High, CVSS 7.3
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
crates.io gix · Upgrade to 0.90.0 or later · >= 0.88.0, <= 0.89.0 · GHSA-q54r-jf2p-rfr2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 80 matching · newest first
- Medium, CVSS 6.5
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Packagist livewire/livewire · Upgrade to 4.4.8 or later · >= 4.3.0, < 4.4.8 · GHSA-mhf7-xp6r-6qrc · amended
- Medium, CVSS 5.3
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Go github.com/labstack/echo/v5 · Upgrade to 5.4.1 or later · >= 5.0.0, < 5.4.1 · CVE-2026-118265 · GHSA-h53f-rm2w-w7rg · amended
- High, CVSS 8.2
Echo: WebSocket proxy can retain connections and handlers after client disconnect
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.15.0, < 4.16.1 · +1 more package · CVE-2026-118262 · GHSA-9969-6676-49h5 · amended
- High, CVSS 8.2
Echo: Decompress permits unbounded gzip expansion in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118261 · GHSA-h7wr-284f-5qvc · amended
- Critical, CVSS 9.1
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · +1 more package · CVE-2026-118264 · GHSA-cxf3-9h37-7rr8 · amended
- Medium, CVSS 6.3
Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
Go github.com/labstack/echo/v5 · Upgrade to 5.4.1 or later · >= 5.0.0, < 5.4.1 · CVE-2026-118263 · GHSA-x9ff-22gv-65f4 · amended
- High, CVSS 8.2
Echo: BodyDump captures request and response bodies without size limits in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118260 · GHSA-f48p-c9v4-h7xv · amended
- High, CVSS 8.6
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
npm @strands-agents/sdk · Upgrade to 1.5.0 or later · < 1.5.0 · +1 more package · CVE-2026-115419 · GHSA-4v6f-7vjh-6x4m · amended
- High, CVSS 7.1
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
PyPI virtualenv +1 · Upgrade all 2 to 21.14.13 or later · >= 21.14.9, < 21.14.13 · CVE-2026-115586 · GHSA-cx6f-vjhg-g3cc · amended
- Unrated
Mistune: Path Traversal and XSS in Include directive
PyPI mistune · Upgrade to 3.3.0 or later · <= 3.2.0 · CVE-2026-115355 · GHSA-h7ww-273w-6cm8 · amended
- Medium, CVSS 4.9
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115774 · GHSA-2qrf-pqgx-qh9v · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115776 · GHSA-53xc-49m8-p798 · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115778 · GHSA-cwm5-jh59-mwxr · amended
- High, CVSS 8.7
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115775 · GHSA-3476-c5c2-fr73 · amended
- Medium, CVSS 5.4
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115877 · GHSA-q7qq-6mhp-9rc4 · amended
- Medium, CVSS 6.5
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
PyPI vllm · Upgrade to 0.31.0 or later · < 0.31.0 · CVE-2026-114050 · GHSA-p92p-rxj5-7p2x · amended
- Unrated
SvelteKit : XSS via untrusted cache-control header in prerendered page
npm @sveltejs/kit · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2026-114061 · GHSA-27mw-82g8-phjj · amended
- High, CVSS 7.1
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
npm obsidian-tc · Upgrade to 1.31.4 or later · >= 1.0.1, <= 1.31.3 · CVE-2026-115478 · GHSA-r3g7-r4hr-m258 · amended
- Medium, CVSS 6.6
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260808010544-26ccb40d390e (pre-release) or later · < 0.0.0-20260808010544-26ccb40d390e · CVE-2026-62204 · GHSA-rpx2-p6hp-x5gj · amended
- High, CVSS 7.5
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260731131820-67bc300b6ea6 (pre-release) or later · < 0.0.0-20260731131820-67bc300b6ea6 · CVE-2026-73054 · GHSA-c8w8-3pqp-wr83 · amended
- Medium, CVSS 5.8
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260731093152-c7522b8db586 (pre-release) or later · < 0.0.0-20260731093152-c7522b8db586 · CVE-2026-73630 · GHSA-4pjg-x8qj-33j5 · amended
- Medium, CVSS 5.8
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260730150429-5b42614311b0 (pre-release) or later · < 0.0.0-20260730150429-5b42614311b0 · CVE-2026-73049 · GHSA-p4qw-vx5p-g984 · amended
- Medium, CVSS 5.8
SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260729005258-4daee87d4152 (pre-release) or later · < 0.0.0-20260729005258-4daee87d4152 · GHSA-xp3q-r38w-vgqm · amended
- Critical, CVSS 9.6
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77363 · GHSA-pqh8-4pj7-32xx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.