High, CVSS 8.1
pyLoad has an authentication bypass in API key validation (check_apikey cache)
PyPI pyload-ng · Upgrade to 0.5.0b3.dev101 (pre-release) or later · < 0.5.0b3.dev101 · CVE-2026-123816 · GHSA-r44w-v6gf-x3p6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–60 of 60 matching · newest first
- Medium, CVSS 5.3
pyLoad: Unauthenticated access to /web/ bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
PyPI pyload-ng · Upgrade to 0.5.0b3.dev101 (pre-release) or later · <= 0.5.0b3.dev100 · CVE-2026-75597 · GHSA-j92p-c242-7hfx
- Medium, CVSS 6.5
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
PyPI pyload-ng · Upgrade to 0.5.0b3.dev101 (pre-release) or later · < 0.5.0b3.dev101 · CVE-2026-48484 · GHSA-vq8p-m3wm-gv5f
- Low, CVSS 3.7
Strawberry legacy graphql-ws retains naturally completed subscription slots
PyPI strawberry-graphql · Upgrade to 0.327.2 or later · >= 0.312.3, < 0.327.2 · CVE-2026-107727 · GHSA-m952-2w3f-6r8h · amended
- High, CVSS 7.5
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
PyPI strawberry-graphql · Upgrade to 0.326.1 or later · >= 0.217.0, <= 0.326.0 · CVE-2026-107728 · GHSA-pfvf-fwfp-25mp · amended
- High, CVSS 7.3
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
crates.io zip · Upgrade to 9.0.0 or later · >= 0.0.0-0, < 9.0.0 · GHSA-vv5m-jxxh-4627
- High, CVSS 7.5
MIKEY message MAC is never verified on receive, so forged messages are accepted
crates.io mykey · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-xq78-wvcv-hqvj
- High, CVSS 7.5
Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
crates.io ic-cipher · Upgrade to 0.2.20 or later · >= 0.2.5, < 0.2.20 · GHSA-xr22-8pqp-gwfh
- Critical, CVSS 9.1
Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
crates.io mykey · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-fwjg-cm92-j3hj
- Unrated
zip:
ZipArchive::extractcreates symbolic links whose attacker-controlled targets are outside the destination directorycrates.io zip · Upgrade to 9.0.0 or later · >= 0.0.0-0, < 9.0.0 · GHSA-4v9h-p7m9-rh26
A vendor fix does not resolve your finding until you verify it in your own systems.