Medium, CVSS 6.9
vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths
crates.io vibeio-http · Upgrade to 0.3.2 or later · < 0.3.2 · GHSA-fx4f-mhw4-qm7j · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–23 of 23 matching · newest first
- Medium, CVSS 6.9
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
Go github.com/gorilla/websocket · Upgrade to 1.5.3 or later · < 1.5.3 · GHSA-w67g-5rqw-f597 · amended
- Low, CVSS 2.7
netfoil vulnerable to improper handling of untrusted DoH response data
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.5.0 or later · < 0.5.0 · GHSA-4ph6-mjv7-3fq6 · amended
- Medium, CVSS 4.8
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
PyPI django-cms · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-54625 · GHSA-fwjf-m4qw-9f2x
- High, CVSS 7.1
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
PyPI django-cms · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-54623 · GHSA-8jj7-4v57-frf5
- Medium, CVSS 6.9
tokio-postgres: Panic on a
DataRowwith fewer fields than columns allows denial of servicecrates.io tokio-postgres · Upgrade to 0.7.18 or later · >= 0.4.0, < 0.7.18 · GHSA-3gjw-f78c-vvpw · amended
- Medium, CVSS 6.9
postgres-protocol: Panic decoding a malformed
hstorevalue allows denial of servicecrates.io postgres-protocol · Upgrade to 0.6.12 or later · < 0.6.12 · GHSA-rgqc-3x5p-6gwg · amended
- High, CVSS 8.7
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
crates.io postgres-protocol · Upgrade to 0.6.12 or later · >= 0.3.0, < 0.6.12 · GHSA-5x78-73v4-xg6w · amended
- Medium, CVSS 6.5
Sakai Profile Image Deletion has an IDOR
Maven org.sakaiproject.profile2:profile2-api +1 · Upgrade all 2 to 23.5; some affected versions have no fix yet · >= 23.0, < 23.5; >= 25.0, <= 25.2 · CVE-2026-54050 · GHSA-9284-fjc3-fmmj · amended
- Critical, CVSS 10.0
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
PyPI mcp-contextforge-gateway · Upgrade to 1.0.2 or later · <= 1.0.1 · CVE-2026-53710 · GHSA-xm98-3vcf-fph7 · amended
- Critical, CVSS 9.8
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Maven org.apache.camel:camel-undertow · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.11.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-78329 · GHSA-v7h8-xhh6-gfj4 · amended
- High, CVSS 7.5
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Maven org.apache.camel:camel-google-storage · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-66907 · GHSA-f78g-9385-qxqj · amended
- Critical, CVSS 9.8
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
Maven org.apache.camel:camel-atmosphere-websocket · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-71300 · GHSA-m5r8-w65q-8wjf · amended
- Medium, CVSS 5.3
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
Maven org.apache.camel:camel-knative · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 3.15.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-63621 · GHSA-vvwm-3j43-7pfm · amended
- High, CVSS 7.5
Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a…
Maven org.apache.camel:camel-platform-http-main · Upgrade to 4.22.0 or later · >= 4.8.0, < 4.22.0 · CVE-2026-66908 · GHSA-fpm2-m4qq-wghr · amended
- Medium, CVSS 5.5
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
Maven org.apache.camel:camel-azure-storage-datalake · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-60093 · GHSA-7jwc-q3fj-c9pq · amended
- Critical, CVSS 9.1
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Maven org.apache.camel:camel-azure-storage-blob · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-66906 · GHSA-2x37-89hj-2j95 · amended
- Medium, CVSS 6.5
Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled
Maven org.apache.camel:camel-mail · Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line · >= 2.17.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0 · CVE-2026-59230 · GHSA-cx47-qxp5-mmh2 · amended
- Unrated
Rejected authentication challenges can poison the Key Vault scope cache
crates.io azure_security_keyvault_certificates · Upgrade to 1.1.0-beta.2 (pre-release) or 1.0.1 by release line · >= 0.9.0, < 1.0.1; >= 1.1.0-beta.0, < 1.1.0-beta.2
- High, CVSS 8.7
Panic on Decoding Short Hybrid Keys
crates.io libcrux-kem · Upgrade to 0.0.10 or later · >= 0.0.0-0, < 0.0.10 · amended
- Unrated
Rejected authentication challenges can poison the Key Vault scope cache
crates.io azure_security_keyvault_keys · Upgrade to 1.0.1 or later · >= 0.10.0, < 1.0.1
- Unrated
Rejected authentication challenges can poison the Key Vault scope cache
crates.io azure_security_keyvault_secrets · Upgrade to 1.0.1 or later · >= 0.10.0, < 1.0.1
- Unrated
Panic-safety unsoundness in
BitVecCore::clear(double-free / use-after-free)crates.io stable-vec · Upgrade to 0.4.3 or later · >= 0.0.0-0, < 0.4.3 · GHSA-mr2v-63pc-gmr4
A vendor fix does not resolve your finding until you verify it in your own systems.