Medium, CVSS 6.8
AWS CLI: Overly permissive File Permissions
PyPI awscli · Upgrade to 1.44.78 or later · <= 1.44.77 · CVE-2026-13769 · GHSA-wfp6-f47h-hxc3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3401–3425 of 30,921 matching · newest first
- Low, CVSS 3.3
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
PyPI onnx · Upgrade to 1.22.0 or later · >= 1.3.0, <= 1.21.0 · CVE-2026-63632 · GHSA-p893-rvq9-2xf9 · amended
- High, CVSS 8.6
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
PyPI ray · Upgrade to 2.56.0 or later · < 2.56.0 · CVE-2026-57516 · GHSA-hhrp-gw25-jr43 · amended
- High, CVSS 8.7
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.4 or 1.29.1 by release line · >= 1.30.0, < 1.32.4; < 1.29.1 · CVE-2026-59859 · GHSA-jqwh-526h-c92j
- High, CVSS 7.5
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59862 · GHSA-7f3j-j7jj-r3vr
- High, CVSS 7.5
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59861 · GHSA-xg2h-5xr2-29jw
- High, CVSS 8.3
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
npm better-auth · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.1.3, < 1.6.22; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67327 · GHSA-qq9h-g4jm-xgf3 · amended
- High, CVSS 7.1
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
npm @better-auth/stripe · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.21 by release line · >= 1.4.11, < 1.6.21; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67329 · GHSA-h3rm-78g3-j7cp · amended
- Critical, CVSS 9.9
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
npm @better-auth/scim · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.4.0-beta.27, <= 1.6.21; >= 1.7.0-beta.0, <= 1.7.0-beta.9 · CVE-2026-67330 · GHSA-rjg6-39jm-rgg4 · amended
- Medium, CVSS 6.0
BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
PyPI blender-mcp · Upgrade to 1.6.5 or later · < 1.6.5 · CVE-2026-66004 · GHSA-4h8q-hh2j-755w · amended
- Medium, CVSS 6.9
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
PyPI datasets · Upgrade to 5.0.1 or later · < 5.0.1 · CVE-2026-66007 · GHSA-379c-qx7v-6h59 · amended
- Low, CVSS 1.8
ImageMagick: Heap Buffer Over-Write in X11 import with crafted window title
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-76q6-2p6h-xjqr
- High, CVSS 8.7
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.3 or 1.29.1 by release line · >= 1.30.0, < 1.32.3; < 1.29.1 · CVE-2026-59860 · GHSA-3hrf-2gc2-mx32
- High, CVSS 7.5
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
PyPI httplib2 · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-59939 · GHSA-j5g9-f88f-gfj3 · amended
- Low, CVSS 2.5
ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-h5r4-w88w-7ccr
- Low, CVSS 3.7
ImageMagick: Memory Leak in ICON decoder when allocation fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-h58x-r7f7-rh84
- Low, CVSS 2.9
ImageMagick: Memory leak in VIFF encoder when allocation fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-m596-67p7-69wh
- Low, CVSS 2.9
ImageMagick: Memory Leak in MIFF encoder when allocaton fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-r628-69v2-2f9c
- Low, CVSS 3.7
ImageMagick: Memory Leak in YUV decoder when opening of blob fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-h7f2-f9cc-h2gv
- Low, CVSS 2.9
ImageMagick: Memory Leak in TIFF encoder when an allocation fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-jfq9-q63x-rc63
- Low, CVSS 2.9
ImageMagick: Memory Leak in JNG encoder when a blob could not be opened
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-99w9-hv66-rfv7
- Low, CVSS 2.9
ImageMagick: Memory Leak in hough lines operation when an operation fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-j8rh-v2r8-v94x
- Low, CVSS 2.9
ImageMagick: Memory Leak in color transformation to log colorspace when operation fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-7c7m-fpjw-gwcq
- Low, CVSS 2.9
ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-6vxp-gfwf-hcr9
- Low, CVSS 2.9
ImageMagick: Information Disclosure when printing profiles with debug enabled
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-hwf3-r46v-5ggx
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.