High, CVSS 7.4
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
NuGet corewcf.primitives · Upgrade to 1.9.1 or later · >= 1.9.0, < 1.9.1 · CVE-2026-54784 · GHSA-2288-8h3r-cqgg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 965 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4851–4875 of 30,970 matching · newest first
- High, CVSS 7.4
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54783 · GHSA-gqv6-pwcg-87r8
- Critical, CVSS 10.0
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54782 · GHSA-xjr9-gg9q-jx3v
- High, CVSS 7.4
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54781 · GHSA-48pq-2xq3-c2m4
- Low, CVSS 3.7
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54780 · GHSA-4v55-cpmv-3vcm
- Medium, CVSS 5.9
CoreWCF: SAML token replay protection is inoperative
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54779 · GHSA-9jr3-rj99-8jq3
- Medium, CVSS 6.2
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
NuGet corewcf.unixdomainsocket · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54778 · GHSA-q6v9-43v5-jv9q
- Medium, CVSS 6.5
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
NuGet corewcf.netnamedpipe · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54777 · GHSA-6jj2-4q5c-x8g6
- Medium, CVSS 4.4
CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
NuGet corewcf.unixdomainsocket · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54776 · GHSA-wjpq-6766-7f5j
- Medium, CVSS 6.5
CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.
NuGet corewcf.kafka · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54775 · GHSA-m744-jhq9-ppw6
- High, CVSS 7.4
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54774 · GHSA-rpj7-hr7h-w6p9
- Medium, CVSS 5.9
CoreWCF: WS-Security signature substitution via document-wide Signature lookup
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54773 · GHSA-jc6x-rj79-w4mx
- High, CVSS 7.5
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
NuGet corewcf.netframingbase · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54772 · GHSA-p86g-xrr2-pf7c
- Medium, CVSS 5.3
Python Liquid: Infinite loop when parsing malformed
{% case %}tagsPyPI python-liquid · Upgrade to 2.2.1 or later · < 2.2.1 · CVE-2026-55865 · GHSA-vq2f-vcc9-j8mv · amended
- High, CVSS 8.7
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close
RubyGems oj · Upgrade to 3.17.3 or later · <= 3.17.2 · CVE-2026-54897 · GHSA-9ppp-w3g4-fh4q
- Low, CVSS 2.1
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
npm parse-server · Upgrade to 9.9.1-alpha.11 (pre-release) or 8.6.81 by release line · >= 9.0.0, < 9.9.1-alpha.11; <= 8.6.80 · CVE-2026-55778 · GHSA-v8x7-r927-cc93 · amended
- High, CVSS 7.5
Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input
RubyGems oj · Upgrade to 3.17.3 or later · < 3.17.3 · CVE-2026-54592 · GHSA-3m6q-jj5j-38c9
- High, CVSS 7.1
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
PyPI jupyterlab-git · Upgrade to 0.54.0 or later · <= 0.53.0 · CVE-2026-54528 · GHSA-436q-jwfr-rm2h · amended
- High, CVSS 8.6
jupyterlab-git extension: Stored XSS leading to RCE
PyPI jupyterlab-git +2 · Upgrade all 3 to 0.54.0 or later · >= 0.30.0b3, < 0.54.0 · CVE-2026-54527 · GHSA-f962-v9hr-pfg5 · amended
- Medium, CVSS 5.3
Oj: intern.c form_attr (uninitialized stack read)
RubyGems oj · Upgrade to 3.17.3 or later · < 3.17.3 · CVE-2026-54500 · GHSA-fm7p-mprw-wjm9
- High, CVSS 7.5
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
PyPI stanza · Upgrade to 1.12.2 or later · <= 1.12.1 · CVE-2026-54499 · GHSA-v5jw-96jm-7h2c · amended
- High, CVSS 7.6
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
PyPI homeassistant · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-54317 · GHSA-x84v-g949-293w · amended
- High, CVSS 7.5
Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
RubyGems faraday · Upgrade to 2.14.3 or 1.10.6 by release line · >= 2.0.0, <= 2.14.2; >= 1.0.0, <= 1.10.5 · CVE-2026-54297 · GHSA-98m9-hrrm-r99r
- High, CVSS 8.4
containerd CRI checkpoint restore CDI annotation smuggling
Go github.com/containerd/containerd/v2 · Upgrade to 2.3.2, 2.2.5 or 2.1.9 by release line · >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 · CVE-2026-53492 · GHSA-33vj-92qq-66hc
- High, CVSS 7.1
Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
Go github.com/containerd/containerd/v2 · Upgrade to 2.3.2, 2.2.5 or 2.1.9 by release line · >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 · CVE-2026-53489 · GHSA-rgh6-rfwx-v388
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.