Unrated
Avoid quadratic complexity in resolvePath in net/url
Go stdlib · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · CVE-2026-56860
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2851–2875 of 30,921 matching · newest first
- Unrated
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Go toolchain · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · +1 more package · CVE-2026-56864
- Unrated
Fix Javascript regexp context tracking in html/template
Go stdlib · Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line · < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 · CVE-2026-56858
- High, CVSS 8.5
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
npm @trigger.dev/core · Upgrade to 4.5.6 or later · >= 3.3.8, <= 4.5.5 · CVE-2026-73654 · GHSA-p28v-f755-9qrg
- Medium, CVSS 6.5
vLLM: Completion prompt lists fan out into unbounded engine requests
PyPI vllm · Upgrade to 0.26.0 or later · >= 0.19.0, < 0.26.0 · CVE-2026-73559 · GHSA-87x5-vmc3-756j
- High, CVSS 8.2
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
PyPI atomic-agents-stack · Upgrade to 1.1.0 or later · <= 1.0.0 · GHSA-rm43-82j9-r4mj
- Medium, CVSS 6.8
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
PyPI pydantic-ai +1 · Upgrade all 2 to 2.0.0b6 (pre-release) or 1.106.0 by release line · >= 1.65.0, < 1.106.0; >= 2.0.0b1, < 2.0.0b6 · CVE-2026-54249 · GHSA-h7p7-w5gc-xj3w · amended
- Unrated
hashi-vault-js: Vault token and secret values exposed in thrown errors
npm hashi-vault-js · Upgrade to 0.5.2 or later · <= 0.5.1 · CVE-2026-55102 · GHSA-5pq8-3ffp-7w5m
- Medium, CVSS 6.8
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
npm ep_etherpad-lite · Upgrade to 3.1.0 or later · >= 2.6.0, <= 3.0.0 · CVE-2026-55088 · GHSA-vqfp-p66c-xrp9
- Medium, CVSS 4.2
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
npm ep_etherpad-lite · Upgrade to 3.1.0 or later · <= 3.0.0 · CVE-2026-55086 · GHSA-2jwf-f4xq-f24h · amended
- Medium, CVSS 6.1
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
npm ep_etherpad-lite · Upgrade to 3.1.0 or later · >= 2.1.0, <= 3.0.0 · CVE-2026-55087 · GHSA-fjgc-3mj7-8rg8
- High, CVSS 8.5
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
Packagist pimcore/pimcore · Upgrade to 2026.1.5 or 12.3.9 by release line · >= 2026.1.0, <= 2026.1.4; < 12.3.9 · CVE-2026-55072 · GHSA-2mhj-fhvg-v428 · amended
- Medium, CVSS 6.6
baseline-browser-mapping process termination on invalid input causes denial of service
npm baseline-browser-mapping · Upgrade to 2.11.0 or later · >= 2.0.0, < 2.11.0 · CVE-2026-45819 · GHSA-w5vr-8v7q-w6rv
- High, CVSS 7.7
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
PyPI ansible-jailexec · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2026-55074 · GHSA-cxgv-hp74-jj7r
- High, CVSS 7.5
SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)
NuGet sipsorcery · Upgrade to 10.0.14 or later · >= 10.0.5, <= 10.0.13 · GHSA-pfvm-w89x-94jw · amended
- High, CVSS 7.5
SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing
NuGet sipsorcery · Upgrade to 10.0.14 or later · < 10.0.14 · CVE-2026-123805 · GHSA-jwjp-4649-v8jp · amended
- High, CVSS 8.4
MCP-for-Stata: Stata Command Injection via Unsanitized
packageinado_package_installPyPI stata-mcp · Upgrade to 1.19.0 or later · < 1.19.0 · CVE-2026-55071 · GHSA-49m4-vp58-wgc9
- High, CVSS 7.8
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260526080459-dd1b4287899e (pre-release) or later · < 0.0.0-20260526080459-dd1b4287899e · CVE-2026-54917 · GHSA-w62w-66v9-vvgv · amended
- Medium, CVSS 6.5
Apache Airflow missing team context permits cross-team Dag actions and XCom reads
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68971 · GHSA-5247-m8w9-2v4m
- Medium, CVSS 6.5
Apache Airflow Task SDK fails to mask list-shaped JSON Variables
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68970 · GHSA-f3c2-j7g8-vpp8
- Medium, CVSS 6.5
Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68969 · GHSA-cjv4-7hp2-2x9h
- Medium, CVSS 5.4
Apache Airflow XCom API permits unsafe deserialization through JSON string literals
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-59242 · GHSA-fcmm-42r9-mmmm
- High, CVSS 7.5
Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68968 · GHSA-j4jc-cq9h-xrhr
- High, CVSS 7.3
Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-67260 · GHSA-q4c3-7575-55j2
- Medium, CVSS 6.5
Apache Airflow Config API exposes team-scoped sensitive configuration values
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-65017 · GHSA-c56v-8w4g-3mfm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.