77413 · GHSA-8gq3-vp5j-2grp · amended
- High, CVSS 8.7
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
Go github.com/getkin/kin-openapi · Upgrade to 0.142.0 or later · >= 0.124.0, < 0.142.0 · CVE-2026-77354 · GHSA-xhj3-7xw9-vr34 · amended
- Critical, CVSS 10.0
Xinference vulnerable to remote code execution via unsafe
eval()in Llama3 tool-call parsingPyPI xinference · Upgrade to 2.7.0 or later · <= 2.5.0 · CVE-2026-61539 · GHSA-x2rj-828p-hx9m · amended
- Critical, CVSS 9.2
Phalcon Volt compiler
joinfilter compile-time PHP code injection (SSTI leads to RCE)Packagist phalcon/cphalcon · Upgrade to 5.16.0 or later · <= 5.15.0 · CVE-2026-59989 · GHSA-hrwp-4hh9-c8r8 · amended
- High, CVSS 7.5
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
Go github.com/getkin/kin-openapi · Upgrade to 0.141.0 or later · >= 0.10.0, < 0.141.0 · CVE-2026-76905 · GHSA-mmfr-pmjx-hw9w · amended
- High, CVSS 8.1
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
Go github.com/runatlantis/atlantis · Upgrade to 0.45.0 or later · >= 0.19.8, < 0.45.0 · CVE-2026-64679 · GHSA-26w5-6g95-gj28 · amended
- High, CVSS 7.5
Keystone vulnerable to
graphql.maxTakebypass with negativetakenpm @keystone-6/core · Upgrade to 6.5.3 or later · <= 6.5.2 · CVE-2026-63421 · GHSA-cqmq-8755-7xvh
- High, CVSS 8.2
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
npm defuddle · Upgrade to 0.19.1 or later · <= 0.19.0 · CVE-2026-61824 · GHSA-jg4p-g6xj-4qmf
- Critical, CVSS 9.8
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Maven org.geotools.jdbc:gt-jdbc-postgis · Upgrade to 35.1, 34.5 or 33.6 by release line · >= 35.0, <= 35.0; >= 34.0, < 34.5; >= 30.5, < 33.6 · CVE-2026-76904 · GHSA-mqjf-5f49-2fjh · amended
- High, CVSS 7.5
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
npm unleash-server · Upgrade to 8.0.2, 7.6.5 or 7.5.2 by release line · < 7.5.2; >= 7.6.0, < 7.6.5; >= 8.0.0, < 8.0.2 · CVE-2026-63462 · GHSA-r5pq-6chh-j3xp
- High, CVSS 8.7
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
PyPI nltk · Upgrade to 3.10.1 or later · < 3.10.1 · CVE-2026-72818 · GHSA-qx2g-xrx7-vfh8
A vendor fix does not resolve your finding until you verify it in your own systems.