High, CVSS 8.2
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
npm decode-uri-component · Upgrade to 0.5.1 or later · < 0.5.1 · CVE-2026-118664 · GHSA-qr28-fpjm-wq7f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · < 26.10.0rc1 · GHSA-vpp8-g58w-m8mp · amended
- High, CVSS 7.5
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
crates.io zip · Upgrade to 9.0.0 or later · >= 5.1.0, < 9.0.0 · CVE-2026-115907 · GHSA-9hj8-73fh-9963 · amended
- High, CVSS 7.4
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
crates.io zip · Upgrade to 9.0.0 or later · >= 7.2.0, < 9.0.0 · CVE-2026-115908 · GHSA-hjqx-j4rw-g7xv · amended
- High, CVSS 7.5
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
crates.io zip · Upgrade to 9.0.0 or later · >= 1.3.0, < 9.0.0 · CVE-2026-115909 · GHSA-q7v9-x93c-xqv3 · amended
- High, CVSS 7.6
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
RubyGems shopify_app · Upgrade to 23.0.3 or later · >= 22.1.0, < 23.0.3 · CVE-2026-63414 · GHSA-6j52-38f8-qhxr · amended
- High, CVSS 7.3
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
Go github.com/cert-manager/cert-manager +1 · Upgrade all 2 to 1.20.3 or 1.19.6 by release line · >= 1.18.0, < 1.19.6; >= 1.20.0-alpha.0, < 1.20.3 · CVE-2026-62290 · GHSA-8rvj-mm4h-c258 · amended
- High, CVSS 7.3
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
Bitnami keycloak · Upgrade to 26.6.4 or 26.4.13 by release line · >= 26.4.0, < 26.4.13; >= 26.6.0, < 26.6.4 · +1 more package · CVE-2026-9086 · GHSA-v3f7-2p4r-mwfw · amended
- High, CVSS 8.1
Keycloak vulnerable to authorization bypass via incorrect uri comparison
Bitnami keycloak · Upgrade to 26.7.0 or 26.4.13 by release line · >= 26.4.0, < 26.4.13; >= 26.6.0, < 26.7.0 · +2 more packages · CVE-2026-9800 · GHSA-f5p5-6xmx-p252 · amended
- High, CVSS 8.2
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
npm @eeacms/volto-chatbot · Upgrade to 2.0.4 or later · < 2.0.4 · GHSA-w9x9-j56r-h98r · amended
- High, CVSS 7.5
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
npm @sylphx/pdf-reader-mcp · Upgrade to 3.0.1 or later · >= 2.2.0, < 3.0.1 · CVE-2026-62264 · GHSA-q344-5v34-gm84 · amended
- High, CVSS 7.3
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
PyPI praisonai · Upgrade to 4.6.78 or later · < 4.6.78 · CVE-2026-61438 · GHSA-26mh-57q7-jfvr · amended
- High, CVSS 7.5
Unbounded memory use on large request bodies
crates.io juniper_warp · Upgrade to 0.9.1 or later · >= 0.0.0-0, < 0.9.1 · GHSA-fj3h-2jc3-973v
- Critical, CVSS 9.1
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
Bitnami tomcat · Upgrade to 11.0.27, 10.1.61 or 9.0.123 by release line · >= 7.0.0, < 9.0.123; >= 10.1.0, < 10.1.61; >= 11.0.0, < 11.0.27 · CVE-2026-101296
- High, CVSS 7.0
Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
Bitnami rclone · Upgrade to 1.75.2 or later · < 1.75.2 · CVE-2026-116195 · GHSA-55qp-jrwr-x827
- High, CVSS 7.6
Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
Bitnami rclone · Upgrade to 1.75.2 or later · >= 1.52.0, < 1.75.2 · CVE-2026-116194 · GHSA-hvpr-p4pv-4f46
- High, CVSS 8.2
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
Bitnami rclone · Upgrade to 1.74.2 or later · >= 1.37.0, < 1.74.2 · CVE-2026-116192 · GHSA-xqmq-v4wj-rw5m
- High, CVSS 8.7
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
Bitnami rclone · Upgrade to 1.75.2 or later · < 1.75.2 · CVE-2026-116191 · GHSA-44pm-2q5p-fm63
- High, CVSS 7.7
rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
Bitnami rclone · Upgrade to 1.75.2 or later · >= 1.55.0, < 1.75.2 · CVE-2026-116189 · GHSA-w33h-3qgq-8mv8 · amended
- High, CVSS 7.5
OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
Bitnami openbao · Upgrade to 2.6.3 or later · >= 2.3.0, < 2.6.3 · CVE-2026-115365 · GHSA-mjch-vcw3-hhmf
- High, CVSS 8.1
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-90800
- High, CVSS 7.7
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-90797
- Critical, CVSS 9.3
Apache CouchDB: Admin credentials leading to code execution as operating system user
Bitnami couchdb · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2026-86471
A vendor fix does not resolve your finding until you verify it in your own systems.