High, CVSS 7.5
Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
Go code.gitea.io/gitea · Upgrade to 1.26.4 or later · <= 1.26.2 · CVE-2026-58421 · GHSA-v96j-25gv-g2w9 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3301–3325 of 30,921 matching · newest first
- Unrated
Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea
Go code.gitea.io/gitea · Upgrade to 1.26.4 or later · < 1.26.4 · CVE-2026-58418 · GHSA-rqhx-647v-wx32
- High, CVSS 8.8
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
Go github.com/ollama/ollama · Upgrade to 0.17.1 or later · < 0.17.1 · CVE-2026-7482 · GHSA-x8qc-fggm-mpqg · amended
- High, CVSS 8.7
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Go github.com/aquasecurity/trivy · Upgrade to 0.71.0 or later · < 0.71.0 · CVE-2026-54448 · GHSA-q3fv-x8vg-qqm4 · amended
- High, CVSS 7.5
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.0 or later · < 2.11.0 · CVE-2026-54063 · GHSA-h69g-9hx6-f3v4 · amended
- High, CVSS 8.8
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
Go google.golang.org/grpc · Upgrade to 1.82.1 or later · < 1.82.1 · GHSA-hrxh-6v49-42gf · amended
- Medium, CVSS 6.3
Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Go github.com/containers/buildah · Upgrade to 1.43.2 or later · >= 1.38.1, < 1.43.2 · CVE-2026-44517 · GHSA-49p4-px3h-rq49 · amended
- Medium, CVSS 5.9
Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit
PyPI thrift · Upgrade to 0.24.0 or later · < 0.24.0 · CVE-2026-66053 · GHSA-hwrj-9rr4-24xh
- High, CVSS 7.5
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability
PyPI thrift · Upgrade to 0.24.0 or later · < 0.24.0 · CVE-2026-41608 · GHSA-6pjx-3pjc-mrj8
- High, CVSS 8.7
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
PyPI thrift +3 · Upgrade all 4 to 0.24.0 or later · < 0.24.0 · CVE-2026-43871 · GHSA-8wv5-x4w7-5gww · amended
- UnratedExploited · CISA KEV
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
Bitnami wordpress +1 · Upgrade all 2 to 7.0.2 or 6.9.5 by release line · >= 6.9.0, < 6.9.5; >= 7.0.0, < 7.0.2 · CVE-2026-63030 · GHSA-ff9f-jf42-662q · amended
- UnratedExploited · CISA KEV
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
Bitnami wordpress +1 · Upgrade all 2 to 7.0.2, 6.9.5 or 6.8.6 by release line · >= 6.8.0, < 6.8.6; >= 6.9.0, < 6.9.5; >= 7.0.0, < 7.0.2 · CVE-2026-60137 · GHSA-fpp7-x2x2-2mjf · amended
- High, CVSS 7.5
Remote Denial of Service via malformed NIP-04 IV
crates.io nostr · Upgrade to 0.45.0-alpha.6 (pre-release) or 0.44.6 by release line · >= 0.0.0-0, < 0.44.6; >= 0.45.0-alpha.1, < 0.45.0-alpha.6 · GHSA-xg7c-246g-6qpv
- High, CVSS 8.5
NLTK vulnerable to Eval Injection via collocations CLI arguments
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2025-71408 · GHSA-848c-c2cx-j7qx · amended
- Medium, CVSS 5.9
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
npm @frontmcp/adapters · Upgrade to 1.5.6 or later · <= 1.5.5 · GHSA-8q49-2h5h-434x · amended
- High, CVSS 8.4
AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
PyPI bedrock-agentcore · Upgrade to 1.18.1 or later · < 1.18.1 · CVE-2026-16796 · GHSA-j6g5-3hh3-pgw8 · amended
- High, CVSS 8.7
Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
crates.io aws-smithy-http-server · Upgrade to 0.66.5 or later · <= 0.66.4 · CVE-2026-16756 · GHSA-jvxp-qmx7-gjpx
- Medium, CVSS 5.6
Quasar: Prototype pollution in the extend() utility
npm quasar · Upgrade to 2.22.0 or later · <= 2.21.4 · CVE-2026-73647 · GHSA-3r53-75j5-3g7j · amended
- High, CVSS 7.5
OmniFaces: Forged combined-resource IDs and related output/push boundaries
Maven org.omnifaces:omnifaces · Upgrade to 5.4.2, 4.7.12, 3.14.23 or 2 more by release line · < 1.14.3; >= 2.0.0, < 2.7.33; >= 3.0.0, < 3.14.23; >= 4.0.0, < 4.7.12; >= 5.0.0, < 5.4.2 · CVE-2026-102695 · GHSA-fp43-vj7g-pg92
- High, CVSS 8.7
Shescape: Quadratic-time denial of service in the flag-protection
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · >= 2.1.11, < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73413 · GHSA-gm3r-q2wp-hw87 · amended
- Medium, CVSS 6.3
Shescape: Home-directory disclosure in assignment context on Unix with Dash
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73411 · GHSA-q53c-4prm-w95q · amended
- Critical, CVSS 9.2
Shescape: Shell injection via unescaped parentheses on Windows with CMD
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73414 · GHSA-w4hw-qcx7-56pr · amended
- Medium, CVSS 6.3
Shescape: Path disclosure on Unix with Zsh
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73412 · GHSA-6v4m-fw66-8r4x · amended
- High, CVSS 7.3
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
PyPI awslabs-aws-api-mcp-server · Upgrade to 1.3.47 or later · >= 0.2.13, < 1.3.47 · CVE-2026-16584 · GHSA-29w2-fq35-v728 · amended
- High, CVSS 7.5
blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
Maven org.http4s:http4s-blaze-server_2.12 · Upgrade to 0.23.18 or later · < 0.23.18 · +2 more packages · CVE-2026-73493 · GHSA-7ppr-r889-mcf2
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.