High, CVSS 7.5
Klever-Go KVM: Hash-array amplification in P2P resolver request handling
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · < 1.7.18 · CVE-2026-47249 · GHSA-w342-mj6g-v9c4
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.6
Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
Go github.com/siderolabs/omni · Upgrade to 1.7.3 or 1.6.6 by release line · >= 1.3.0, < 1.6.6; >= 1.7.0, < 1.7.3 · CVE-2026-45726 · GHSA-wv8c-6mx2-xf4j
- High, CVSS 7.0
Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token
Go github.com/siderolabs/omni · Upgrade to 1.7.3 or 1.6.6 by release line · < 1.6.6; >= 1.7.0, < 1.7.3 · CVE-2026-45720 · GHSA-5x9f-6vg5-qg4m
- High, CVSS 7.8
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
PyPI ansible-core · Upgrade to 2.21.1rc1 (pre-release), 2.20.7rc1 (pre-release), 2.19.11rc1 (pre-release) or 2 more by release line · < 2.16.19rc1; >= 2.17.0b1, < 2.18.18rc1; >= 2.19.0b1, < 2.19.11rc1; >= 2.20.0b1, < 2.20.7rc1; >= 2.21.0b1, < 2.21.1rc1 · CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj · amended
- Critical, CVSS 9.3
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
PyPI stata-mcp · Upgrade to 1.17.3 or later · < 1.17.3 · CVE-2026-47708 · GHSA-4p62-hqp5-g644 · amended
- Critical, CVSS 9.6
Supply chain compromise via malicious @cap-js/openapi
npm @cap-js/openapi · Upgrade to 1.4.2 or later · >= 1.4.1, <= 1.4.1 · GHSA-jpvj-wpmj-h7rv · amended
- Critical, CVSS 9.1
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
Maven org.apache.fory:fory-core · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-50076 · GHSA-8f39-v287-78jf
- High, CVSS 7.5
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)
Go github.com/klever-io/klever-go · Upgrade to 1.7.17 or later · < 1.7.17 · GHSA-74m6-4hjp-7226
- High, CVSS 7.5
React Router vulnerable to Denial of Service via reflected user input in single-fetch
npm react-router · Upgrade to 7.14.0 or later · >= 7.0.0, < 7.14.0 · +1 more package · CVE-2026-34077 · GHSA-rxv8-25v2-qmq8 · amended
- High, CVSS 8.3
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
Go github.com/nuclio/nuclio · Upgrade to 0.0.0-20260513101907-1915cd26d514 (pre-release) or later · < 0.0.0-20260513101907-1915cd26d514 · CVE-2026-45730 · GHSA-m8xg-8xg9-mxhm
- High, CVSS 7.6
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
npm better-auth · Upgrade to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-45337 · GHSA-cq3f-vc6p-68fh · amended
- High, CVSS 7.5
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44496 · GHSA-hfxv-24rg-xrqf · amended
- High, CVSS 7.5
Allocation of Resources Without Limits or Throttling in Axios
npm axios · Upgrade to 1.16.0 or later · >= 1.7.0, < 1.16.0 · CVE-2026-44488 · GHSA-777c-7fjr-54vf · amended
- High, CVSS 8.2
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44487 · GHSA-p92q-9vqr-4j8v · amended
- High, CVSS 7.5
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44486 · GHSA-j5f8-grm9-p9fc · amended
- Critical, CVSS 9.9
OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
PyPI mistral · Upgrade to 20.1.1; some affected versions have no fix yet · >= 20.0.0, < 20.1.1; >= 21.0.0, <= 21.0.0; >= 22.0.0, <= 22.0.0 · CVE-2026-41283 · GHSA-9hfw-w3f4-c4p8 · amended
- High, CVSS 8.1
Froxlor's API Authentication bypasses 2FA Authentication
Packagist froxlor/froxlor · Upgrade to 2.3.7 or later · < 2.3.7 · CVE-2026-52793 · GHSA-f9rx-7wf7-jr36
- Critical, CVSS 10.0
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
PyPI jupyter-enterprise-gateway · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-44182 · GHSA-cfw7-6c5v-2wjq · amended
- Critical, CVSS 10.0
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
PyPI jupyter-enterprise-gateway · Upgrade to 3.3.0 or later · >= 2.0.0rc2, < 3.3.0 · CVE-2026-44181 · GHSA-f49j-v924-fx9w · amended
- High, CVSS 8.4
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
Packagist concrete5/concrete5 · Upgrade to 9.5.2 or later · < 9.5.2 · CVE-2026-7888 · GHSA-52pr-7vmf-2w7x
- Critical, CVSS 9.8
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
PyPI jupyter-enterprise-gateway · Upgrade to 3.3.0 or later · >= 2.0.0rc1, < 3.3.0 · CVE-2026-44180 · GHSA-chq7-94j8-cj28 · amended
- High, CVSS 8.6
Docling Core: Unsafe remote filename resolution
PyPI docling-core · Upgrade to 2.74.1 or later · >= 1.5.0, < 2.74.1 · CVE-2026-44023 · GHSA-jmmv-h3mp-59v8 · amended
- High, CVSS 8.1
Docling Core: Insufficient validation of image reference URIs
PyPI docling-core · Upgrade to 2.74.1 or later · >= 2.5.0, < 2.74.1 · CVE-2026-44019 · GHSA-j5xp-7m2f-49jv · amended
- High, CVSS 7.1
Docling: Unsafe URI and Path Handling in HTML Backend
PyPI docling · Upgrade to 2.94.0 or later · < 2.94.0 · CVE-2026-47214 · GHSA-q29v-xc37-wh5m · amended
- High, CVSS 7.5
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
PyPI docling · Upgrade to 2.74.0 or later · >= 2.13.0, < 2.74.0 · CVE-2026-44020 · GHSA-m88r-rg27-5xfg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.