Low, CVSS 1.2
fixurjavainstall: Previous Fuji versions can accidentally wipe /usr/share/man/man8
crates.io fixurjavainstall · Upgrade to 0.8.1 or later · <= 0.8.0 · GHSA-fq3w-p4fg-mw73
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 953 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4601–4625 of 30,958 matching · newest first
fixurjavainstall: Previous Fuji versions can accidentally wipe
- Low, CVSS 0.6
neotoma has tenant isolation gap in relationship query endpoints
npm neotoma · Upgrade to 0.14.0 or later · >= 0.13.0, < 0.14.0 · GHSA-wrr4-782v-jhwh · amended
- Medium, CVSS 6.1
justhtml: to_markdown() code-span blank-line breakout enables XSS
PyPI justhtml · Upgrade to 1.22.0 or later · >= 0.9.0, <= 1.21.0 · CVE-2026-77088 · GHSA-jf6w-2mvx-633j · amended
- Critical, CVSS 9.1
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
npm i18next-fs-backend · Upgrade to 2.6.6 or later · < 2.6.6 · CVE-2026-48713 · GHSA-2933-q333-qg83 · amended
- Critical, CVSS 9.1
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
npm i18next-http-middleware · Upgrade to 3.9.7 or later · < 3.9.7 · CVE-2026-48714 · GHSA-f49m-vf83-692w · amended
- High, CVSS 7.5
OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing
Maven org.openidentityplatform.openam:openam-radius · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46560 · GHSA-386j-6m86-78f9 · amended
- High, CVSS 7.1
OpenAM Arbitrary OAuth Token Minting via Push Registration
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46498 · GHSA-cj8f-2fhf-826r · amended
- Medium, CVSS 4.4
@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write
npm @anthropic-ai/claude-code · Upgrade to 2.1.128 or later · >= 2.1.59, < 2.1.128 · CVE-2026-46406 · GHSA-4vp2-6q8c-pvq2 · amended
- High, CVSS 7.7
OpenAM has Unsafe Java Deserialization via SNS
Maven org.openidentityplatform.openam:openam-push-notification · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45794 · GHSA-pp89-732f-3g8q · amended
- High, CVSS 8.2
Apache Shiro shiro-guice module vulnerable to authentication bypass
Maven org.apache.shiro:shiro-guice · Upgrade to 3.0.0 or later · >= 2.0.0, < 3.0.0 · CVE-2026-56091 · GHSA-qj64-jj84-w38j · amended
- Low, CVSS 2.0
Apache Shiro's "remember me" cookie age is not verified on the server.
Maven org.apache.shiro:shiro-web +1 · Upgrade all 2 to 3.0.0 or later · >= 1.2.4, < 3.0.0 · CVE-2026-56130 · GHSA-m8g6-vrr2-x7ff · amended
- High, CVSS 7.1
Tiptap contains an input validation vulnerability resulting in DoS
Packagist ueberdosis/tiptap-php · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-47110 · GHSA-4595-7fjw-r3jh
- Critical, CVSS 9.3
Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto
PyPI feast · Upgrade to 0.63.0 or later · < 0.63.0 · CVE-2026-56121 · GHSA-q63x-9pfm-mjx4 · amended
- Medium, CVSS 4.3
OliveTin has Unvalidated
ot_-prefixed Arguments that Bypass Input FilteringGo github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260531214440-ebffd9f040f7 (pre-release) or later · < 0.0.0-20260531214440-ebffd9f040f7 · CVE-2026-53541 · GHSA-prj9-97mp-mwh2
- Low, CVSS 3.7
OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260521230847-a3865704c854 (pre-release) or later · < 0.0.0-20260521230847-a3865704c854 · CVE-2026-48709 · GHSA-f637-w7p2-m7fx
- Critical, CVSS 9.3
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
Maven org.openidentityplatform.openam:openam-federation-library · Upgrade to 16.1.1 or later · <= 16.0.6 · CVE-2026-45052 · GHSA-p462-xxwx-pqf4
- Critical, CVSS 9.2
OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
Maven org.openidentityplatform.openam:openam-auth-webauthn · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45051 · GHSA-6c99-87fr-6q7r · amended
- Medium, CVSS 4.3
Jenkins MCP Server Plugin missing a permission check
Maven io.jenkins.plugins:mcp-server · Upgrade to 0.178.vffe5a (pre-release) or later · < 0.178.vffe5a · CVE-2026-57300 · GHSA-mpff-xhg4-vr45
- Medium, CVSS 5.4
Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
Maven org.jenkins-ci.plugins:contrast-continuous-application-security · Upgrade to 3.12 or later · < 3.12 · CVE-2026-57298 · GHSA-6qc4-57v3-28rr
- High, CVSS 7.3
Payara Server Full has a Cross-Site Request Forgery vulnerability
Maven fish.payara.distributions:payara · Upgrade to 7.2026.6 or later · >= 4.0.0, < 7.2026.6 · CVE-2026-12986 · GHSA-x939-7fq5-v9v6
- Medium, CVSS 4.3
Jenkins Contrast Continuous Application Security Plugin missing permission checks
Maven org.jenkins-ci.plugins:contrast-continuous-application-security · Upgrade to 3.12 or later · < 3.12 · CVE-2026-57299 · GHSA-8263-qv4g-vfxr
- Medium, CVSS 4.3
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
Maven org.jenkins-ci.tools:git-parameter · Upgrade to 462.463 or later · < 462.463 · CVE-2026-57286 · GHSA-hwvp-7xqv-8jx3
- Medium, CVSS 4.8
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Maven io.jenkins.plugins:bitbucket-push-and-pull-request · Upgrade to 3.3.9 or later · < 3.3.9 · CVE-2026-57289 · GHSA-jwhr-h7pc-3974
- Medium, CVSS 4.3
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Maven org.jenkins-ci.plugins:jobConfigHistory · Upgrade to 1367 or later · < 1367 · CVE-2026-57287 · GHSA-8qr4-27mh-hqfr
- High, CVSS 8.8
Jenkins External Workspace Manager Plugin has a path traversal vulnerability
Maven org.jenkins-ci.plugins:external-workspace-manager · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-57296 · GHSA-hrmj-8fm9-cg8x
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.