High, CVSS 8.7
image-size: JXL and HEIF parsers allow denial of service through infinite loops
npm image-size · Upgrade to 2.0.3 or later · >= 1.2.0, <= 2.0.2 · CVE-2025-71329 · GHSA-5p2g-fcmc-qvqq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents
Go github.com/nezhahq/nezha · Upgrade to 2.0.14 or later · >= 1.0.0, < 2.0.14 · CVE-2026-49396 · GHSA-8qhj-4f8c-j8qg
- Critical, CVSS 9.1
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
Go github.com/dhax/go-base · Upgrade to 0.0.0-20260517152733-cc82b9740fa6 (pre-release) or later · < 0.0.0-20260517152733-cc82b9740fa6 · CVE-2026-48031 · GHSA-mqq6-462x-jxmm
- High, CVSS 8.4
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
npm @hulumi/drift · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48036 · GHSA-32g3-35g9-wc9g · amended
- High, CVSS 7.1
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
npm @hulumi/baseline · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48035 · GHSA-2mxr-p26x-mj73 · amended
- High, CVSS 8.5
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48034 · GHSA-9vc9-4jv3-rf86 · amended
- High, CVSS 8.4
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48033 · GHSA-rhgj-6g2c-frmm · amended
- High, CVSS 8.3
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
npm @hulumi/policies · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-48032 · GHSA-g759-4pxw-6692 · amended
- High, CVSS 8.4
Concrete CMS: PHP Object Injection via unserialize() calls
Packagist concrete5/concrete5 · Upgrade to 9.5.2 or later · < 9.5.2 · CVE-2026-10721 · GHSA-g82f-9pw7-773w
- High, CVSS 8.6
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter
Packagist buddypress/buddypress · Upgrade to 14.5.0 or later · < 14.5.0 · CVE-2026-53673 · GHSA-j3j5-5m8v-7gvc
- High, CVSS 8.1
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41729 · GHSA-j388-8rm5-p97f
- High, CVSS 8.1
Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
Maven org.springframework.pulsar:spring-pulsar · Upgrade to 2.0.6 or 1.2.18 by release line; some affected versions have no fix yet · >= 2.0.0, <= 2.0.5; >= 1.2.0, <= 1.2.17; <= 1.1.17 · CVE-2026-41732 · GHSA-gg69-9wwp-6jx2
- High, CVSS 8.1
In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
Maven org.springframework.kafka:spring-kafka · Upgrade to 4.0.6 or 3.3.16 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.3.0, <= 3.3.15; >= 3.2.0, <= 3.2.13; >= 2.9.0, <= 2.9.13; <= 2.8.11 · CVE-2026-41731 · GHSA-xq69-5h5v-x9x4
- High, CVSS 7.5
Spring Data REST has Improper Access Control in its JSON Patch Implementation
Maven org.springframework.data:spring-data-rest-core · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.3.0, <= 4.3.16; <= 3.7.19 · CVE-2026-41728 · GHSA-cv39-x4c6-hhp2
- High, CVSS 8.1
Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection
Maven org.springframework.data:spring-data-mongodb · Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet · >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.0.0, <= 4.3.16; <= 3.4.19 · CVE-2026-41717 · GHSA-5whc-4q84-fj73
- High, CVSS 7.5
Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys
Maven org.springframework.data:spring-data-commons · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.14; >= 3.3.0, <= 3.3.16; <= 2.7.19 · CVE-2026-41716 · GHSA-9fw2-h3hf-293r
- High, CVSS 7.5
Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)
Maven org.springframework.security:spring-security-saml2-service-provider · Upgrade to 7.0.6 or 6.5.11 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.5; >= 6.5.0, <= 6.5.10; >= 6.4.0, <= 6.4.16; >= 6.3.0, <= 6.3.16; >= 5.8.0, <= 5.8.25; <= 5.7.23 · CVE-2026-40988 · GHSA-m69x-pw9p-7j3q
- High, CVSS 7.6
Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters
Maven org.springframework.security:spring-security-saml2-service-provider · Upgrade to 7.0.6 or 6.5.11 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.5; >= 6.5.0, <= 6.5.10; >= 6.4.0, <= 6.4.16; >= 6.3.0, <= 6.3.16; >= 5.8.0, <= 5.8.25; <= 5.7.23 · CVE-2026-41003 · GHSA-3pjj-qpw6-5fcm
- High, CVSS 7.3
Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository
Maven org.springframework.security:spring-security-saml2-service-provider · Upgrade to 7.0.6 or later · >= 7.0.0, <= 7.0.5 · CVE-2026-40993 · GHSA-2q7c-5gjm-7q23
- Critical, CVSS 9.9
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Packagist pheditor/pheditor · Upgrade to 2.0.4 or later · >= 2.0.1, <= 2.0.3 · CVE-2026-48030 · GHSA-jvc5-6g7q-c843
- High, CVSS 8.7
Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
Go github.com/dexidp/dex · Upgrade to 0.0.0-20260303131938-204dbb2e3ff7 (pre-release) or later · < 0.0.0-20260303131938-204dbb2e3ff7 · GHSA-7qjx-gp9h-65qj
- Critical, CVSS 9.2
shell-quote quote() does not escape newlines in object .op values
npm shell-quote · Upgrade to 1.8.4 or later · >= 1.1.0, <= 1.8.3 · CVE-2026-9277 · GHSA-w7jw-789q-3m8p · amended
- High, CVSS 7.4
degit has a Command Injection issue
npm degit · Upgrade to 3.3.1 or 2.8.6 by release line · < 2.8.6; >= 3.0.0, < 3.3.1 · CVE-2026-11572 · GHSA-77c7-pq4r-6mcq · amended
- High, CVSS 7.5
Spring Framework Algorithmic Denial of Service via SpEL Expressions
Maven org.springframework:spring-expression · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41850 · GHSA-r5w3-xv2f-j59q
- High, CVSS 8.1
Spring Framework Unsafe Deserialization via Jackson JMS Converters
Maven org.springframework:spring-jms · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · <= 5.3.39; >= 6.0.0, <= 6.1.21; >= 6.2.0, <= 6.2.18; >= 7.0.0-M1, <= 7.0.7 · CVE-2026-41855 · GHSA-x863-p983-p4f7
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.