Critical, CVSS 9.1
Chainlit contains a session hijacking vulnerability
PyPI chainlit · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2026-56104 · GHSA-c39v-8hrw-h448 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 962 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4751–4775 of 30,967 matching · newest first
- Medium, CVSS 6.1
Keras: DiskIOStore permits path traversal through crafted layer names
PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-12479 · GHSA-gh82-f9x8-5frx · amended
- Medium, CVSS 5.3
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
Packagist wwbn/avideo · Upgrade to 29.0 or later · < 29.0 · CVE-2026-33684 · GHSA-8j8m-p79x-g4jm
- Critical, CVSS 9.6
Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
crates.io mise · Upgrade to 2026.3.10 or later · < 2026.3.10 · CVE-2026-33646 · GHSA-fjj5-v948-whjj
- Medium, CVSS 5.5
motionEye's World-Readable Configuration File Exposes Admin Password Hash
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-32315 · GHSA-rhgp-6wq6-9j67 · amended
- Medium, CVSS 6.5
motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-31978 · GHSA-g9fx-5r4h-pcw3 · amended
- High, CVSS 7.7
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-25119 · GHSA-w6j9-vw59-27wv
- High, CVSS 7.7
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
PyPI pycti · Upgrade to 6.8.16 or later · < 6.8.16 · CVE-2026-21887 · GHSA-ffm6-vvph-g5f5 · amended
- Medium, CVSS 4.9
Gogs has a Denial of Service in repository/wiki file listing web pages
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2025-64719 · GHSA-3qq3-668m-v9mj
- Critical, CVSS 9.9
Paymenter vulnerable to Remote Code Execution via public file uploads
Packagist paymenter/paymenter · Upgrade to 1.2.11 or later · < 1.2.11 · CVE-2025-58048 · GHSA-5pm9-r2m8-rcmj
- Medium, CVSS 6.5
OpenCTI May Bypass Introspection Restriction
PyPI pycti · Upgrade to 6.1.9 or later · < 6.1.9 · CVE-2024-37155 · GHSA-4mvw-j8r9-xcgc · amended
- High, CVSS 8.1
Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path
PyPI doris-mcp-server · Upgrade to 0.6.1 or later · < 0.6.1 · CVE-2025-66336 · GHSA-pqrj-4gwg-h5f7 · amended
- Medium, CVSS 5.2
Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Maven org.apache.nifi:nifi-cdc-mysql-processors · Upgrade to 2.10.0 or later · >= 1.2.0, < 2.10.0 · CVE-2026-44913 · GHSA-chxj-gxww-q98w
- High, CVSS 7.5
Apache NiFi: Missing authorization when replacing Process Groups with restricted components
Maven org.apache.nifi:nifi-web-api · Upgrade to 2.9.0 or later · >= 1.12.0, < 2.9.0 · CVE-2026-44914 · GHSA-r2g5-993q-664g
- Low, CVSS 2.3
Apache NiFi allows read-only users to submit component configuration verification request
Maven org.apache.nifi:nifi-web-api · Upgrade to 2.10.0 or later · >= 1.15.0, < 2.10.0 · CVE-2026-44911 · GHSA-qvj8-gwpm-4x49
- Medium, CVSS 5.4
Apache Atlas UI: Authenticated User XSS
Maven org.apache.atlas:atlas-dashboardv2 · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2025-62198 · GHSA-v73p-f52r-fmmr
- Medium, CVSS 6.3
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Maven org.apache.nifi:nifi-jetty · Upgrade to 2.10.0 or later · < 2.10.0 · CVE-2026-54665 · GHSA-8vm2-c32j-mvfr
- Critical, CVSS 9.3
Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server
PyPI crawl4ai · Upgrade to 0.8.7 or later · < 0.8.7 · CVE-2026-56265 · GHSA-8qrg-7j2f-rf2h · amended
- Medium, CVSS 5.5
LiteLLM: MCP Proxy Has Improper Authentication
PyPI litellm · Upgrade to 1.84.0 or later · < 1.84.0 · CVE-2026-12773 · GHSA-4jcj-7x88-m979 · amended
- Critical, CVSS 9.9
Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
PyPI prefect · Upgrade to 3.6.25 or later · >= 3.1.11, < 3.6.25 · CVE-2026-5366 · GHSA-7pm4-56h2-5rxr · amended
- High, CVSS 8.7
Anki's local HTTP server does not sufficiently validate requests
PyPI aqt · Upgrade to 25.9.3 or later · <= 25.9.2 · CVE-2026-59153 · GHSA-869j-r97x-hx2g · amended
- Medium, CVSS 6.5
SurrealDB: Denial of Service via deep operator chains
crates.io surrealdb · Upgrade to 3.1.5 or later · >= 3.0.0, < 3.1.5 · CVE-2026-63737 · GHSA-jv2j-mqmw-xvv5 · amended
- Medium, CVSS 4.3
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
crates.io surrealdb · Upgrade to 3.1.5 or later · >= 3.1.0, < 3.1.5 · CVE-2026-63738 · GHSA-hv6h-hc26-q48p
- Medium, CVSS 4.3
SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
crates.io surrealdb · Upgrade to 3.1.5 or later · >= 3.0.0, < 3.1.5 · CVE-2026-63309 · GHSA-h4h3-3rfj-x6fq · amended
- High, CVSS 7.7
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
crates.io surrealdb · Upgrade to 3.1.5 or later · < 3.1.5 · CVE-2026-63739 · GHSA-cc8f-fcx3-gpjr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.