Critical, CVSS 9.8
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
PyPI litellm · Upgrade to 1.83.7 or later · < 1.83.7 · CVE-2026-37004 · GHSA-6wvf-77m9-58rm · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
Go github.com/crossplane/crossplane-runtime/v2 · Upgrade to 2.4.0-rc.1 (pre-release) or 2.3.3 by release line · >= 2.4.0-rc.0, <= 2.4.0-rc.0; >= 2.3.0, <= 2.3.2 · CVE-2026-105163 · GHSA-mf7q-r4rv-jv94 · amended
- High, CVSS 7.2
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template
Packagist symbiote/silverstripe-advancedworkflow · Upgrade to 7.2.1, 7.1.3 or 6.4.5 by release line · < 6.4.5; >= 7.0.0, < 7.1.3; >= 7.2.0, < 7.2.1 · CVE-2026-54718 · GHSA-39mm-rwm3-29jp · amended
- High, CVSS 8.8
silverstripe/userforms vulnerable to remote code execution via userforms email subject
Packagist silverstripe/userforms · Upgrade to 7.1.1, 7.0.7 or 6.4.9 by release line · < 6.4.9; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.1 · CVE-2026-54721 · GHSA-g8wr-r2v2-vqc6 · amended
- Critical, CVSS 9.8
Spring Framework Server Sent Event stream corruption while rendering fragments
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 7.0.9; some affected versions have no fix yet · >= 6.2.0, <= 6.2.19; >= 7.0.0, <= 7.0.8 · CVE-2026-47890 · GHSA-j9f9-w8pj-32f8 · amended
- Critical, CVSS 9.8
Spring Framework Improper Path Limitation in XsltView
Maven org.springframework:spring-webmvc · Upgrade to 7.0.9; some affected versions have no fix yet · <= 5.2.25.RELEASE; >= 5.3.0, <= 5.3.49; >= 6.0.0, <= 6.0.30; >= 6.1.0, <= 6.1.28; >= 6.2.0, <= 6.2.19; >= 7.0.0, <= 7.0.8 · CVE-2026-47884 · GHSA-pc63-qcmh-9cmg · amended
- Critical, CVSS 9.8
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
Maven org.springframework:spring-webflux · Upgrade to 7.0.9; some affected versions have no fix yet · >= 5.2.5.RELEASE, <= 5.2.25.RELEASE; >= 5.3.0, <= 5.3.49; >= 6.0.0, <= 6.0.30; >= 6.1.0, <= 6.1.28; >= 6.2.0, <= 6.2.19; >= 7.0.0, <= 7.0.8 · CVE-2026-47892 · GHSA-9qf2-26p9-2q2q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.