High, CVSS 8.7
rPGP affected by crash in message handling for deeply nested messages
crates.io pgp · Upgrade to 0.19.0 or later · >= 0.16.0-alpha.0, < 0.19.0 · GHSA-8h58-w33p-wq3g
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
rPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-21895
crates.io pgp · Upgrade to 0.19.0 or later · >= 0.16.0-alpha.0, < 0.19.0 · GHSA-7587-4wv6-m68m
- High, CVSS 8.1
Wildfly Elytron integration susceptible to brute force attacks via CLI
Maven org.wildfly.core:wildfly-elytron-integration · Upgrade to 32.0.0.Beta3 or 31.0.3.Final by release line · >= 32.0.0.Beta1, < 32.0.0.Beta3; < 31.0.3.Final · CVE-2025-23368 · GHSA-qhp6-6p8p-2rqh
- High, CVSS 8.2
Bug fixes in hpke-rs, hpke-rs-rust-crypto
crates.io hpke-rs-rust-crypto +1 · Upgrade all 2 to 0.6.0 or later · < 0.6.0 · GHSA-g433-pq76-6cmf
- High, CVSS 8.1
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access
Go github.com/treeverse/lakefs · Upgrade to 1.77.0 or later · <= 1.76.0 · CVE-2026-26187 · GHSA-699m-4v95-rmpm
- High, CVSS 8.8
MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
Packagist cesargb/laravel-magiclink · Upgrade to 2.25.1 or later · >= 2.0.0, < 2.25.1 · GHSA-r33w-fg8j-9c94
- High, CVSS 8.8
CediPay Affected by Improper Input Validation in Payment Processing
npm cedipay-core · Upgrade to 1.2.3 or later · < 1.2.3 · CVE-2026-26063 · GHSA-wvr6-395c-5pxr · amended
- High, CVSS 7.5
Traefik: TCP readTimeout bypass via STARTTLS on Postgres
Go github.com/traefik/traefik/v3 · Upgrade to 3.6.8 or later · <= 3.6.7 · CVE-2026-25949 · GHSA-89p3-4642-cr2w
- High, CVSS 8.9
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP
Go github.com/dunglas/frankenphp · Upgrade to 1.11.2 or later · < 1.11.2 · CVE-2026-24895 · GHSA-g966-83w7-6w38
- High, CVSS 8.7
FrankenPHP leaks session data between requests in worker mode
Go github.com/dunglas/frankenphp · Upgrade to 1.11.2 or later · < 1.11.2 · CVE-2026-24894 · GHSA-r3xh-3r3w-47gp
- High, CVSS 8.8
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
npm next-mdx-remote · Upgrade to 6.0.0 or later · >= 4.3.0, < 6.0.0 · CVE-2026-0969 · GHSA-g4xw-jxrg-5f6m · amended
- Critical, CVSS 9.8
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
Go github.com/milvus-io/milvus · Upgrade to 2.6.10 or 2.5.27 by release line · < 2.5.27; >= 2.6.0, < 2.6.10 · CVE-2026-26190 · GHSA-7ppg-37fh-vcr6 · amended
- High, CVSS 8.7
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
Packagist statamic/cms · Upgrade to 6.2.3 or later · >= 6.0.0, < 6.2.3 · CVE-2026-25759 · GHSA-ff9r-ww9c-43x8
- Critical, CVSS 9.4
set-in Affected by Prototype Pollution
npm set-in · Upgrade to 2.0.5 or later · >= 2.0.1, < 2.0.5 · CVE-2026-26021 · GHSA-2c4m-g7rx-63q7 · amended
- High, CVSS 7.6
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Maven org.open-metadata:openmetadata-sdk · Upgrade to 1.11.8 or later · < 1.11.8 · CVE-2026-26010 · GHSA-pqqf-7hxm-rj5r
- High, CVSS 8.6
Pillow affected by out-of-bounds write when loading PSD images
PyPI pillow · Upgrade to 12.1.1 or later · >= 10.3.0, < 12.1.1 · CVE-2026-25990 · GHSA-cfh3-3jmp-rvhc · amended
- High, CVSS 8.7
Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability
NuGet system.security.cryptography.cose · Upgrade to 10.0.3, 9.0.13 or 8.0.2 by release line · >= 8.0.0, <= 8.0.1; >= 9.0.0, <= 9.0.12; >= 10.0.0, <= 10.0.2 · CVE-2026-21218 · GHSA-qvhc-9v3j-5rfw
- High, CVSS 8.2
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
PyPI cryptography · Upgrade to 46.0.5 or later · <= 46.0.4 · CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2 · amended
- Critical, CVSS 9.8
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
PyPI azure-ai-language-conversations-authoring · Upgrade to 1.0.0b4 (pre-release) or later · < 1.0.0b4 · CVE-2026-21531 · GHSA-436v-jg82-p533 · amended
- Critical, CVSS 9.8
CASL Ability is Vulnerable to Prototype Pollution
npm @casl/ability · Upgrade to 6.7.5 or later · >= 2.4.0, <= 6.7.4 · CVE-2026-1774 · GHSA-x9vf-53q3-cvx6 · amended
- High, CVSS 7.5
Emmett-Core: Unhandled CookieError Exception Causing Denial of Service
PyPI emmett-core · Upgrade to 1.3.11 or later · <= 1.3.10 · CVE-2026-25577 · GHSA-x6cr-mq53-cc76 · amended
- Critical, CVSS 9.3
Apache Druid Vulnerable to Authentication Bypass
Maven org.apache.druid.extensions:druid-basic-security · Upgrade to 36.0.0 or later · >= 0.17.0, < 36.0.0 · CVE-2026-23906 · GHSA-q672-hfc7-g833
- High, CVSS 7.7
Cube Core is vulnerable to privilege escalation via a specially crafted request
npm @cubejs-backend/server-core · Upgrade to 1.5.13, 1.4.2 or 1.0.14 by release line · >= 0.27.19, < 1.0.14; >= 1.1.0, < 1.4.2; >= 1.5.0, < 1.5.13 · CVE-2026-25958 · GHSA-v226-32c7-x2v7 · amended
- High, CVSS 8.6
FUXA Affected by a Path Traversal Sanitization Bypass
npm fuxa-server · Upgrade to 1.2.11 or later · <= 1.2.10 · CVE-2026-25951 · GHSA-68m5-5w2h-h837 · amended
- Critical, CVSS 9.3
FUXA Unauthenticated Remote Arbitrary Scheduler Write
npm fuxa-server · Upgrade to 1.2.11 or later · >= 1.2.8, < 1.2.11 · CVE-2026-25939 · GHSA-c869-jx4c-q5fc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.