High, CVSS 8.7
libcrux: Panic in Signature Hint Decoding During Verification
crates.io libcrux-ml-dsa · Upgrade to 0.0.8 or later · < 0.0.8 · GHSA-xrf2-5r3p-5wgj
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution
Maven com.splunk:splunk-otel-javaagent · Upgrade to 2.26.1 or later · < 2.26.1 · GHSA-h8w2-rv57-vc6f
- Critical, CVSS 9.1
Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · <= 2.2.0 · GHSA-2pv8-4c52-mf8j
- Critical, CVSS 9.3
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
Maven com.datadoghq:dd-java-agent · Upgrade to 1.60.3 or later · >= 0.40.0, < 1.60.3 · CVE-2026-33728 · GHSA-579q-h82j-r5v2
- High, CVSS 8.7
n8n has SQL Injection in Data Table Node via orderByColumn Expression
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.26 by release line · < 1.123.26; >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3 · CVE-2026-33713 · GHSA-98c2-4cr3-4jc3 · amended
- Critical, CVSS 9.4
n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.27 by release line · >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3; < 1.123.27 · CVE-2026-33696 · GHSA-mxrg-77hm-89hv · amended
- High, CVSS 7.8
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
PyPI bentoml · Upgrade to 1.4.37 or later · <= 1.4.36 · CVE-2026-33744 · GHSA-jfjg-vc52-wqvf · amended
- High, CVSS 7.3
n8n Has External Secrets Authorization Bypass in Credential Saving
npm n8n · Upgrade to 2.6.4 or 1.123.23 by release line · < 1.123.23; >= 2.0.0-rc.0, < 2.6.4 · CVE-2026-33722 · GHSA-fxcw-h3qj-8m8p · amended
- High, CVSS 7.6
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
PyPI openhands-ai · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-33718 · GHSA-7h8w-hj9j-8rjw · amended
- High, CVSS 8.7
pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names
Maven org.pf4j:pf4j · Upgrade to 3.14.1 or later · < 3.14.1 · CVE-2025-70952 · GHSA-5458-7hh9-v7p4
- High, CVSS 7.1
Signify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components
PyPI signify · Upgrade to 0.9.2 or later · < 0.9.2 · CVE-2025-70887 · GHSA-p4hh-mq57-gq8x · amended
- Critical, CVSS 9.3
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
Maven io.opentelemetry.javaagent:opentelemetry-javaagent · Upgrade to 2.26.1 or later · < 2.26.1 · CVE-2026-33701 · GHSA-xw7x-h9fj-p2c7
- High, CVSS 7.5
Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
Go code.vikunja.io/api · Upgrade to 2.2.2 or later · < 2.2.2 · CVE-2026-33680 · GHSA-8hp8-9fhr-pfm9
- High, CVSS 8.1
Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · <= 2.2.0 · CVE-2026-33678 · GHSA-jfmm-mjcp-8wq2
- High, CVSS 7.5
Picomatch has a ReDoS vulnerability via extglob quantifiers
npm picomatch · Upgrade to 4.0.4, 3.0.2 or 2.3.2 by release line · >= 4.0.0, < 4.0.4; >= 3.0.0, < 3.0.2; < 2.3.2 · CVE-2026-33671 · GHSA-c2c7-rcm5-vvqj · amended
- High, CVSS 7.1
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · >= 0.18.0, <= 2.2.0 · CVE-2026-33668 · GHSA-94xm-jj8x-3cr4
- High, CVSS 8.8
n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover
npm n8n · Upgrade to 2.4.0 or 1.121.0 by release line · >= 2.0.0-rc.0, < 2.4.0; < 1.121.0 · CVE-2026-33665 · GHSA-c545-x2rh-82fc · amended
- High, CVSS 8.5
n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.27 by release line · < 1.123.27; >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3 · CVE-2026-33663 · GHSA-m63j-689w-3j35 · amended
- Critical, CVSS 9.4
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.27 by release line · >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3; < 1.123.27 · CVE-2026-33660 · GHSA-58qr-rcgv-642v · amended
- High, CVSS 7.1
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
Packagist google/protobuf · Upgrade to 4.33.6 or later · < 4.33.6 · CVE-2026-6409 · GHSA-p2gh-cfq4-4wjc
- High, CVSS 8.6
MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · >= 2.28.0, <= 2.28.0 · CVE-2026-33548 · GHSA-73vx-49mv-v8w5
- High, CVSS 8.8
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
Packagist code16/sharp · Upgrade to 9.20.0 or later · < 9.20.0 · CVE-2026-33686 · GHSA-9ffq-6457-8958
- High, CVSS 8.8
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
Packagist code16/sharp · Upgrade to 9.20.0 or later · < 9.20.0 · CVE-2026-33687 · GHSA-fr76-5637-w3g9
- High, CVSS 8.6
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
Packagist mantisbt/mantisbt · Upgrade to 2.28.1 or later · >= 2.28.0, <= 2.28.0 · CVE-2026-33517 · GHSA-fh48-f69w-7vmp
- High, CVSS 7.6
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
Packagist prestashop/prestashop · Upgrade to 9.1.0 or 8.2.5 by release line · >= 9.0.0-alpha.1, < 9.1.0; < 8.2.5 · CVE-2026-33673 · GHSA-35pf-37c6-jxjv
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.