Critical, CVSS 10.0
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
npm vm2 · Upgrade to 3.11.0 or later · >= 3.9.6, <= 3.10.5 · CVE-2026-44005 · GHSA-vwrp-x96c-mhwq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 10.0
vm2 Access to Host Object Enables Sandbox Escape
npm vm2 · Upgrade to 3.11.0 or later · <= 3.10.5 · CVE-2026-43997 · GHSA-47x8-96vw-5wg6 · amended
- Critical, CVSS 10.0
vm2 has a Sandbox Escape Vulnerability
npm vm2 · Upgrade to 3.11.0 or later · <= 3.10.5 · CVE-2026-44006 · GHSA-qcp4-v2jj-fjx8 · amended
- Critical, CVSS 9.1
FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion
Go github.com/gtsteffaniak/filebrowser · Upgrade to 0.0.0-20260501183844-112740bdd41d (pre-release) or later · < 0.0.0-20260501183844-112740bdd41d · CVE-2026-44542 · GHSA-fwj3-42wh-8673
- High, CVSS 7.5
Talos Linux has a local privilege escalation from untrusted workloads
Go github.com/siderolabs/talos · Upgrade to 1.12.7 or later · < 1.12.7 · GHSA-m38g-vww2-mvgx
- High, CVSS 7.4
katalyst-koi: Session cookies can be replayed after user logout
RubyGems katalyst-koi · Upgrade to 5.6.0 or 4.20.0 by release line · < 4.20.0; >= 5.0.0, < 5.6.0 · CVE-2026-44511 · GHSA-4cx3-3c38-j9vv
- High, CVSS 8.2
Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI
Go github.com/free5gc/pcf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-42083 · GHSA-6rgm-gr97-x3j5
- Critical, CVSS 9.6
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Go github.com/argoproj/argo-cd/v3 · Upgrade to 3.3.9 or 3.2.11 by release line · >= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.9 · CVE-2026-42880 · GHSA-3v3m-wc6v-x4x3
- High, CVSS 7.5
rust-zserio has Unbounded Memory Allocation
crates.io rust-zserio · Upgrade to 0.5.4 or later · <= 0.5.3 · GHSA-fpf5-4jw8-67x8
- High, CVSS 8.6
Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
PyPI aegra-api · Upgrade to 0.9.7 or later · >= 0.9.0, < 0.9.7 · CVE-2026-44504 · GHSA-m98r-6667-4wq7 · amended
- High, CVSS 7.0
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Go github.com/microsoft/kiota-http-go · Upgrade to 1.5.5 or later · < 1.5.5 · +4 more packages · CVE-2026-44503 · GHSA-7j59-v9qr-6fq9 · amended
- Critical, CVSS 9.9
Fleet: Helm impersonation bypass of
RESTClientGetterretainscluster-adminduring template renderingGo github.com/rancher/fleet · Upgrade to 0.15.1, 0.14.5, 0.13.10 or 2 more by release line · >= 0.15.0, < 0.15.1; >= 0.14.0, < 0.14.5; >= 0.13.0, < 0.13.10; >= 0.12.0, < 0.12.14; >= 0.11.0, < 0.11.13 · CVE-2026-41050 · GHSA-765j-qfrp-hm3j
- High, CVSS 8.4
Rancher Extensions have arbitrary file access via path traversal
Go github.com/rancher/rancher · Upgrade to 2.14.1, 2.13.5, 2.12.9 or 2.11.13 by release line · >= 2.14.0, < 2.14.1; >= 2.13.0, < 2.13.5; >= 2.12.0, < 2.12.9; >= 2.10.11, < 2.11.13 · CVE-2026-25705 · GHSA-5v3h-x4wf-5c35
- High, CVSS 7.2
Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
Go github.com/aws/amazon-ecs-agent · Upgrade to 1.103.0 or later · >= 1.47.0, <= 1.102.2 · GHSA-fc67-c4hg-q653
- Critical, CVSS 9.4
Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.32.0 or later · <= 8.30.1 · CVE-2026-42596 · GHSA-4vmc-gm8v-m35h
- High, CVSS 7.5
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.32.0 or later · <= 8.31.0 · CVE-2026-42594 · GHSA-r33j-c622-r6qp
- High, CVSS 7.5
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Maven io.netty:netty-codec-http2 +1 · Upgrade all 2 to 4.2.13.Final or 4.1.133.Final by release line · >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final · CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv
- High, CVSS 7.3
Netty has HttpClientCodec response desynchronization
Maven io.netty:netty-codec-http · Upgrade to 4.2.13.Final or 4.1.133.Final by release line · >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final · CVE-2026-42584 · GHSA-57rv-r2g8-2cj3
- High, CVSS 7.5
Netty Lz4FrameDecoder is vulnerable to resource exhaustion
Maven io.netty:netty-codec-compression · Upgrade to 4.2.13.Final or later · <= 4.2.12.Final · +1 more package · CVE-2026-42583 · GHSA-mj4r-2hfc-f8p6
- High, CVSS 7.5
Netty HTTP/3 QPACK literal unbounded allocation
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.13.Final or later · >= 4.2.0.Final, <= 4.2.12.Final · CVE-2026-42582 · GHSA-2c5c-chwr-9hqw
- High, CVSS 7.5
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
Maven io.netty:netty-codec-dns · Upgrade to 4.2.13.Final or 4.1.133.Final by release line · >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final · CVE-2026-42579 · GHSA-cm33-6792-r9fm
- High, CVSS 7.8
gix-fs: Symlink prefix-reuse allows worktree escape during checkout
crates.io gix-fs · Upgrade to 0.21.1 or later · <= 0.21.0 · CVE-2026-44471 · GHSA-f89h-2fjh-2r9q
- High, CVSS 8.7
ldap3_proto has LDAP Filter stack exhaustion
crates.io ldap3_proto · Upgrade to 0.7.1 or later · < 0.7.1 · GHSA-qcxq-75wr-5cm8
- High, CVSS 8.7
scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion
crates.io kanidm_proto +1 · Upgrade all 2 to 1.9.3 or later · <= 1.9.2 · CVE-2026-46689 · GHSA-r5fr-9gmv-jggh
- Critical, CVSS 9.1
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
Go github.com/getaxonflow/axonflow · Upgrade to 7.5.0 or later · < 7.5.0 · GHSA-9h64-2846-7x7f
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.