Medium, CVSS 6.0
Parse Server 9.0.0 before 9.10.5 LiveQuery Information Disclosure via $or Subscriptions
Bitnami parse · Upgrade to 9.10.5 or 8.6.103 by release line · < 8.6.103; >= 9.0.0, < 9.10.5 · CVE-2026-116161 · GHSA-349r-988w-x3jp
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
251–275 of 30,910 matching · newest first
- Critical, CVSS 9.4
Distrust compromised intermediate certificates in ssl module
Bitnami python-min +2 · Upgrade all 3 to 3.15.2, 3.14.10, 3.13.18 or 2 more by release line · < 3.11.18; >= 3.12.0, < 3.12.16; >= 3.13.0, < 3.13.18; >= 3.14.0, < 3.14.10; >= 3.15.0, < 3.15.2 · CVE-2026-115557 · amended
- Medium, CVSS 6.9
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
PyPI joserfc · Upgrade to 1.7.6 or later · < 1.7.6 · CVE-2026-119284 · GHSA-9pg5-8c7x-5hfx · amended
- High, CVSS 7.5
joserfc: Unbounded JWE General JSON
recipientsArray Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI joserfc · Upgrade to 1.7.5 or later · < 1.7.5 · CVE-2026-119283 · GHSA-jpxq-7h8p-2q76 · amended
- Medium, CVSS 5.9
charmbracelet/soft-serve: Race in
SetPrivateleaves a private repository readable by unauthenticated usersGo github.com/charmbracelet/soft-serve · Upgrade to 0.12.3 or later · >= 0.6.0, < 0.12.3 · GHSA-f3fj-9625-rv3m · amended
- Medium, CVSS 5.3
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
Go github.com/charmbracelet/soft-serve · Upgrade to 0.12.3 or later · >= 0.5.0, < 0.12.3 · GHSA-fgxm-5hvv-x4vh · amended
- High, CVSS 7.3
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
npm @nx/gradle +1 · Upgrade all 2 to 23.1.2 or 22.7.9 by release line · >= 21.0.0, < 22.7.9; >= 23.0.0, < 23.1.2 · CVE-2026-119282 · GHSA-qm8w-vx34-5j9j · amended
- Medium, CVSS 6.8
libsqlite3-sysvia C SQLite CVE-2026-119375crates.io libsqlite3-sys · Upgrade to 0.39.0 or later · >= 0.6.0, < 0.39.0 · CVE-2026-119375 · GHSA-72w2-rjgg-q729
- High, CVSS 7.5
nix-nar:Decoder::unpackwrites archive entries outside the destination directory (path traversal)crates.io nix-nar · Upgrade to 0.6.0 or later · >= 0.0.0-0, < 0.6.0
- Unrated
BLAKE2b produces wrong tag when using
reset()with a different-length keycrates.io orion · Upgrade to 0.18.1 or 0.17.16 by release line · >= 0.0.0-0, < 0.17.16; >= 0.18.0-0, < 0.18.1 · GHSA-xcc6-f2jq-43x6
- High, CVSS 7.1
ocipkg: unpacking an OCI archive can write and delete files outside the local image store (path traversal)crates.io ocipkg · Upgrade to 0.4.1 or later · >= 0.0.0-0, < 0.4.1
- Unrated
LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time
crates.io orion · Upgrade to 0.18.1 or 0.17.16 by release line · >= 0.0.0-0, < 0.17.16; >= 0.18.0-0, < 0.18.1 · GHSA-r7wm-4vf2-h44w
- High, CVSS 8.2
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
npm decode-uri-component · Upgrade to 0.5.1 or later · < 0.5.1 · CVE-2026-118664 · GHSA-qr28-fpjm-wq7f · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · < 26.10.0rc1 · GHSA-vpp8-g58w-m8mp · amended
- High, CVSS 7.5
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
crates.io zip · Upgrade to 9.0.0 or later · >= 5.1.0, < 9.0.0 · CVE-2026-115907 · GHSA-9hj8-73fh-9963 · amended
- High, CVSS 7.4
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
crates.io zip · Upgrade to 9.0.0 or later · >= 7.2.0, < 9.0.0 · CVE-2026-115908 · GHSA-hjqx-j4rw-g7xv · amended
- Medium, CVSS 6.5
zip: AES Entry HMAC Authentication Bypass on Premature EOF
crates.io zip · Upgrade to 9.0.0 or later · >= 0.6.0, < 9.0.0 · CVE-2026-115906 · GHSA-8hxf-qr8p-62x4 · amended
- High, CVSS 7.5
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
crates.io zip · Upgrade to 9.0.0 or later · >= 1.3.0, < 9.0.0 · CVE-2026-115909 · GHSA-q7v9-x93c-xqv3 · amended
- Medium, CVSS 6.9
Vite:
server.fs.denybypassed with queriesnpm vite · Upgrade to 6.4.5 or later · >= 6.4.4, < 6.4.5 · CVE-2026-118662 · GHSA-8g5g-mxqh-grgj · amended
- High, CVSS 7.6
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
RubyGems shopify_app · Upgrade to 23.0.3 or later · >= 22.1.0, < 23.0.3 · CVE-2026-63414 · GHSA-6j52-38f8-qhxr · amended
- High, CVSS 7.3
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
Go github.com/cert-manager/cert-manager +1 · Upgrade all 2 to 1.20.3 or 1.19.6 by release line · >= 1.18.0, < 1.19.6; >= 1.20.0-alpha.0, < 1.20.3 · CVE-2026-62290 · GHSA-8rvj-mm4h-c258 · amended
- High, CVSS 7.3
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
Bitnami keycloak · Upgrade to 26.6.4 or 26.4.13 by release line · >= 26.4.0, < 26.4.13; >= 26.6.0, < 26.6.4 · +1 more package · CVE-2026-9086 · GHSA-v3f7-2p4r-mwfw · amended
- Medium, CVSS 4.9
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Bitnami keycloak · Upgrade to 26.6.4 or 26.4.13 by release line · >= 26.4.0, < 26.4.13; >= 26.6.0, < 26.6.4 · +1 more package · CVE-2026-9083 · GHSA-9jrw-8xf7-xqhq · amended
- Medium, CVSS 4.6
Keycloak allows unauthorized access to resources via uma permission ticket bypass
Bitnami keycloak · Upgrade to 26.6.4 or 26.4.13 by release line · >= 26.4.0, < 26.4.13; >= 26.6.0, < 26.6.4 · +1 more package · CVE-2026-9799 · GHSA-w3p3-7cjg-vgfw · amended
- High, CVSS 8.1
Keycloak vulnerable to authorization bypass via incorrect uri comparison
Bitnami keycloak · Upgrade to 26.7.0 or 26.4.13 by release line · >= 26.4.0, < 26.4.13; >= 26.6.0, < 26.7.0 · +2 more packages · CVE-2026-9800 · GHSA-f5p5-6xmx-p252 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.