Critical, CVSS 9.8
pgx contains memory-safety vulnerability
Go github.com/jackc/pgx/v5 · Upgrade to 5.9.0 or later · < 5.9.0 · CVE-2026-33815 · GHSA-xgrm-4fwx-7qm8
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.30.0 or later · <= 8.29.1 · GHSA-qmwh-9m9c-h36m
- High, CVSS 8.7
Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.30.0 or later · <= 8.29.1 · CVE-2026-35458 · GHSA-fmwg-qcqh-m992
- High, CVSS 7.1
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-41359 · GHSA-767m-xrhc-fxm7 · amended
- High, CVSS 8.7
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
npm openclaw · Upgrade to 2026.3.24 or later · <= 2026.3.23-2 · CVE-2026-41384 · GHSA-vfw7-6rhc-6xxg · amended
- High, CVSS 7.5
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
npm @fedify/fedify · Upgrade to 2.1.1, 2.0.8, 1.10.5 or 1.9.6 by release line · < 1.9.6; >= 1.10.0, < 1.10.5; >= 2.0.0, < 2.0.8; >= 2.1.0, <= 2.1.0 · +1 more package · CVE-2026-34148 · GHSA-gm9m-gwc4-hwgp · amended
- Critical, CVSS 9.3
OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via
jato.clientSessionDeserialization in OpenAMMaven org.openidentityplatform.openam:openam · Upgrade to 16.0.6 or later · <= 16.0.5 · CVE-2026-33439 · GHSA-2cqq-rpvq-g5qj
- High, CVSS 8.2
Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation
Go open-cluster-management.io/ocm · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-4740 · GHSA-q4gv-pjmh-c735
- High, CVSS 7.5
Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
PyPI django · Upgrade to 6.0.4, 5.2.13 or 4.2.30 by release line · >= 6.0, < 6.0.4; >= 5.2, < 5.2.13; >= 4.2, < 4.2.30 · CVE-2026-3902 · GHSA-mvfq-ggxm-9mc5 · amended
- High, CVSS 7.5
Django: SGI requests with a missing or understated
Content-Lengthheader could bypass theDATA_UPLOAD_MAX_MEMORY_SIZElimitPyPI django · Upgrade to 6.0.4, 5.2.13 or 4.2.30 by release line · >= 6.0, < 6.0.4; >= 5.2, < 5.2.13; >= 4.2, < 4.2.30 · CVE-2026-33034 · GHSA-933h-hp56-hf7m · amended
- High, CVSS 8.7
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Maven org.apache.kafka:kafka-clients · Upgrade to 4.1.2, 4.0.2 or 3.9.2 by release line · >= 2.8.0, < 3.9.2; >= 4.0.0, < 4.0.2; >= 4.1.0, < 4.1.2 · CVE-2026-35554 · GHSA-5qcv-4rpc-jp93
- High, CVSS 8.8Exploited · CISA KEV
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Maven org.apache.activemq:activemq-broker +1 · Upgrade all 2 to 6.2.3 or 5.19.5 by release line · < 5.19.5; >= 6.0.0, < 6.2.3 · CVE-2026-34197 · GHSA-rxpj-7qvf-xv32
- Critical, CVSS 9.8
LoLLMs is vulnerable to Improper Access Control through weak secret key
PyPI lollms · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-1114 · GHSA-9296-v3fr-j92j · amended
- Critical, CVSS 9.2
PraisonAI Has Path Traversal in FileTools
PyPI praisonai · Upgrade to 1.5.113 or later · <= 1.5.112 · CVE-2026-35615 · GHSA-693f-pf34-72c5 · amended
- High, CVSS 7.1
PraisonAI recipe registry publish path traversal allows out-of-root file write
PyPI praisonai · Upgrade to 4.5.113 or later · <= 4.5.112 · CVE-2026-39308 · GHSA-r9x3-wx45-2v7f · amended
- High, CVSS 7.3
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
PyPI praisonai · Upgrade to 4.5.113 or later · <= 4.5.112 · CVE-2026-39306 · GHSA-4rx4-4r3x-6534 · amended
- Critical, CVSS 9.0
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
PyPI praisonai · Upgrade to 4.5.113 or later · <= 4.5.112 · CVE-2026-39305 · GHSA-jfxc-v5g9-38xr · amended
- High, CVSS 8.1
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
PyPI praisonai · Upgrade to 4.5.113 or later · <= 4.5.112 · CVE-2026-39307 · GHSA-4ph2-f6pf-79wv · amended
- High, CVSS 7.1
PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling
Packagist pocketmine/pocketmine-mp · Upgrade to 5.39.2 or later · < 5.39.2 · GHSA-788v-5pfp-93ff
- High, CVSS 7.5
PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket
Packagist pocketmine/pocketmine-mp · Upgrade to 5.41.1 or later · < 5.41.1 · GHSA-h6rj-3m53-887h
- High, CVSS 8.2
Vite:
server.fs.denybypassed with queriesnpm vite · Upgrade to 8.0.5 or 7.3.2 by release line · >= 8.0.0, <= 8.0.4; >= 7.1.0, <= 7.3.1 · CVE-2026-39364 · GHSA-v2wj-q39q-566r · amended
- High, CVSS 8.2
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
npm vite · Upgrade to 8.0.5, 7.3.2 or 6.4.2 by release line · >= 8.0.0, <= 8.0.4; >= 7.0.0, <= 7.3.1; >= 6.0.0, <= 6.4.1 · CVE-2026-39363 · GHSA-p9ff-h696-f583 · amended
- High, CVSS 7.5
strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions
PyPI strawberry-graphql · Upgrade to 0.312.3 or later · <= 0.312.2 · CVE-2026-35526 · GHSA-hv3w-m4g2-5x77 · amended
- High, CVSS 7.5
strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol
PyPI strawberry-graphql · Upgrade to 0.312.3 or later · <= 0.312.2 · CVE-2026-35523 · GHSA-vpwc-v33q-mq89 · amended
- Critical, CVSS 9.8
changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering
PyPI changedetection-io · Upgrade to 0.54.8 or later · <= 0.54.7 · CVE-2026-35490 · GHSA-jmrh-xmgh-x9j4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.