SageMaker Python SDK has Exposed HMAC
PyPI sagemaker · Upgrade to 3.2.0 or 2.256.0 by release line · >= 3.0, < 3.2.0; < 2.256.0 · CVE-2026-1777 · GHSA-rjrp-m2jw-pv9c · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
PyPI sagemaker · Upgrade to 3.2.0 or 2.256.0 by release line · >= 3.0, < 3.2.0; < 2.256.0 · CVE-2026-1777 · GHSA-rjrp-m2jw-pv9c · amended
PyPI sagemaker · Upgrade to 3.1.1 or 2.256.0 by release line · >= 3.0, < 3.1.1; < 2.256.0 · CVE-2026-1778 · GHSA-62rc-f4v9-h543 · amended
npm fastify · Upgrade to 5.7.2 or later · < 5.7.2 · CVE-2026-25223 · GHSA-jx2c-rxcm-jvmq · amended
npm locutus · Upgrade to 2.0.39 or later · >= 2.0.12, < 2.0.39 · CVE-2026-25521 · GHSA-rxrv-835q-v5mh · amended
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.28.5.0 or later · < 0.28.5.0 · CVE-2026-25510 · GHSA-gp56-f67f-m4px
PyPI bambuddy · Upgrade to 0.1.7 or later · < 0.1.7 · CVE-2026-25505 · GHSA-gc24-px2r-5qmf · amended
builtins.eval callPyPI picklescan · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-53874 · GHSA-9m3x-qqw2-h32h · amended
PyPI langroid · Upgrade to 0.59.32 or later · <= 0.59.31 · CVE-2026-25481 · GHSA-x34r-63hx-w57f · amended
Go github.com/bpg/terraform-provider-proxmox · Upgrade to 0.93.1 or later · < 0.93.1 · CVE-2026-25499 · GHSA-gwch-7m8v-7544
npm @backstage/plugin-techdocs-node · Upgrade to 1.14.1 or 1.13.11 by release line · >= 1.14.0, <= 1.14.0; < 1.13.11 · CVE-2026-25153 · GHSA-6jr7-99pf-8vgf · amended
npm @nyariv/sandboxjs · Upgrade to 0.8.27 or later · <= 0.8.26 · CVE-2026-25142 · GHSA-9p4w-fq8m-2hp7 · amended
Go github.com/OpenListTeam/OpenList/v4 · Upgrade to 4.1.10 or later · < 4.1.10 · CVE-2026-25060 · GHSA-wf93-3ghh-h389
Go go.opentelemetry.io/otel/sdk · Upgrade to 1.40.0 or later · >= 1.21.0, < 1.40.0 · CVE-2026-24051 · GHSA-9h8m-3fm2-qjrq
Go github.com/OpenListTeam/OpenList/v4 · Upgrade to 4.1.10 or later · < 4.1.10 · CVE-2026-25059 · GHSA-qmj2-8r24-xxcq
npm jspdf · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-24737 · GHSA-pqxr-3g65-p328 · amended
npm jspdf · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-24133 · GHSA-95fx-jjr5-f39c · amended
npm @signalk/set-system-time · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-23515 · GHSA-p8gp-2w28-mhwg · amended
PyPI vllm · Upgrade to 0.14.1 or later · >= 0.8.3, < 0.14.1 · CVE-2026-22778 · GHSA-4r2x-xpjr-7cvv · amended
PyPI lollms · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2026-1117 · GHSA-82fw-ch24-j34w · amended
PyPI text-generation · Upgrade to 3.3.7 or later · < 3.3.7 · CVE-2026-0599 · GHSA-j7x9-7j54-2v3h · amended
PyPI mlflow · Upgrade to 3.4.0rc0 (pre-release) or later · < 3.4.0rc0 · CVE-2025-10279 · GHSA-4x5p-f36r-mxxr · amended
RubyGems foreman_kubevirt · Upgrade to 0.4.3 or later · < 0.4.3 · CVE-2026-1531 · GHSA-2qxw-7fmx-gqfm
RubyGems fog-kubevirt · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-1530 · GHSA-m3hq-3qj8-c5fm
Packagist billz/raspap-webgui · Upgrade to 3.3.6 or later · < 3.3.6 · CVE-2026-24788 · GHSA-4wwf-f7w3-94f5
Go github.com/rancher/rancher · Upgrade to 2.13.2, 2.12.6, 2.11.10 or 2 more by release line · < 0.0.0-20260129092249-bb0625fd1896; >= 2.13.0, < 2.13.2; >= 2.12.0, < 2.12.6; >= 2.11.0, < 2.11.10; >= 2.10.0, < 2.10.11 · CVE-2025-67601 · GHSA-mc24-7m59-4q5p
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.