High, CVSS 7.5
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
npm @typespec/spector · Upgrade to 0.1.0-alpha.27 (pre-release) or later · <= 0.1.0-alpha.26 · GHSA-7q9c-hpx7-9cwm · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–19 of 19 matching · newest first
- Unrated
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo
Go github.com/openchoreo/openchoreo · Upgrade to 1.2.0, 1.1.3 or 1.0.3 by release line · < 1.0.3; >= 1.1.0, < 1.1.3; >= 1.2.0-rc.1, < 1.2.0 · CVE-2026-73842 · GHSA-rh53-xvx2-j327 · amended
- Medium, CVSS 6.3
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
PyPI vllm · Upgrade to 0.26.0 or later · >= 0.21.0, < 0.26.0 · CVE-2026-73557 · GHSA-pr7f-p5mw-fc87
- Medium, CVSS 5.3
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
PyPI vllm · Upgrade to 0.26.0 or later · < 0.26.0 · CVE-2026-73556 · GHSA-48jh-3gj7-fg8v
- Medium, CVSS 5.3
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
PyPI vllm · Upgrade to 0.26.0 or later · < 0.26.0 · CVE-2026-73555 · GHSA-hwrm-c4cx-rf4j
- Medium, CVSS 4.3
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
PyPI vllm · Upgrade to 0.26.0 or later · < 0.26.0 · CVE-2026-71486 · GHSA-8737-qx52-hjff
- Medium, CVSS 5.8
SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260726002639-4515fa257cfa (pre-release) or later · < 0.0.0-20260726002639-4515fa257cfa · CVE-2026-72792 · GHSA-mp7r-57w4-5qm3 · amended
- High, CVSS 8.6
SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to…
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725132049-2d8b98395a91 (pre-release) or later · < 0.0.0-20260725132049-2d8b98395a91 · CVE-2026-72793 · GHSA-h4v5-crx2-3cv4 · amended
- High, CVSS 8.6
SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725125659-1ca1c3c9d94b (pre-release) or later · < 0.0.0-20260725125659-1ca1c3c9d94b · CVE-2026-72795 · GHSA-h6w7-xxcf-w2mq · amended
- High, CVSS 8.6
SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725123945-77421530be4a (pre-release) or later · < 0.0.0-20260725123945-77421530be4a · CVE-2026-72794 · GHSA-34fj-mwm6-fjfg · amended
- Medium, CVSS 5.8
SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725122641-34be6c0bb073 (pre-release) or later · < 0.0.0-20260725122641-34be6c0bb073 · CVE-2026-72796 · GHSA-fgmr-7w36-9qfq · amended
- Medium, CVSS 5.8
SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724123622-8fb1b5766093 (pre-release) or later · < 0.0.0-20260724123622-8fb1b5766093 · CVE-2026-72797 · GHSA-f2rw-w22v-54vh · amended
- High, CVSS 8.6
SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724121519-426991d155c0 (pre-release) or later · < 0.0.0-20260724121519-426991d155c0 · CVE-2026-72798 · GHSA-mfrj-v65r-979c · amended
- Medium, CVSS 5.8
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724112156-5bae0926b896 (pre-release) or later · < 0.0.0-20260724112156-5bae0926b896 · CVE-2026-72799 · GHSA-5w7r-f4cg-rqq7 · amended
- Medium, CVSS 4.3
SurrealDB: Writes in a PERMISSIONS clause bypass table permissions
crates.io surrealdb-core · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-63733 · GHSA-66r2-5gwj-gxm2 · amended
- High, CVSS 8.1
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
crates.io surrealdb · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-63735 · GHSA-848m-r628-vrxw · amended
- Low, CVSS 2.0
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
npm @simplewebauthn/server · Upgrade to 13.3.2 or later · <= 13.3.1 · GHSA-6hxq-p678-4hr2
- Medium, CVSS 5.8
SurrealDB allows bypass of deny-net flags via DNS resolution
crates.io SurrealDB · Upgrade to 3.0.0-alpha.7 (pre-release), 2.3.6, 2.2.6 or 2.1.8 by release line · >= 2.1.0, < 2.1.8; >= 2.2.0, < 2.2.6; >= 3.0.0-alpha.1, < 3.0.0-alpha.7; >= 2.3.0, < 2.3.6 · CVE-2025-71390 · GHSA-m3c3-78fh-w3w7 · amended
- Unrated
Double free / use-after-free in
ChunkandInlineArrayremoval methods when an element'sDroppanicscrates.io imbl-sized-chunks · Upgrade to 0.2.0 or later · >= 0.0.0-0, < 0.2.0
A vendor fix does not resolve your finding until you verify it in your own systems.