High, CVSS 7.1
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
PyPI django-cms · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-54623 · GHSA-8jj7-4v57-frf5
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
crates.io postgres-protocol · Upgrade to 0.6.12 or later · >= 0.3.0, < 0.6.12 · GHSA-5x78-73v4-xg6w · amended
- Critical, CVSS 10.0
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
PyPI mcp-contextforge-gateway · Upgrade to 1.0.2 or later · <= 1.0.1 · CVE-2026-53710 · GHSA-xm98-3vcf-fph7 · amended
- Critical, CVSS 9.8
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Maven org.apache.camel:camel-undertow · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.11.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-78329 · GHSA-v7h8-xhh6-gfj4 · amended
- High, CVSS 7.5
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Maven org.apache.camel:camel-google-storage · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-66907 · GHSA-f78g-9385-qxqj · amended
- Critical, CVSS 9.8
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
Maven org.apache.camel:camel-atmosphere-websocket · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-71300 · GHSA-m5r8-w65q-8wjf · amended
- High, CVSS 7.5
Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a…
Maven org.apache.camel:camel-platform-http-main · Upgrade to 4.22.0 or later · >= 4.8.0, < 4.22.0 · CVE-2026-66908 · GHSA-fpm2-m4qq-wghr · amended
- Critical, CVSS 9.1
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Maven org.apache.camel:camel-azure-storage-blob · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-66906 · GHSA-2x37-89hj-2j95 · amended
- High, CVSS 8.7
Panic on Decoding Short Hybrid Keys
crates.io libcrux-kem · Upgrade to 0.0.10 or later · >= 0.0.0-0, < 0.0.10 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.