Medium, CVSS 4.3
plone.app.textfield: Stored XSS by spoofing mime type
PyPI plone-app-textfield · Upgrade to 4.0.1, 3.0.2 or 2.0.2 by release line · < 2.0.2; >= 3.0.0, < 3.0.2; >= 4.0.0, <= 4.0.0 · CVE-2026-54503 · GHSA-4r4f-gg25-rmg5 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 946 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3751–3775 of 30,922 matching · newest first
- Medium, CVSS 4.3
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Go github.com/zalando/skipper · Upgrade to 0.26.22 or later · < 0.26.22 · CVE-2026-54247 · GHSA-cwxq-rc9x-2jvv
- Medium, CVSS 6.5
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.22.0, < 0.24.0 · CVE-2026-55646 · GHSA-v82g-2437-67m2 · amended
- High, CVSS 8.7
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
PyPI vllm · Upgrade to 0.24.0 or later · < 0.24.0 · CVE-2026-55574 · GHSA-rwxx-mrjm-wc2m · amended
- High, CVSS 7.5
vLLM has Remote DoS via Invalid Recovered Token Reinjection
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.17.1, < 0.24.0 · CVE-2026-54234 · GHSA-8wr5-jm2h-8r4f · amended
- Medium, CVSS 5.9
vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models
PyPI vllm · Upgrade to 0.18.0 or later · >= 0.5.5, < 0.18.0 · CVE-2026-34760 · GHSA-6c4r-fmh3-7rh8 · amended
- High, CVSS 7.1
Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema
npm @genql/cli · Upgrade to 6.3.4 or later · < 6.3.4 · CVE-2026-63397 · GHSA-w757-xvvv-vgfw · amended
- High, CVSS 7.1
ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization
Maven com.arcadedb:arcadedb-server · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-x8mg-6r4p-87pf
- High, CVSS 8.7
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-vwjc-v7x7-cm6g
- High, CVSS 8.6
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.7.2 or later · < 26.7.2 · GHSA-x9f9-r4m8-9xc2
- High, CVSS 7.6
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
PyPI mcp · Upgrade to 1.28.1 or later · < 1.28.1 · CVE-2026-59950 · GHSA-vj7q-gjh5-988w · amended
- High, CVSS 7.7
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
Maven com.arcadedb:arcadedb-server · Upgrade to 26.7.1 or later · < 26.7.1 · GHSA-48qw-824m-86pr
- Critical, CVSS 9.8
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Packagist pheditor/pheditor · Upgrade to 2.0.6 or later · >= 2.0.1, < 2.0.6 · CVE-2026-55579 · GHSA-p4h7-p9rj-2pq2
- High, CVSS 8.8
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Packagist pheditor/pheditor · Upgrade to 2.0.6 or later · >= 2.0.1, < 2.0.6 · CVE-2026-55578 · GHSA-wg4w-wr5q-6vjc
- High, CVSS 8.1
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.6.1 or later · < 26.6.1 · CVE-2026-54076 · GHSA-vg6x-6pg9-6qwg
- High, CVSS 7.1
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
Maven com.arcadedb:arcadedb-engine · Upgrade to 26.6.1 or later · < 26.6.1 · CVE-2026-54077 · GHSA-8w86-m9h8-hvqg
- Low, CVSS 3.7
nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof
crates.io nimiq-primitives · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-54542 · GHSA-5rg2-xv9j-gv5p
- Low, CVSS 3.7
nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys
crates.io nimiq-primitives · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-54541 · GHSA-46wq-28cx-mhw4
- High, CVSS 8.8
Pheditor has an authenticated terminal command whitelist bypass
Packagist pheditor/pheditor · Upgrade to 2.0.5 or later · <= 2.0.4 · CVE-2026-54540 · GHSA-9643-6xjp-vx57
- High, CVSS 7.1
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
PyPI mcp · Upgrade to 1.27.2 or later · <= 1.27.1 · CVE-2026-52869 · GHSA-jpw9-pfvf-9f58 · amended
- High, CVSS 7.6
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
PyPI mcp · Upgrade to 1.27.2 or later · >= 1.23.0, <= 1.27.1 · CVE-2026-52870 · GHSA-hvrp-rf83-w775 · amended
- Medium, CVSS 4.9
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
Go github.com/nuclio/nuclio · Upgrade to 1.16.5 or later · < 1.16.5 · CVE-2026-52832 · GHSA-wpcj-rmv4-86qg
- High, CVSS 8.0
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
Go github.com/nuclio/nuclio · Upgrade to 1.16.5 or later · < 1.16.5 · CVE-2026-52833 · GHSA-3v79-m2cg-89ww
- High, CVSS 7.4
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode
Go github.com/envoyproxy/gateway · Upgrade to 1.8.1 or 1.7.4 by release line · >= 1.8.0-rc.0, < 1.8.1; < 1.7.4 · CVE-2026-53714 · GHSA-22xc-xg2r-9j7v
- Medium, CVSS 6.9
Diesel has possible use after free when deserializing a SQLite database via
SqliteConnection::deserialize_readonly_databasecrates.io diesel · Upgrade to 2.3.10 or later · < 2.3.10 · GHSA-ggxf-9f6j-w742
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.