High, CVSS 7.5
SSH.NET: ScpClient allows server-side RCE via default SCP path handling
NuGet ssh.net · Upgrade to 2026.0.0 or later · < 2026.0.0 · CVE-2026-85756 · GHSA-mggc-4xg6-vcxf · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
Packagist getgrav/grav · Upgrade to 2.0.11 or later · >= 2.0.10, <= 2.0.10 · CVE-2026-69089 · GHSA-w3f4-8pj2-599w · amended
- High, CVSS 8.1
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
Packagist getgrav/grav · Upgrade to 2.0.11 or later · >= 2.0.7, < 2.0.11 · CVE-2026-69088 · GHSA-7pgq-cr25-xvc8 · amended
- High, CVSS 8.8
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
Go oras.land/oras-go/v2 · Upgrade to 2.6.2 or later · <= 2.6.1 · CVE-2026-85731 · GHSA-m37j-52j7-pjw7 · amended
- High, CVSS 8.7
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Packagist getgrav/grav · Upgrade to 2.0.9 or later · >= 1.7.0, < 2.0.9 · CVE-2026-65608 · GHSA-c4wf-2xxc-68qm · amended
- High, CVSS 7.5
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)
Go github.com/zalando/skipper · Upgrade to 0.27.37 or later · < 0.27.37 · CVE-2026-86043 · GHSA-5gpm-rgj3-9q76 · amended
- High, CVSS 8.9
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77412 · GHSA-4v58-74mf-rjx3 · amended
- Critical, CVSS 9.5
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77411 · GHSA-c5pq-fr2g-9jpf · amended
- High, CVSS 8.9
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77410 · GHSA-r9c8-gcjp-xfwh · amended
- Critical, CVSS 9.1
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77408 · GHSA-j497-x9hr-x34x · amended
- High, CVSS 7.0
RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77407 · GHSA-27gv-rfvv-22mv · amended
- High, CVSS 8.2
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77406 · GHSA-rm6m-hrcw-jw33 · amended
- Critical, CVSS 9.4
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77405 · GHSA-33mj-cw25-m34h · amended
- High, CVSS 8.7
RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77404 · GHSA-465g-fh3v-9jw4 · amended
- High, CVSS 8.9
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-77403 · GHSA-xwwf-m8fg-p9q2 · amended
- High, CVSS 8.4
RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution
PyPI restrictedpython · Upgrade to 8.4 or later · < 8.4 · CVE-2026-76825 · GHSA-hp3v-5vw7-fx9w · amended
- High, CVSS 7.5
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
npm exifreader · Upgrade to 4.41.1 or later · <= 4.41.0 · CVE-2026-85715 · GHSA-pj96-35fp-cfcc · amended
- High, CVSS 8.7
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
NuGet umbraco.cms · Upgrade to 18.0.2, 17.5.3 or 13.15.1 by release line · >= 12.0.0, < 13.15.1; >= 14.0.0-rc1, < 17.5.3; >= 18.0.0, < 18.0.2 · CVE-2026-69197 · GHSA-wr57-hqmp-fgvh · amended
- High, CVSS 8.8
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
npm next-tinacms-azure · Upgrade to 15.0.1 or later · <= 15.0.0 · +1 more package · CVE-2026-63506 · GHSA-g74q-6g2f-874x · amended
- High, CVSS 8.7
Pocketbase: Unhandled panic in worker goroutines
Go github.com/pocketbase/pocketbase · Upgrade to 0.39.7 or 0.22.48 by release line · < 0.22.48; >= 0.23.0, < 0.39.7 · CVE-2026-82410 · GHSA-84vh-m24q-wjjx · amended
- High, CVSS 7.5
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
Maven com.squareup.wire:wire-runtime · Upgrade to 7.0.0-alpha04 (pre-release) or 6.4.5 by release line · <= 6.4.4; >= 7.0.0-alpha01, < 7.0.0-alpha04 · CVE-2026-63126 · GHSA-9rm7-3qhh-h2mc · amended
- High, CVSS 8.7
RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
Maven com.rabbitmq:amqp-client · Upgrade to 5.34.0 or later · < 5.34.0 · CVE-2026-75516 · GHSA-jh4v-gfqj-7rhx · amended
- Critical, CVSS 9.1
Marten's LINQ provider has SQL injection via unescaped string literals
NuGet marten · Upgrade to 9.13.0 or 8.37.4 by release line · >= 7.0.0, < 8.37.4; >= 9.0.0, < 9.13.0 · CVE-2026-75513 · GHSA-rfx3-98h7-v3xp · amended
- High, CVSS 8.5
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
npm @cyclonedx/cyclonedx-npm · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2026-71538 · GHSA-q69g-4hcv-6jg4 · amended
- Critical, CVSS 9.1
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
npm @vendure/core · Upgrade to 3.7.0 or later · < 3.7.0 · CVE-2026-63472 · GHSA-6j36-r6pr-59x4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.