Critical, CVSS 10.0
openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access
Go github.com/jkroepke/openvpn-auth-oauth2 · Upgrade to 1.27.3 or later · >= 1.26.3, < 1.27.3 · CVE-2026-41070 · GHSA-246w-jgmq-88fg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.3
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Maven org.apache.httpcomponents.client5:httpclient5 · Upgrade to 5.6.1 or later · >= 5.6-alpha1, < 5.6.1 · CVE-2026-40542 · GHSA-v468-qcjx-r72w
- High, CVSS 7.5
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules
Maven org.springframework.security:spring-security-config · Upgrade to 7.0.5 or later · >= 7.0.0, <= 7.0.4 · CVE-2026-22754 · GHSA-4vrc-j85c-598c
- High, CVSS 7.5
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers
Maven org.springframework.security:spring-security-config · Upgrade to 7.0.5 or later · >= 7.0.0, <= 7.0.4 · CVE-2026-22753 · GHSA-4wrg-8wpc-h923
- High, CVSS 7.5
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
PyPI lxml · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-41066 · GHSA-vfmq-68hx-4jfw · amended
- High, CVSS 7.5
Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
Go github.com/tektoncd/pipeline · Upgrade to 1.11.1, 1.9.3, 1.6.2 or 2 more by release line · >= 1.10.0, < 1.11.1; >= 1.7.0, < 1.9.3; >= 1.4.0, < 1.6.2; >= 1.2.0, < 1.3.4; >= 1.0.0, < 1.0.2 · CVE-2026-40938 · GHSA-94jr-7pqp-xhcq
- Critical, CVSS 9.2
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41264 · GHSA-3hjv-c53m-58jj · amended
- Critical, CVSS 9.3
Brillig: Heap corruption in foreign call results with nested tuple arrays
crates.io brillig · Upgrade to 1.0.0-beta.19 (pre-release) or later · <= 1.0.0-beta.18 · CVE-2026-41197 · GHSA-jj7c-x25r-r8r3
- High, CVSS 8.7
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Packagist openmage/magento-lts · Upgrade to 20.17.0 or later · <= 20.16.0 · CVE-2026-40488 · GHSA-3j5q-7q7h-2hhv
- High, CVSS 7.7
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
Go github.com/tektoncd/pipeline · Upgrade to 1.11.1, 1.9.3, 1.6.2 or 2 more by release line · >= 1.0.0, < 1.0.2; >= 1.2.0, < 1.3.4; >= 1.4.0, < 1.6.2; >= 1.7.0, < 1.9.3; >= 1.10.0, < 1.11.1 · CVE-2026-40161 · GHSA-wjxp-xrpv-xpff
- High, CVSS 7.7
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
npm @anthropic-ai/claude-code · Upgrade to 2.1.64 or later · < 2.1.64 · CVE-2026-39861 · GHSA-vp62-r36r-9xqp · amended
- High, CVSS 8.8
Neko has a Self-service Privilege Escalation for Authenticated Users
Go github.com/m1k1o/neko/server · Upgrade to 3.0.11 or 0.0.0-20260406184107-c54bcf1ee211 (pre-release) by release line · >= 3.0.0, < 3.0.11; >= 0.0.0-20250322225643-212bf8a60756, < 0.0.0-20260406184107-c54bcf1ee211 · CVE-2026-39386 · GHSA-2gw9-c2r2-f5qf
- High, CVSS 7.5
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
npm signalk-server · Upgrade to 2.25.0 or later · < 2.25.0 · CVE-2026-39320 · GHSA-7gcj-phff-2884 · amended
- High, CVSS 7.3
Glances has SSRF in IP Plugin via public_api leading to credential leakage
PyPI glances · Upgrade to 4.5.4 or later · < 4.5.4 · CVE-2026-35587 · GHSA-g5pq-48mj-jvw8 · amended
- High, CVSS 8.4
OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal
npm @gitlawb/openclaude · Upgrade to 0.5.1 or later · < 0.5.1 · CVE-2026-35570 · GHSA-m6rx-7pvw-2f73 · amended
- High, CVSS 7.1
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
PyPI glances · Upgrade to 4.5.4 or later · < 4.5.4 · CVE-2026-34839 · GHSA-gfc2-9qmw-w7vh · amended
- High, CVSS 8.6
Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260316053337-1a9cd29a3082 (pre-release) or later · < 1.9.10-0.20260316053337-1a9cd29a3082 · CVE-2026-34403 · GHSA-78mf-482w-62qj
- High, CVSS 8.6
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260314152518-7b66578adb47 (pre-release) or later · < 1.9.10-0.20260314152518-7b66578adb47 · CVE-2026-33031 · GHSA-x234-x5vq-cc2v
- Critical, CVSS 9.9
Spinnaker: RCE via expression parsing due to unrestricted context handling
Maven io.spinnaker.echo:echo-pipelinetriggers · Upgrade to 2026.0.1, 2025.4.2 or 2025.3.2 by release line · >= 2026.0-0, < 2026.0.1; >= 2025.4-0, < 2025.4.2; < 2025.3.2 · CVE-2026-32613 · GHSA-69rw-45wj-g4v6
- Critical, CVSS 9.9
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Maven io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo · Upgrade to 2026.0.1 or later · < 2026.0.1 · CVE-2026-32604 · GHSA-x3j7-7pgj-h87r
- High, CVSS 8.1
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Packagist openmage/magento-lts · Upgrade to 20.17.0 or later · < 20.17.0 · CVE-2026-25524 · GHSA-fg79-cr9c-7369
- Critical, CVSS 9.1
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation
Maven org.apache.kafka:kafka-clients · Upgrade to 4.1.2 or later · >= 4.1.0, < 4.1.2 · CVE-2026-33557 · GHSA-28jg-cgg7-j4wc
- High, CVSS 7.5
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
PyPI apache-airflow-core · Upgrade to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2026-32228 · GHSA-h97w-pm3w-mwmc · amended
- High, CVSS 7.2
Apache Airflow allows code execution through crafted XCom payloads
PyPI apache-airflow-core +1 · Upgrade all 2 to 3.2.0 or later · < 3.2.0 · CVE-2026-25917 · GHSA-6ffj-2wg2-w45j · amended
- Critical, CVSS 9.3
Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling
crates.io zebra-script · Upgrade to 5.0.2 or later · < 5.0.2 · +1 more package · CVE-2026-41583 · GHSA-8m29-fpq5-89jj
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.