High, CVSS 8.2
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using Kysely .
npm kysely · Upgrade to 0.28.12 or later · >= 0.26.0, <= 0.28.11 · CVE-2026-32763 · GHSA-wmrf-hv6w-mr66 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using
- High, CVSS 7.1
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
PyPI langflow · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-33053 · GHSA-rf6x-r45m-xv3w · amended
- High, CVSS 8.8
SQL Injection in Spring AI MariaDBFilterExpressionConverter
Maven org.springframework.ai:spring-ai-mariadb-store · Upgrade to 1.1.3 or 1.0.4 by release line · >= 1.1.0-M1, < 1.1.3; < 1.0.4 · CVE-2026-22730 · GHSA-c267-rfvc-mvpm
- High, CVSS 8.6
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
Maven org.springframework.ai:spring-ai-vector-store · Upgrade to 1.1.3 or 1.0.4 by release line · >= 1.1.0-M1, < 1.1.3; < 1.0.4 · CVE-2026-22729 · GHSA-rp9g-qx29-88cp
- High, CVSS 8.1
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Maven org.keycloak:keycloak-server-spi-private +1 · Upgrade all 2 to 26.5.5 or later · < 26.5.5 · CVE-2026-2603 · GHSA-x4p7-7chp-64hq
- High, CVSS 8.7
Ray Dashboard is vulnerable to path traversal through its static file handling mechanism
PyPI ray · Upgrade to 2.8.1 or later · < 2.8.1 · CVE-2026-32981 · GHSA-j3mh-qmjj-xp83 · amended
- Critical, CVSS 9.3Exploited · CISA KEV
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
PyPI langflow · Upgrade to 1.9.0 or later · <= 1.8.2 · CVE-2026-33017 · GHSA-vwmf-pq79-vjvx · amended
- High, CVSS 7.5
music-metadata has an infinite loop vulnerability in ASF parser
npm music-metadata · Upgrade to 11.12.3 or later · <= 11.12.1 · CVE-2026-32256 · GHSA-v6c2-xwv6-8xf7 · amended
- High, CVSS 7.5
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
npm fast-xml-parser · Upgrade to 5.5.6 or 4.5.5 by release line · >= 5.0.0, < 5.5.6; >= 4.0.0-beta.3, < 4.5.5 · CVE-2026-33036 · GHSA-8gc5-j5rx-235r · amended
- High, CVSS 7.5
Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Maven io.micronaut:micronaut-http-server · Upgrade to 4.10.17 or later · >= 4.7.0, < 4.10.17 · CVE-2026-33012 · GHSA-2hcp-gjrf-7fhc
- High, CVSS 8.7
Nest Fastify HEAD Request Middleware Bypass
npm @nestjs/platform-fastify · Upgrade to 11.1.16 or later · <= 11.1.15 · CVE-2026-33011 · GHSA-wf42-42fg-fg84 · amended
- High, CVSS 8.2
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
npm parse-server · Upgrade to 9.6.0-alpha.24 (pre-release) or 8.6.47 by release line · >= 9.0.0, < 9.6.0-alpha.24; < 8.6.47 · CVE-2026-32886 · GHSA-4263-jgmp-7pf4 · amended
- High, CVSS 8.7
Parse Server crash via deeply nested query condition operators
npm parse-server · Upgrade to 9.6.0-alpha.21 (pre-release) or 8.6.45 by release line · >= 9.0.0, < 9.6.0-alpha.21; < 8.6.45 · CVE-2026-32944 · GHSA-9xp9-j92r-p88v · amended
- High, CVSS 7.1
Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS
Go github.com/cloudnativelabs/kube-router/v2 · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-32254 · GHSA-phqm-jgc3-qf8g
- Critical, CVSS 9.6
jsPDF has HTML Injection in New Window paths
npm jspdf · Upgrade to 4.2.1 or later · <= 4.2.0 · CVE-2026-31938 · GHSA-wfv2-pwc8-crg5 · amended
- High, CVSS 8.1
jsPDF has a PDF Object Injection via FreeText color
npm jspdf · Upgrade to 4.2.1 or later · <= 4.2.0 · CVE-2026-31898 · GHSA-7x6v-j9x4-qf24 · amended
- High, CVSS 7.7
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
Packagist cockpit-hq/cockpit · Upgrade to 2.13.5 or later · < 2.13.5 · CVE-2026-31891 · GHSA-7x5c-vfhj-9628
- High, CVSS 8.2
Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Maven io.micronaut:micronaut-json-core · Upgrade to 4.10.16, 3.10.5 or 3.8.13 by release line · >= 4.0.0-M1, < 4.10.16; >= 3.9.0, < 3.10.5; < 3.8.13 · CVE-2026-33013 · GHSA-43w5-mmxv-cpvh
- High, CVSS 7.5
Denial of Service in pyasn1 via Unbounded Recursion
PyPI pyasn1 · Upgrade to 0.6.3 or later · <= 0.6.2 · CVE-2026-30922 · GHSA-jr27-m4p2-rc6r · amended
- High, CVSS 8.1
PYSEC-2026-117
PyPI pycti · Upgrade to 6.9.1 or later · < 6.9.1 · CVE-2026-21886 · GHSA-mhmx-j75v-2m6x
- High, CVSS 7.1
Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
PyPI justhtml · Upgrade to 1.10.0 or later · <= 1.9.1 · CVE-2026-9769 · GHSA-v7cf-c9rm-wm3j · amended
- High, CVSS 7.5
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
PyPI apache-airflow · Upgrade to 3.1.8 or later · >= 3.0.0, < 3.1.8 · CVE-2026-28779 · GHSA-4fhm-p86v-hwpx · amended
- High, CVSS 8.1
Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
PyPI apache-airflow · Upgrade to 3.1.8 or later · >= 3.1.0, < 3.1.8 · CVE-2026-30911 · GHSA-8x34-9q3v-h7g8 · amended
- High, CVSS 7.5
Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
PyPI apache-airflow · Upgrade to 3.1.8 or later · >= 3.0.0, < 3.1.8 · CVE-2026-26929 · GHSA-4m3h-wp5w-5hqh · amended
- High, CVSS 7.7
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
Packagist ralffreit/mfa-email · Upgrade to 2.0.1 or 1.0.7 by release line · < 1.0.7; >= 2.0.0, <= 2.0.0 · CVE-2026-4208 · GHSA-29r8-gvx4-r9w3
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.