Medium, CVSS 5.9
aiosmtplib: STARTTLS response injection
PyPI aiosmtplib · Upgrade to 5.1.2 or later · <= 5.1.1 · CVE-2026-55558 · GHSA-vxj7-4xrp-5vr4
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–15 of 15 matching · newest first
- Medium, CVSS 6.1
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
PyPI webob · Upgrade to 1.8.11 or later · < 1.8.11 · CVE-2026-54770 · GHSA-6hx8-3wjj-gr8g
- Critical, CVSS 9.8
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
PyPI litellm · Upgrade to 1.83.7 or later · < 1.83.7 · CVE-2026-37004 · GHSA-6wvf-77m9-58rm · amended
- High, CVSS 8.2
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
Go github.com/crossplane/crossplane-runtime/v2 · Upgrade to 2.4.0-rc.1 (pre-release) or 2.3.3 by release line · >= 2.4.0-rc.0, <= 2.4.0-rc.0; >= 2.3.0, <= 2.3.2 · CVE-2026-105163 · GHSA-mf7q-r4rv-jv94 · amended
- Medium, CVSS 6.5
libreoffice-convert vulnerable to path traversal / arbitrary file write
npm libreoffice-convert · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2026-54732 · GHSA-gmxc-r82q-347r
- High, CVSS 7.2
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template
Packagist symbiote/silverstripe-advancedworkflow · Upgrade to 7.2.1, 7.1.3 or 6.4.5 by release line · < 6.4.5; >= 7.0.0, < 7.1.3; >= 7.2.0, < 7.2.1 · CVE-2026-54718 · GHSA-39mm-rwm3-29jp · amended
- Low, CVSS 1.2
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Go github.com/akuity/kargo · Upgrade to 1.10.2, 1.9.8, 1.8.13 or 1.7.10 by release line · < 1.7.10; >= 1.8.0, < 1.8.13; >= 1.9.0, < 1.9.8; >= 1.10.0, < 1.10.2 · CVE-2026-42350 · GHSA-g7gw-m874-7rmf · amended
- Medium, CVSS 6.1
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
npm n8n-nodes-sqlite3 · Upgrade to 1.0.0 or later · < 1.0.0 · CVE-2026-54687 · GHSA-q7m3-rhxg-7vxr
- Low, CVSS 3.7
cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions
Packagist cakephp/queue · Upgrade to 2.3.1 or later · >= 0.1.10, < 2.3.1 · CVE-2026-54713 · GHSA-r5pm-vrc5-3m73 · amended
- High, CVSS 8.8
silverstripe/userforms vulnerable to remote code execution via userforms email subject
Packagist silverstripe/userforms · Upgrade to 7.1.1, 7.0.7 or 6.4.9 by release line · < 6.4.9; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.1 · CVE-2026-54721 · GHSA-g8wr-r2v2-vqc6 · amended
- Medium, CVSS 5.4
Silverstripe Framework: Possible XSS attack through media embed
Packagist silverstripe/framework · Upgrade to 6.2.2 or later · < 6.2.2 · CVE-2026-54720 · GHSA-gvrw-qqp5-jgc5 · amended
- Unrated
Panic-safety unsoundness in
Stack::pop,Fifo::pop_frontandValue::replace_stable(use-after-free / double-free)crates.io stack_dst · Upgrade to 0.8.2 or later · >= 0.0.0-0, < 0.8.2
- Critical, CVSS 9.8
Spring Framework Server Sent Event stream corruption while rendering fragments
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 7.0.9; some affected versions have no fix yet · >= 6.2.0, <= 6.2.19; >= 7.0.0, <= 7.0.8 · CVE-2026-47890 · GHSA-j9f9-w8pj-32f8 · amended
- Critical, CVSS 9.8
Spring Framework Improper Path Limitation in XsltView
Maven org.springframework:spring-webmvc · Upgrade to 7.0.9; some affected versions have no fix yet · <= 5.2.25.RELEASE; >= 5.3.0, <= 5.3.49; >= 6.0.0, <= 6.0.30; >= 6.1.0, <= 6.1.28; >= 6.2.0, <= 6.2.19; >= 7.0.0, <= 7.0.8 · CVE-2026-47884 · GHSA-pc63-qcmh-9cmg · amended
- Critical, CVSS 9.8
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
Maven org.springframework:spring-webflux · Upgrade to 7.0.9; some affected versions have no fix yet · >= 5.2.5.RELEASE, <= 5.2.25.RELEASE; >= 5.3.0, <= 5.3.49; >= 6.0.0, <= 6.0.30; >= 6.1.0, <= 6.1.28; >= 6.2.0, <= 6.2.19; >= 7.0.0, <= 7.0.8 · CVE-2026-47892 · GHSA-9qf2-26p9-2q2q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.