Unrated
Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
crates.io quinn-proto · Upgrade to 0.11.17 or later · >= 0.5.0, < 0.11.17 · GHSA-2hv7-gw8g-gpq5
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2826–2850 of 30,921 matching · newest first
- High, CVSS 7.5
Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
crates.io quinn-proto · Upgrade to 0.11.17 or later · >= 0.11.15, < 0.11.17 · GHSA-qfwj-vfxf-92j2
- Unrated
Unbounded growth of pending connection ID retirements in quinn-proto
crates.io quinn-proto · Upgrade to 0.11.17 or later · >= 0.6.0, < 0.11.17 · GHSA-hmxj-32vh-65vr
- Medium, CVSS 5.4
Stack overflow in phar with circular symlinks
Bitnami php +2 · Upgrade all 3 to 8.5.9, 8.4.24, 8.3.33 or 8.2.33 by release line · >= 8.2.0, < 8.2.33; >= 8.3.0, < 8.3.33; >= 8.4.0, < 8.4.24; >= 8.5.0, < 8.5.9 · CVE-2026-7260 · GHSA-vc5h-9ppw-p5f3 · amended
- Unrated
Out-of-bounds write in bccomp() via crafted operand and scale
Bitnami php +2 · Upgrade all 3 to 8.5.9 or 8.4.24 by release line · >= 8.4.0, < 8.4.24; >= 8.5.0, < 8.5.9 · CVE-2026-17544 · GHSA-x692-q9x7-8c3f · amended
- Unrated
SQL injection in ext-pgsql via E'...' backslash breakout
Bitnami php +2 · Upgrade all 3 to 8.5.9, 8.4.24, 8.3.33 or 8.2.33 by release line · >= 8.2.0, < 8.2.33; >= 8.3.0, < 8.3.33; >= 8.4.0, < 8.4.24; >= 8.5.0, < 8.5.9 · CVE-2026-17543 · GHSA-7qpv-r5mr-78m4 · amended
- Medium, CVSS 6.5
Legacy
azure_corewrites theauthorizationheader value to logscrates.io azure_core · Upgrade to 0.22.0 or 0.2.0 by release line · >= 0.0.0-0, < 0.2.0; >= 0.2.1-0, < 0.22.0
- Medium, CVSS 6.9
s2n-quic has excessive memory allocation
crates.io s2n-quic · Upgrade to 1.82.0 or later · <= 1.81.0 · CVE-2026-10740 · GHSA-9q54-f358-3fqf · amended
- Medium, CVSS 5.3
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
npm @ooples/token-optimizer-mcp · Upgrade to 5.1.0 or later · < 5.1.0 · CVE-2026-55156 · GHSA-76pc-mqxp-3rq5
- High, CVSS 8.4
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
npm @ooples/token-optimizer-mcp · Upgrade to 5.1.0 or later · < 5.1.0 · CVE-2026-55157 · GHSA-49mq-fc6q-3h46
- Medium, CVSS 6.6
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (
/admin/gateways/test)PyPI mcp-contextforge-gateway · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2026-53708 · GHSA-9hgc-g3w5-67cm
- Medium, CVSS 6.5
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
crates.io surrealdb · Upgrade to 3.1.4 or later · <= 3.1.3 · CVE-2026-63740 · GHSA-8rw6-p7m8-63jp · amended
- High, CVSS 7.1
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
Maven com.mchange:mchange-commons-java · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-55153 · GHSA-h84g-69h7-mw6v · amended
- High, CVSS 7.0
OpenAM Insecure SSO Cookie Initialization
Maven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-53660 · GHSA-fpmh-vx4h-xc33 · amended
- Medium, CVSS 6.3
Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter
Go github.com/hyperledger/fabric-ca · Upgrade to 1.5.21 or later · <= 1.5.20 · CVE-2026-53658 · GHSA-xghw-p77p-3r7x · amended
- High, CVSS 8.7
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
Packagist getgrav/grav · Upgrade to 2.0.0-rc.8 (pre-release) or 1.7.53 by release line · >= 2.0.0-beta.1, < 2.0.0-rc.8; < 1.7.53 · CVE-2026-53653 · GHSA-4x9g-vw65-vvf9 · amended
- High, CVSS 7.1
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
npm @budibase/server · Upgrade to 3.41.3 or later · < 3.41.3 · CVE-2026-35219 · GHSA-5fpj-28rv-84r7
- Unrated
Excessive memory allocation during VP8L decoding in golang.org/x/image
Go golang.org/x/image · Upgrade to 0.45.0 or later · < 0.45.0 · CVE-2026-46603
- High, CVSS 8.7
Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts
Go github.com/authorizerdev/authorizer · Upgrade to 0.0.0-20260807033110-66fe488fd2a4 (pre-release) or later · < 0.0.0-20260807033110-66fe488fd2a4 · CVE-2026-35511 · GHSA-29rf-f4vv-pvq6 · amended
- Critical, CVSS 9.1
BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses
crates.io bip322 · Upgrade to 0.0.11 or later · >= 0.0.6, < 0.0.11 · GHSA-5chw-87w3-j9cv
- Unrated
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Go toolchain · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · +1 more package · CVE-2026-56865
- Unrated
Add recursion depth guard during decode in encoding/xml
Go stdlib · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · CVE-2026-56859
- Unrated
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Go stdlib · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · CVE-2026-56853
- Unrated
Enforce maximum recursion depth in encoding/asn1
Go stdlib · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · CVE-2026-33818
- Unrated
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Go stdlib · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · CVE-2026-56862
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.