High, CVSS 7.5
Netty epoll transport denial of service via RST on half-closed TCP connection
Maven io.netty:netty-transport-classes-epoll · Upgrade to 4.2.13.Final or later · >= 4.2.0.Final, < 4.2.13.Final · CVE-2026-42577 · GHSA-rwm7-x88c-3g2p
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
PyPI keras · Upgrade to 3.13.2 or 3.12.1 by release line · >= 3.0.0, <= 3.12.0; >= 3.13.0, < 3.13.2 · CVE-2026-0897 · GHSA-mgx6-5cf9-rr43 · amended
- High, CVSS 7.5
Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
NuGet nerdbank.messagepack · Upgrade to 1.1.62 or later · < 1.1.62 · CVE-2026-44375 · GHSA-2cwq-pwfr-wcw3
- High, CVSS 7.7
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
Packagist getgrav/grav-plugin-form · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-42845 · GHSA-w4rc-p66m-x6qq
- Critical, CVSS 9.1
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
npm fast-jwt · Upgrade to 6.2.4 or later · <= 6.2.3 · CVE-2026-44351 · GHSA-gmvf-9v4p-v8jc · amended
- High, CVSS 7.1
Daptin fuzzy search injects unvalidated column name into raw SQL
Go github.com/daptin/daptin · Upgrade to 0.11.5 or later · <= 0.11.4 · CVE-2026-44349 · GHSA-pwqg-q8pg-pp6r
- High, CVSS 8.4
PraisonAI has unauthenticated RCE via
tool_override.py(CVE-2026-40287 patch bypass)PyPI praisonai · Upgrade to 4.6.32 or later · >= 4.5.139, <= 4.6.31 · CVE-2026-44334 · GHSA-xcmw-grxf-wjhj · amended
- High, CVSS 7.7
PraisonAI has an SSRF bypass
PyPI praisonaiagents · Upgrade to 1.6.32 or later · <= 1.6.31 · CVE-2026-44335 · GHSA-q9pw-vmhh-384g · amended
- High, CVSS 7.8
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
PyPI gitpython · Upgrade to 3.1.49 or later · <= 3.1.48 · CVE-2026-44244 · GHSA-v87r-6q3f-2j67 · amended
- High, CVSS 7.5
python-multipart has Denial of Service via unbounded multipart part headers
PyPI python-multipart · Upgrade to 0.0.27 or later · < 0.0.27 · CVE-2026-42561 · GHSA-pp6c-gr5w-3c5g · amended
- High, CVSS 8.7
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
PyPI mako · Upgrade to 1.3.12 or later · <= 1.3.11 · CVE-2026-44307 · GHSA-2h4p-vjrc-8xpq · amended
- High, CVSS 8.6
JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content
PyPI jupyterlab · Upgrade to 4.5.7 or later · <= 4.5.6 · +1 more package · CVE-2026-42557 · GHSA-mqcg-5x36-vfcg · amended
- Critical, CVSS 9.1
Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
Maven com.ritense.valtimo:contract · Upgrade to 13.23.0 or later · >= 13.4.0, < 13.23.0 · +2 more packages · CVE-2026-42555 · GHSA-j7j9-5253-f7vh
- High, CVSS 7.5
Flight vulnerable to sensitive information disclosure via default error handler
Packagist flightphp/core · Upgrade to 3.18.1 or later · < 3.18.1 · CVE-2026-42552 · GHSA-qrch-52m5-vv85
- High, CVSS 7.5
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass
Packagist flightphp/core · Upgrade to 3.18.1 or later · < 3.18.1 · CVE-2026-42551 · GHSA-vxrr-w42w-w76g
- High, CVSS 8.8
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Packagist flightphp/core · Upgrade to 3.18.1 or later · < 3.18.1 · CVE-2026-42550 · GHSA-xwqr-rcqg-22mr
- High, CVSS 8.6
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
Packagist flightphp/core · Upgrade to 3.18.1 or later · < 3.18.1 · CVE-2026-42548 · GHSA-fcx8-ph5r-mxr4
- High, CVSS 7.5
Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic
PyPI granian · Upgrade to 2.7.4 or later · >= 1.2.0, < 2.7.4 · CVE-2026-42544 · GHSA-vrg7-482j-p6f6 · amended
- High, CVSS 8.7
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
Packagist getgrav/grav · Upgrade to 2.0.0-beta.4 (pre-release) or later · < 2.0.0-beta.4 · CVE-2026-42844 · GHSA-6xx2-m8wv-756h
- High, CVSS 7.5
Snappier has an infinite loop during SnappyStream decompression with malformed framed input
NuGet snappier · Upgrade to 1.3.1 or later · <= 1.3.0 · CVE-2026-44302 · GHSA-pggp-6c3x-2xmx
- Critical, CVSS 9.8
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46364 · GHSA-289f-fq7w-6q2w
- High, CVSS 7.5
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46366 · GHSA-99qv-g4x9-mgc3
- High, CVSS 7.5
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-46359 · GHSA-pm8c-3qq3-72w7
- Critical, CVSS 9.1
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.2 or later · <= 4.1.1 · CVE-2026-45010 · GHSA-9pq7-mfwh-xx2j
- High, CVSS 8.6
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS
Go github.com/harvester/harvester · Upgrade to 1.8.0 or later · < 1.8.0 · CVE-2025-71261 · GHSA-pgh9-mpwc-8jjf
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.