Unrated
Double flow control refund on HTTP/2 server streams in net/http
Go golang.org/x/net · Upgrade to 0.60.0 or later · < 0.60.0 · +1 more package · CVE-2026-78663
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 104 matching · newest first
- Unrated
Recognize yield as regexp preceder keyword in html/template
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-97030
- Unrated
Checksum bypass for golang.org/fips140 in cmd/go
Go toolchain · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-94444
- Unrated
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-56866
- Unrated
Lack of limit on size of parsed Range headers in net/http
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-78667
- Unrated
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-56857
- Unrated
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-94439
- Unrated
Reset context tracking on consecutive template expressions in html/template
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-94448
- Unrated
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-94440
- Unrated
Excessive CPU consumption from repeated initial window changes in net/http
Go golang.org/x/net · Upgrade to 0.60.0 or later · < 0.60.0 · +1 more package · CVE-2026-78669
- Unrated
HTTP/2 transport accepts malformed framing-related headers in net/http
Go golang.org/x/net · Upgrade to 0.60.0 or later · < 0.60.0 · +1 more package · CVE-2026-78660
- Unrated
HTTP/2 server crash due to HPACK encoder race in net/http
Go golang.org/x/net · Upgrade to 0.60.0 or later · < 0.60.0 · +1 more package · CVE-2026-97032
- Unrated
Reject malformed ECH outer extension references in crypto/tls
Go stdlib · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-97031
- Unrated
Checksum database bypass for golang.org/toolchain in cmd/go
Go toolchain · Upgrade to 1.27.2 or 1.26.9 by release line · < 1.26.9; >= 1.27.0-0, < 1.27.2 · CVE-2026-94447
- Unrated
HTTP/2 server memory exhaustion due to Trailer headers in net/http
Go golang.org/x/net · Upgrade to 0.60.0 or later · < 0.60.0 · +1 more package · CVE-2026-78659
- Medium, CVSS 4.2
fast-jwt: Verifier cache accepts expired JWTs without iat.
npm fast-jwt · Upgrade to 6.3.4 or later · <= 6.3.3 · CVE-2026-107719 · GHSA-x937-hj6v-793p · amended
- Critical, CVSS 9.3
Hazelcast allows arbitrary member memory access by low-privileged client
Maven com.hazelcast:hazelcast · Upgrade to 5.7.0 or later · >= 5.6.0, < 5.7.0; >= 5.5.0, < 5.7.0; < 5.7.0 · CVE-2026-107726 · GHSA-6v25-8wq6-xq4j · amended
- Unrated
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
PyPI banks · Upgrade to 2.5.1 or later · <= 2.5.0 · CVE-2026-107716 · GHSA-556j-vv39-8rqv · amended
- Medium, CVSS 6.5
Banks: User-controlled prompt input can be parsed as privileged chat messages
PyPI banks · Upgrade to 2.5.0 or later · <= 2.4.5 · CVE-2026-107717 · GHSA-hmq2-7hp6-7crh · amended
- Medium, CVSS 6.8
Indico: Incomplete Server-Side Request Forgery (SSRF) check
PyPI indico · Upgrade to 3.3.13 or later · < 3.3.13 · CVE-2026-107394 · GHSA-2v95-h47v-g4x9 · amended
- Medium, CVSS 4.3
Indico: Missing access check in legacy session export API
PyPI indico · Upgrade to 3.3.13 or later · < 3.3.13 · CVE-2026-107395 · GHSA-6p4f-j8j6-463q · amended
- Medium, CVSS 4.4
Indico: Cross-Site-Scripting in minutes editor
PyPI indico · Upgrade to 3.3.13 or later · < 3.3.13 · CVE-2026-107397 · GHSA-cw24-x4mj-fw3q · amended
- Medium, CVSS 5.4
Indico: Cross-Site-Scripting in link fields
PyPI indico · Upgrade to 3.3.13 or later · < 3.3.13 · CVE-2026-107396 · GHSA-c4wc-ggrj-jg9v · amended
- High, CVSS 8.7
Hazelcast has an authorization bypass in IMap Predicates API
Maven com.hazelcast:hazelcast · Upgrade to 5.7.0 or later · >= 5.6.0, < 5.7.0; >= 5.5.0, < 5.7.0; < 5.7.0 · CVE-2026-107725 · GHSA-w294-6q5q-53p8 · amended
- Medium, CVSS 6.1
AdonisJS: Unencoded route parameters can produce open redirects
npm @adonisjs/http-server · Upgrade to 9.3.0 or 8.2.3 by release line · >= 9.0.0, <= 9.2.0; <= 8.2.2 · CVE-2026-107718 · GHSA-2m6q-8v3h-jqww · amended
A vendor fix does not resolve your finding until you verify it in your own systems.