High, CVSS 8.4
Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table
PyPI apache-airflow · Upgrade to 2.11.1 or later · < 2.11.1 · CVE-2024-56373 · GHSA-r837-hpv7-pc2f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.0
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Packagist craftcms/cms · Upgrade to 5.8.23 or 4.16.19 by release line · >= 5.0.0-RC1, <= 5.8.22; >= 3.5.0, <= 4.16.18 · CVE-2026-27127 · GHSA-gp2f-7wcm-5fhx
- High, CVSS 8.8
yt-dlp: Arbitrary Command Injection when using the
--netrc-cmdoptionPyPI yt-dlp · Upgrade to 2026.2.21 or later · >= 2023.6.21, < 2026.2.21 · CVE-2026-26331 · GHSA-g3gw-q23r-pgqm · amended
- Critical, CVSS 9.8
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
PyPI ormar · Upgrade to 0.23.0 or later · >= 0.9.9, <= 0.22.0 · CVE-2026-26198 · GHSA-xxh2-68g9-8jqr · amended
- High, CVSS 7.6
New API has Potential XSS in its MarkdownRenderer component
Go github.com/QuantumNous/new-api · Upgrade to 0.10.8-alpha.9 (pre-release) or later · < 0.10.8-alpha.9 · CVE-2026-25802 · GHSA-299v-8pq9-5gjq
- High, CVSS 7.1
New API has an SQL LIKE Wildcard Injection DoS via Token Search
Go github.com/QuantumNous/new-api · Upgrade to 0.10.8-alpha.10 (pre-release) or later · < 0.10.8-alpha.10 · CVE-2026-25591 · GHSA-w6x6-9fp7-fqm4
- Critical, CVSS 9.1
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
Maven org.apache.camel:camel-keycloak · Upgrade to 4.18.0 or later · >= 4.15.0, < 4.18.0 · CVE-2026-23552 · GHSA-c3f3-cc42-xr9v
- High, CVSS 7.1
Apache Camel Deserializes Untrusted Data in its LevelDB Component
Maven org.apache.camel:camel-leveldb · Upgrade to 4.18.0, 4.14.5 or 4.10.9 by release line · >= 3.0.0, < 4.10.9; >= 4.11.0, < 4.14.5; >= 4.15.0, < 4.18.0 · CVE-2026-25747 · GHSA-429q-mrc4-38fr
- High, CVSS 7.2
Moodle has a Remote Code Execution risk via file restore
Packagist moodle/moodle · Upgrade to 5.1.2, 5.0.5 or 4.5.9 by release line · >= 5.1.0-beta, < 5.1.2; >= 5.0.0-beta, < 5.0.5; < 4.5.9 · CVE-2026-26045 · GHSA-ggxq-2mg9-8966
- High, CVSS 8.1
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
PyPI mlflow · Upgrade to 3.8.0rc0 (pre-release) or later · < 3.8.0rc0 · CVE-2026-2033 · GHSA-q2r8-vmq7-fpx2 · amended
- Critical, CVSS 9.8
MLflow Use of Default Password Authentication Bypass Vulnerability
PyPI mlflow · Upgrade to 3.8.0rc0 (pre-release) or later · < 3.8.0rc0 · CVE-2026-2635 · GHSA-gq3w-7jj3-x7gr · amended
- High, CVSS 8.6
Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
PyPI google-cloud-aiplatform · Upgrade to 1.131.0 or later · >= 1.98.0, < 1.131.0 · CVE-2026-2472 · GHSA-qv8j-hgpc-vrq8 · amended
- High, CVSS 7.7
Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming
PyPI google-cloud-aiplatform · Upgrade to 1.133.0 or later · >= 1.21.0, < 1.133.0 · CVE-2026-2473 · GHSA-wh2j-26j7-9728 · amended
- Critical, CVSS 9.3
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
npm fast-xml-parser · Upgrade to 5.3.5 or 4.5.4 by release line · >= 5.0.0, < 5.3.5; >= 4.1.3, < 4.5.4 · CVE-2026-25896 · GHSA-m7jm-9gc2-mpf2 · amended
- High, CVSS 8.1
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
Packagist zumba/json-serializer · Upgrade to 3.2.3 or later · < 3.2.3 · CVE-2026-27206 · GHSA-v7m3-fpcr-h7m2
- High, CVSS 8.7
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace
npm openclaw · Upgrade to 2026.2.14 or later · < 2026.2.14 · CVE-2026-32060 · GHSA-r5fq-947m-xm57 · amended
- High, CVSS 8.2
Feathers exposes internal headers via unencrypted session cookie
npm @feathersjs/authentication-oauth · Upgrade to 5.0.40 or later · <= 5.0.39 · CVE-2026-27193 · GHSA-9m9c-vpv5-9g85 · amended
- High, CVSS 7.6
Feathers has an origin validation bypass via prefix matching
npm @feathersjs/authentication-oauth · Upgrade to 5.0.40 or later · <= 5.0.39 · CVE-2026-27192 · GHSA-mp4x-c34x-wv3x · amended
- High, CVSS 7.4
Feathers has an open redirect in OAuth callback enables account takeover
npm @feathersjs/authentication-oauth · Upgrade to 5.0.40 or later · <= 5.0.39 · CVE-2026-27191 · GHSA-ppf9-4ffw-hh4p · amended
- High, CVSS 8.1
Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
crates.io deno · Upgrade to 2.6.8 or later · < 2.6.8 · CVE-2026-27190 · GHSA-hmh4-3xvx-q5hr
- High, CVSS 8.8
Formwork Improperly Managed Privileges in User creation
Packagist getformwork/formwork · Upgrade to 2.3.4 or later · >= 2.0.0, <= 2.3.3 · CVE-2026-27198 · GHSA-34p4-7w83-35g2
- High, CVSS 8.1
Statamic affected by privilege escalation via stored cross-site scripting
Packagist statamic/cms · Upgrade to 6.3.2 or 5.73.9 by release line · >= 6.0.0-alpha.1, < 6.3.2; < 5.73.9 · CVE-2026-27196 · GHSA-8r7r-f4gm-wcpq
- High, CVSS 8.1
D-Tale affected by Remote Code Execution through the /save-column-filter endpoint
PyPI dtale · Upgrade to 3.20.0 or later · < 3.20.0 · CVE-2026-27194 · GHSA-c87c-78rc-vmv2 · amended
- Critical, CVSS 9.4
Prototype pollution in swiper
npm swiper · Upgrade to 12.1.2 or later · >= 6.5.1, < 12.1.2 · CVE-2026-27212 · GHSA-hmx5-qpq5-p643 · amended
- High, CVSS 7.2
PyO3 has type confusion when accessing data from sublasses of subclasses of native types with
abi3featurecrates.io pyo3 · Upgrade to 0.28.2 or later · >= 0.28.0, < 0.28.2 · GHSA-47qc-857f-7w7f
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.