High, CVSS 7.5
jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine
Maven org.jdbi:jdbi3-freemarker · Upgrade to 3.53.0 or later · <= 3.52.1 · GHSA-mggx-p7jf-jgw4
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.3
authd: Primary group ID is incorrectly set to value of UID
Go github.com/canonical/authd · Upgrade to 0.6.4 or later · >= 0.6.0, < 0.6.4 · CVE-2026-6970 · GHSA-fg3j-5w9g-hmg7
- High, CVSS 7.5
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
npm mongoose · Upgrade to 9.1.6, 8.22.1, 7.8.9 or 6.13.9 by release line · < 6.13.9; >= 7.0.0, <= 7.8.8; >= 8.0.0, <= 8.22.0; >= 9.0.0, <= 9.1.5 · CVE-2026-42334 · GHSA-wpg9-53fq-2r8h · amended
- High, CVSS 8.7
rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
crates.io openssl · Upgrade to 0.10.79 or later · >= 0.9.7, < 0.10.79 · CVE-2026-42327 · GHSA-xp3w-r5p5-63rr · amended
- High, CVSS 8.9
Grav is Vulnerable to Stored XSS via Tag Injection
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42611 · GHSA-w8cg-7jcj-4vv2
- High, CVSS 8.8
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42608 · GHSA-hmcx-ch82-3fv2
- High, CVSS 7.7
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
PyPI ironic-python-agent · Upgrade to 35.0.1, 32.0.1, 29.0.5 or 26.1.6 by release line · >= 33.0.0, < 35.0.1; >= 30.0.0, < 32.0.1; >= 27.0.0, < 29.0.5; < 26.1.6 · CVE-2026-42997 · GHSA-54w4-233h-x86g · amended
- High, CVSS 8.1
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42609 · GHSA-rr73-568v-28f8
- High, CVSS 8.5
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42612 · GHSA-9695-8fr9-hw5q
- Critical, CVSS 9.4
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42613 · GHSA-pxm6-mhxr-q4mj
- Critical, CVSS 9.1
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42607 · GHSA-w48r-jppp-rcfw
- High, CVSS 8.8
Grav API Privilege Escalation to Super Admin
Packagist getgrav/grav-plugin-api · Upgrade to 1.0.0-beta.15 (pre-release) or later · < 1.0.0-beta.15 · CVE-2026-42843 · GHSA-r945-h4vm-h736
- High, CVSS 8.1
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
PyPI pyload-ng · Upgrade to 0.5.0b3.dev100 (pre-release) or later · <= 0.5.0b3.dev99 · CVE-2026-42315 · GHSA-838g-gr43-qqg9 · amended
- High, CVSS 7.5
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
Packagist phpseclib/phpseclib · Upgrade to 3.0.52, 2.0.54 or 1.0.29 by release line · >= 2.0.0, <= 2.0.53; >= 3.0.0, <= 3.0.51; >= 0.1.1, <= 1.0.28 · CVE-2026-44167 · GHSA-3qpq-r242-jqj7
- High, CVSS 7.5
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
PyPI changedetection-io · Upgrade to 0.55.1 or later · <= 0.54.10 · CVE-2026-43891 · GHSA-8757-69j2-hx56 · amended
- High, CVSS 8.1
@evomap/evolver's validator sandbox allowlist permits
npm/npx, yielding RCE from Hub-delivered validation tasks via lifecycle scriptsnpm @evomap/evolver · Upgrade to 1.70.0-beta.5 (pre-release) or later · <= 1.70.0-beta.4 · GHSA-jxh8-jh77-xh6g · amended
- High, CVSS 8.8
@evomap/evolver: Path Traversal in
evolver fetchdefault-branchsafeIdallows Hub-controlled overwrite of project files (RCE)npm @evomap/evolver · Upgrade to 1.70.0-beta.5 (pre-release) or later · <= 1.70.0-beta.4 · GHSA-cfcj-hqpf-hccf · amended
- High, CVSS 7.5
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
PyPI twisted · Upgrade to 26.4.0rc2 (pre-release) or later · <= 25.5.0 · CVE-2026-42304 · GHSA-grgv-6hw6-v9g4 · amended
- Critical, CVSS 9.3
DevGuard has an unauthenticated identity assertion via
X-Admin-TokenheaderGo github.com/l3montree-dev/devguard · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-42300 · GHSA-2g9v-7mr5-fgjg
- High, CVSS 7.5
GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
Go github.com/osrg/gobgp/v4 · Upgrade to 4.5.0 or later · >= 4.4.0, <= 4.4.0 · CVE-2026-42285 · GHSA-p3w2-64xm-833j
- Critical, CVSS 9.2
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
npm magicmirror · Upgrade to 2.36.0 or later · <= 2.35.0 · CVE-2026-42281 · GHSA-ph6f-2cvq-79hq · amended
- High, CVSS 8.8
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
PyPI jupyterlab · Upgrade to 4.5.7 or later · >= 4.0.0, <= 4.5.6 · CVE-2026-42266 · GHSA-37w4-hwhx-4rc4 · amended
- High, CVSS 8.2
open-websearch has SSRF in
fetchWebContentMCP tool: bracketed IPv6 literals and non-resolving hostname check bypassisPrivateOrLocalHostnamenpm open-websearch · Upgrade to 2.1.7 or later · <= 2.1.6 · CVE-2026-42260 · GHSA-v228-72c7-fx8j · amended
- High, CVSS 7.3
YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers
NuGet yafnet.core · Upgrade to 4.0.5 or 3.2.12 by release line · >= 4.0.0-beta01, <= 4.0.4; <= 3.2.11 · CVE-2026-43939 · GHSA-8rq5-wwpp-fmj2
- High, CVSS 8.8
YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via
/Admin/RunSqlNuGet yafnet.core · Upgrade to 4.0.5 or later · <= 4.0.4 · CVE-2026-43937 · GHSA-xhw7-j96h-c3g5
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.