High, CVSS 8.7
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
PyPI litellm · Upgrade to 1.83.0 or later · < 1.83.0 · CVE-2026-35029 · GHSA-53mr-6c8q-9789 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Go github.com/patrickhener/goshs · Upgrade to 1.1.5-0.20260401172448-237f3af891a9 (pre-release) or later · < 1.1.5-0.20260401172448-237f3af891a9 · CVE-2026-35471 · GHSA-6qcc-6q27-whp8
- High, CVSS 8.8
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
Packagist devcode-it/openstamanager · Upgrade to 2.10.2 or later · <= 2.10.1 · CVE-2026-35470 · GHSA-mmm5-3g4x-qw39
- High, CVSS 7.5
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
PyPI mesop · Upgrade to 1.2.5 or later · >= 1.2.3, < 1.2.5 · CVE-2026-34824 · GHSA-3jr7-6hqp-x679 · amended
- High, CVSS 8.7
Budibase: Command Injection in Bash Automation Step
npm @budibase/server · Upgrade to 3.33.4 or later · < 3.33.4 · CVE-2026-25044 · GHSA-gjw9-34gf-rp6m · amended
- High, CVSS 8.7
OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
PyPI openexr · Upgrade to 3.4.8; some affected versions have no fix yet · >= 3.4.0, <= 3.4.7; >= 3.3.0, <= 3.3.8; >= 3.2.0, <= 3.2.6 · CVE-2026-34543 · GHSA-vc68-257w-m432 · amended
- High, CVSS 8.4
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
PyPI openexr · Upgrade to 3.4.8; some affected versions have no fix yet · >= 3.4.0, <= 3.4.7; >= 3.3.0, <= 3.3.8; >= 3.2.0, <= 3.2.6 · CVE-2026-34544 · GHSA-h762-rhv3-h25v · amended
- Critical, CVSS 10.0
SandboxJS: Sandbox integrity escape
npm @nyariv/sandboxjs · Upgrade to 0.8.36 or later · < 0.8.36 · CVE-2026-34208 · GHSA-2gg9-6p7w-6cpj · amended
- Critical, CVSS 9.4
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
npm signalk-server · Upgrade to 2.24.0-beta.4 (pre-release) or later · < 2.24.0-beta.4 · CVE-2026-33950 · GHSA-x8hc-fqv3-7gwf · amended
- High, CVSS 8.6
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
PyPI curl-cffi · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2026-33752 · GHSA-qw2m-4pqf-rmpp · amended
- High, CVSS 8.8
Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims
PyPI oauthenticator · Upgrade to 17.4.0 or later · < 17.4.0 · CVE-2026-33175 · GHSA-rrvg-cxh4-qhrv · amended
- Critical, CVSS 9.6
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
npm @budibase/backend-core · Upgrade to 3.33.4 or later · < 3.33.4 · CVE-2026-31818 · GHSA-7r9j-r86q-7g45 · amended
- High, CVSS 7.1
Juju has a resource poisoning vulnerability
Go github.com/juju/juju · Upgrade to 0.0.0-20260120044552-26ff93c903d5 (pre-release) or later · < 0.0.0-20260120044552-26ff93c903d5 · CVE-2025-68153 · GHSA-245v-p8fj-vwm2
- Critical, CVSS 9.8
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
Go github.com/patrickhener/goshs · Upgrade to 1.1.5-0.20260401172448-237f3af891a9 (pre-release) or later · < 1.1.5-0.20260401172448-237f3af891a9 · CVE-2026-35393 · GHSA-jg56-wf8x-qrv5
- Critical, CVSS 9.8
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
Go github.com/patrickhener/goshs · Upgrade to 1.1.5-0.20260401172448-237f3af891a9 (pre-release) or later · < 1.1.5-0.20260401172448-237f3af891a9 · CVE-2026-35392 · GHSA-g8mv-vp7j-qp64
- Critical, CVSS 9.1
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
npm fast-jwt · Upgrade to 6.2.0 or later · >= 0.0.1, < 6.2.0 · CVE-2026-35039 · GHSA-rp9m-7r4c-75qg · amended
- Critical, CVSS 9.4
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 31.0.0.0 or later · <= 0.28.6.0 · CVE-2026-34989 · GHSA-vr2g-rhm5-q4jr
- High, CVSS 7.2
Ajenti has an authorization bypass during custom package installation
PyPI ajenti-panel · Upgrade to 2.2.15 or later · < 2.2.15 · CVE-2026-35175 · GHSA-73jv-44c3-j5p2 · amended
- Critical, CVSS 9.8
Kedro has Arbitrary Code Execution via Malicious Logging Configuration
PyPI kedro · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-35171 · GHSA-9cqf-439c-j96r · amended
- High, CVSS 8.8
OpenSTAManager: SQL Injection via Aggiornamenti Module
Packagist devcode-it/openstamanager · Upgrade to 2.10.2 or later · <= 2.10.1 · CVE-2026-35168 · GHSA-2fr7-cc4f-wh98
- High, CVSS 7.1
Kedro: Path Traversal in versioned dataset loading via unsanitized version string
PyPI kedro · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-35167 · GHSA-6326-w46w-ppjw · amended
- High, CVSS 8.2
Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption
Packagist auth0/symfony · Upgrade to 5.8.0 or later · >= 5.0.0, <= 5.7.0 · GHSA-ghc5-95c2-vwcv
- High, CVSS 8.2
Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption
Packagist auth0/wordpress · Upgrade to 5.6.0 or later · >= 5.0.0-BETA0, <= 5.5.0 · GHSA-vfpx-q664-h93m
- High, CVSS 8.2
Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption
Packagist auth0/login · Upgrade to 7.21.0 or later · >= 7.0.0, <= 7.20.0 · GHSA-fmg6-246m-9g2v
- High, CVSS 7.2
Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
Go github.com/lin-snow/ech0 · Upgrade to 1.4.8-0.20260401031029-4ca56fea5ba4 (pre-release) or later · < 1.4.8-0.20260401031029-4ca56fea5ba4 · CVE-2026-35037 · GHSA-cqgf-f4x7-g6wc
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.