High, CVSS 7.5
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
Maven io.github.ndsev:zserio-runtime · Upgrade to 2.18.1 or later · <= 2.18.0 · CVE-2026-33524 · GHSA-cwq5-8pvq-j65j
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
crates.io rustls-webpki · Upgrade to 0.104.0-alpha.7 (pre-release) or 0.103.13 by release line · < 0.103.13; >= 0.104.0-alpha.1, < 0.104.0-alpha.7 · GHSA-82j2-j2ch-gfr8
- High, CVSS 8.1
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
npm @budibase/backend-core · Upgrade to 3.35.10 or later · < 3.35.10 · CVE-2026-42239 · GHSA-4f9j-vr4p-642r · amended
- Critical, CVSS 9.3Exploited · CISA KEV
LiteLLM has SQL Injection in Proxy API key verification
PyPI litellm · Upgrade to 1.83.7 or later · >= 1.81.16, < 1.83.7 · CVE-2026-42208 · GHSA-r75f-5x8p-qvmc · amended
- High, CVSS 8.8
Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources
RubyGems avo · Upgrade to 3.31.2 or later · < 3.31.2 · CVE-2026-42205 · GHSA-qc5p-3mg5-9fh8
- High, CVSS 8.6
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
PyPI litellm · Upgrade to 1.83.7 or later · >= 1.80.5, < 1.83.7 · CVE-2026-42203 · GHSA-xqmj-j6mv-4862 · amended
- High, CVSS 7.1
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
Go github.com/QuantumNous/new-api · Upgrade to 0.12.10 or later · < 0.12.10 · CVE-2026-41432 · GHSA-xff3-5c9p-2mr4
- High, CVSS 7.5
russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler
crates.io russh · Upgrade to 0.60.1 or later · < 0.60.1 · CVE-2026-42189 · GHSA-f5v4-2wr6-hqmg
- High, CVSS 8.1
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
RubyGems erb · Upgrade to 6.0.4, 6.0.1.1, 4.0.4.1 or 4.0.3.1 by release line · < 4.0.3.1; >= 4.0.4, <= 4.0.4; >= 5.0.0, < 6.0.1.1; >= 6.0.2, < 6.0.4 · CVE-2026-41316 · GHSA-q339-8rmv-2mhv
- High, CVSS 7.5
liquidjs has a Denial of Service via circular block reference in layout
npm liquidjs · Upgrade to 10.25.7 or later · < 10.25.7 · CVE-2026-41311 · GHSA-4rc3-7j7w-m548 · amended
- High, CVSS 8.1
Contour has Lua code injection via Cookie Path Rewrite Policy
Go github.com/projectcontour/contour · Upgrade to 1.33.4, 1.32.5 or 1.31.6 by release line · >= 1.19.0, < 1.31.6; >= 1.32.0, < 1.32.5; >= 1.33.0, < 1.33.4 · CVE-2026-41246 · GHSA-x4mj-7f9g-29h4
- High, CVSS 8.8
Apache ActiveMQ Vulnerable to Code Injection
Maven org.apache.activemq:activemq-broker +2 · Upgrade all 3 to 6.2.5 or 5.19.6 by release line · < 5.19.6; >= 6.0.0, < 6.2.5 · CVE-2026-41044 · GHSA-mr6m-xj7v-3cv3
- High, CVSS 8.8
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
Maven org.apache.activemq:activemq-broker +2 · Upgrade all 3 to 6.2.5 or 5.19.6 by release line · < 5.19.6; >= 6.0.0, < 6.2.5 · CVE-2026-40466 · GHSA-w3w2-mpp5-92gm
- High, CVSS 8.1
Apache DolphinScheduler has an Incorrect Authorization Vulnerability
Maven org.apache.dolphinscheduler:dolphinscheduler · Upgrade to 3.4.1 or later · < 3.4.1 · CVE-2026-23902 · GHSA-72mv-wwvm-vgp5
- High, CVSS 7.5
Grafana Tempo has an Uncontrolled Resource Consumption issue
Go github.com/grafana/tempo · Upgrade to 2.10.2, 2.9.2 or 2.8.4 by release line · >= 1.3.0, < 2.8.4; >= 2.9.0, < 2.9.2; >= 2.10.0, < 2.10.2 · CVE-2026-21728 · GHSA-p4r4-xvrq-gvmc
- High, CVSS 8.8
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
npm openlearnx · Upgrade to 2.0.3 or later · < 2.0.3 · CVE-2026-41900 · GHSA-8h25-q488-4hxw · amended
- High, CVSS 7.7
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller
Go github.com/argoproj/argo-workflows/v4 · Upgrade to 4.0.5 or later · >= 4.0.0, < 4.0.5 · +1 more package · CVE-2026-40886 · GHSA-5jv8-h7qh-rf5p
- High, CVSS 7.1
Apktool: Path Traversal to Arbitrary File Write
Maven org.apktool:apktool-lib · Upgrade to 3.0.2 or later · >= 3.0.0, < 3.0.2 · CVE-2026-39973 · GHSA-m8mh-x359-vm8m
- High, CVSS 7.6
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Packagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · < 4.9.0; >= 5.0.0, < 5.4.0 · CVE-2026-34587 · GHSA-jcjw-58rv-c452
- High, CVSS 8.8
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
npm @actual-app/sync-server · Upgrade to 26.4.0 or later · < 26.4.0 · CVE-2026-33318 · GHSA-prp4-2f49-fcgp · amended
- Critical, CVSS 9.8
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
PyPI pipecat-ai · Upgrade to 0.0.94 or later · >= 0.0.41, < 0.0.94 · CVE-2025-62373 · GHSA-c2jg-5cp7-6wc7 · amended
- Critical, CVSS 9.8
ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function
Go heckel.io/ntfy/v2 · Upgrade to 2.22.0 or later · < 2.22.0 · CVE-2026-39087 · GHSA-pqhx-w72w-m393
- Critical, CVSS 9.1
Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege
NuGet microsoft.aspnetcore.dataprotection · Upgrade to 10.0.7 or later · >= 10.0.0, <= 10.0.6 · CVE-2026-40372 · GHSA-9mv3-2cwr-p262
- High, CVSS 8.1
Evolver: Path Traversal via
--outflag infetchcommand allows Arbitrary File Writenpm @evomap/evolver · Upgrade to 1.69.3 or later · < 1.69.3 · CVE-2026-42075 · GHSA-r466-rxw4-3j9j · amended
- Critical, CVSS 9.8
Evolver: Command Injection via
execSyncin_extractLLM()function allows Remote Code Executionnpm @evomap/evolver · Upgrade to 1.69.3 or later · < 1.69.3 · CVE-2026-42076 · GHSA-j5w5-568x-rq53 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.