High, CVSS 7.5
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
Go chainguard.dev/apko · Upgrade to 1.2.7 or later · < 1.2.7 · CVE-2026-42575 · GHSA-hcwr-pq9g-rq3m
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Go chainguard.dev/apko · Upgrade to 1.2.5 or later · >= 0.14.8, < 1.2.5 · CVE-2026-42574 · GHSA-qq3r-w4hj-gjp6
- Critical, CVSS 9.0
Pelican Web UI Affected by a Privilege Escalation Attack
Go github.com/pelicanplatform/pelican · Upgrade to 0.0.0-20260408120501-7f73b9c3e677 (pre-release) or later · < 0.0.0-20260408120501-7f73b9c3e677 · CVE-2026-42571 · GHSA-rpfr-x88x-xwcw
- Critical, CVSS 9.4
phpVMS has an /importer authorization bypass causing full database wipe
Packagist nabeel/phpvms · Upgrade to 7.0.6 or later · < 7.0.6 · CVE-2026-42569 · GHSA-fv26-4939-62fh
- High, CVSS 8.8
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
Packagist azuracast/azuracast · Upgrade to 0.23.6 or later · <= 0.23.5 · GHSA-q4ph-8x8g-95f8
- High, CVSS 8.1
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
Packagist azuracast/azuracast · Upgrade to 0.23.6 or later · <= 0.23.5 · CVE-2026-42606 · GHSA-gv7r-3mr9-h5x8
- High, CVSS 8.8
AzuraCast has Path Traversal in
currentDirectoryParameter that Enables Remote Code Execution via Media UploadPackagist azuracast/azuracast · Upgrade to 0.23.6 or later · <= 0.23.5 · CVE-2026-42605 · GHSA-vp2f-cqqp-478j
- Critical, CVSS 9.0
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
Maven org.thymeleaf:thymeleaf +2 · Upgrade all 3 to 3.1.5.RELEASE or later · <= 3.1.4.RELEASE · CVE-2026-41901 · GHSA-c9ph-gxww-7744
- High, CVSS 8.7
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
npm signalk-server · Upgrade to 2.25.0 or later · <= 2.24.0 · CVE-2026-41893 · GHSA-vmfm-ch9h-5c7g · amended
- High, CVSS 8.5
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
npm openclaw · Upgrade to 2026.4.22 or later · <= 2026.4.21 · CVE-2026-44118 · GHSA-r6xh-pqhr-v4xh · amended
- High, CVSS 8.6
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
PyPI pillow · Upgrade to 12.2.0 or later · >= 10.3.0, < 12.2.0 · CVE-2026-42311 · GHSA-pwv6-vv43-88gr · amended
- High, CVSS 7.8
pyp2spec is Vulnerable to Code Injection
PyPI pyp2spec · Upgrade to 0.14.1 or later · < 0.14.1 · CVE-2026-42301 · GHSA-r35x-v8p8-xvhw · amended
- High, CVSS 8.5
Argo vulnerable to exposure of artifact repository credentials
Go github.com/argoproj/argo-workflows/v4 · Upgrade to 4.0.5 or later · >= 4.0.0, < 4.0.5 · CVE-2026-42295 · GHSA-7vf8-2cr6-54mf
- High, CVSS 8.1
Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
Go github.com/argoproj/argo-workflows/v4 · Upgrade to 4.0.5 or later · >= 4.0.0, < 4.0.5 · +1 more package · CVE-2026-42296 · GHSA-3775-99mw-8rp4
- High, CVSS 8.2
Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Go github.com/argoproj/argo-workflows/v4 · Upgrade to 4.0.5 or later · >= 4.0.0, < 4.0.5 · +1 more package · CVE-2026-42294 · GHSA-jcc8-g2q4-9fxq
- High, CVSS 8.5
Argo has Missing Authorization in its Sync ConfigMap Provider
Go github.com/argoproj/argo-workflows/v4 · Upgrade to 4.0.5 or later · >= 4.0.0, < 4.0.5 · CVE-2026-42297 · GHSA-xchc-cqwg-g76q
- High, CVSS 7.1
Kirby CMS's read access to site, user and role information is not gated by permissions
Packagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · <= 4.8.0; >= 5.0.0, <= 5.3.3 · CVE-2026-42069 · GHSA-2h7v-4372-f6x2
- High, CVSS 8.2
Kata Container has CopyFile Policy Subversion via Symlinks
Go github.com/kata-containers/kata-containers · Upgrade to 0.0.0-20260422180503-1b9e49eb2763 (pre-release) or later · < 0.0.0-20260422180503-1b9e49eb2763 · CVE-2026-41326 · GHSA-q49m-57vm-c8cc
- Critical, CVSS 9.1
OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange
Maven org.openmrs.api:openmrs-api · Upgrade to 2.8.6 or 2.7.9 by release line · >= 2.7.0, < 2.7.9; >= 2.8.0, < 2.8.6 · CVE-2026-41258 · GHSA-xj4f-8jjg-vx4q
- High, CVSS 7.1
Incus Vulnerable to Panic via Snapshot Bounds Check
Go github.com/lxc/incus/v6/cmd/incusd · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-40251 · GHSA-4m88-wxj4-9qj6
- Critical, CVSS 9.4
Apache Polaris has an Improper Input Validation Issue
Maven org.apache.polaris:polaris-runtime-service · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-42809 · GHSA-8ggj-j522-h5qf
- Critical, CVSS 9.4
Apache Polaris has an Improper Input Validation Issue
Maven org.apache.polaris:polaris-core · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-42810 · GHSA-vxgg-mqx2-3w59
- Critical, CVSS 9.4
Apache Polaris has an Improper Input Validation issue
Maven org.apache.polaris:polaris-runtime-service · Upgrade to 1.4.1 or later · >= 0.9.0, < 1.4.1 · CVE-2026-42812 · GHSA-w76p-3cgp-qfcm
- Critical, CVSS 9.8
Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest
Maven org.apache.opennlp:opennlp-tools · Upgrade to 3.0.0-M3 (pre-release), 2.5.9 or 1.9.5 by release line · >= 3.0.0-M1, < 3.0.0-M3; >= 2.0.0, < 2.5.9; < 1.9.5 · CVE-2026-42027 · GHSA-cx4m-2p55-rw7j
- Critical, CVSS 9.4
Apache Polaris has an Improper Input Validation issue
Maven org.apache.polaris:polaris-core · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-42811 · GHSA-fc3h-c6h7-r83j
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.