High, CVSS 7.5
Salt Authentication Protocol Version Downgrade Allows Minion Impersonation
PyPI salt · Upgrade to 3007.9 or 3006.17 by release line · >= 3006.12, < 3006.17; >= 3007.4, < 3007.9 · CVE-2025-62349 · GHSA-vcf3-26xf-fw4m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 410 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure
PyPI geopandas · Upgrade to 1.1.2 or later · < 1.1.2 · CVE-2025-69662 · GHSA-6497-prx7-gpmq · amended
- High, CVSS 7.3
Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload
PyPI salt · Upgrade to 3006.17 or later · < 3006.17 · CVE-2025-62348 · GHSA-77w2-v593-vxvv · amended
- Critical, CVSS 9.3
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
npm @orval/core · Upgrade to 8.2.0 or 7.21.0 by release line · >= 7.19.0, < 7.21.0; >= 8.0.0, < 8.2.0 · CVE-2026-25141 · GHSA-gch2-phqh-fg9q · amended
- High, CVSS 7.5
fast-xml-parser has RangeError DoS Numeric Entities Bug
npm fast-xml-parser · Upgrade to 5.3.4 or later · >= 5.0.9, <= 5.3.3 · CVE-2026-25128 · GHSA-37qj-frw5-hhjh · amended
- High, CVSS 7.5
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
Maven io.undertow:undertow-core · Upgrade to 2.4.0.Beta1, 2.3.21.Final or 2.2.39.Final by release line · < 2.2.39.Final; >= 2.4.0.Alpha1, <= 2.4.0.Alpha1; >= 2.3.0.Alpha1, < 2.3.21.Final · CVE-2024-4027 · GHSA-33hj-rcmx-86mv
- Critical, CVSS 9.4
deepHas vulnerable to Prototype Pollution via constructor.prototype
npm deephas · Upgrade to 1.0.8 or later · < 1.0.8 · CVE-2026-25047 · GHSA-2733-6c58-pf27 · amended
- High, CVSS 8.7
Unfurl's unbounded zlib decompression allows decompression bomb DoS
PyPI dfir-unfurl · Upgrade to 20260405 or later · < 20260405 · CVE-2026-40036 · GHSA-h5qv-qjv4-pc5m · amended
- High, CVSS 7.5
React Server Components have multiple Denial of Service Vulnerabilities
npm react-server-dom-turbopack +2 · Upgrade all 3 to 19.2.4, 19.1.5 or 19.0.4 by release line · >= 19.1.0-canary-7130d0c6-20241212, < 19.1.5; >= 19.0.0, < 19.0.4; >= 19.2.0-canary-63779030-20250328, < 19.2.4 · CVE-2026-23864 · GHSA-83fc-fqcc-2hmg · amended
- High, CVSS 8.5
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
npm nocodb · Upgrade to 0.301.0 or later · < 0.301.0 · CVE-2026-24769 · GHSA-q5c6-h22r-qpwr · amended
- Critical, CVSS 9.1
DotNetNuke.Core Vulnerable to Stored XSS via Module Title
NuGet dotnetnuke.core · Upgrade to 10.2.0 or 9.13.10 by release line · < 9.13.10; >= 10.0.0, < 10.2.0 · CVE-2026-24838 · GHSA-w9pf-h6m6-v89h
- High, CVSS 8.7
EGroupware has SQL Injection in Nextmatch Filter Processing
Packagist egroupware/egroupware · Upgrade to 26.0.20260113 or 23.1.20260113 by release line · < 23.1.20260113; >= 26.0.20251208, < 26.0.20260113 · CVE-2026-22243 · GHSA-rvxj-7f72-mhrx
- High, CVSS 8.2
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
npm tar · Upgrade to 7.5.7 or later · < 7.5.7 · CVE-2026-24842 · GHSA-34x7-hfp2-rc4v · amended
- High, CVSS 7.6
DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal
NuGet dotnetnuke.core · Upgrade to 10.2.0; some affected versions have no fix yet · >= 9.0.0, <= 9.13.9; >= 10.0.0, < 10.2.0 · CVE-2026-24837 · GHSA-vm5q-8qww-h238
- High, CVSS 8.0
Clatter has a PSK Validity Rule Violation issue
crates.io clatter · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-24785 · GHSA-253q-9q78-63x4
- High, CVSS 7.5
soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives
crates.io soroban-fixed-point-math · Upgrade to 1.4.1 or 1.3.1 by release line · >= 1.4.0, <= 1.4.0; >= 1.3.0, <= 1.3.0 · CVE-2026-24783 · GHSA-x5m4-43jf-hh65
- High, CVSS 7.1
vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector
PyPI vllm · Upgrade to 0.14.1 or later · < 0.14.1 · CVE-2026-24779 · GHSA-qh4c-xf7m-gxfc · amended
- High, CVSS 8.8
Ghost vulnerable to XSS via malicious Portal preview links
npm @tryghost/portal · Upgrade to 2.57.1 or 2.51.5 by release line · >= 2.29.1, < 2.51.5; >= 2.52.0, < 2.57.1 · +1 more package · CVE-2026-24778 · GHSA-gv6q-2m97-882h · amended
- Critical, CVSS 9.3
Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema
crates.io capnp · Upgrade to 0.24.0 or later · < 0.24.0 · GHSA-5w5r-mf82-595p
- High, CVSS 7.5
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
npm next · Upgrade to 16.1.5, 16.0.11, 15.6.0-canary.61 (pre-release) or 6 more by release line · >= 13.0.0, < 15.0.8; >= 15.1.1-canary.0, < 15.1.12; >= 15.2.0-canary.0, < 15.2.9; >= 15.3.0-canary.0, < 15.3.9; >= 15.4.0-canary.0, < 15.4.11; >= 15.5.1-canary.0, < 15.5.10; >= 15.6.0-canary.0, < 15.6.0-canary.61; >= 16.0.0-beta.0, < 16.0.11; >= 16.1.0-canary.0, < 16.1.5 · GHSA-h25m-26qc-wcjf · amended
- High, CVSS 7.1
billboard.js is vulnerable to XSS during chart option binding
npm billboard.js · Upgrade to 3.18.0 or later · < 3.18.0 · CVE-2026-1513 · GHSA-rpc5-pm7q-hjmp · amended
- High, CVSS 7.8
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
Packagist phpunit/phpunit · Upgrade to 12.5.8, 11.5.50, 10.5.62 or 2 more by release line · < 8.5.52; >= 9.0.0, < 9.6.33; >= 10.0.0, < 10.5.62; >= 11.0.0, < 11.5.50; >= 12.0.0, < 12.5.8 · CVE-2026-24765 · GHSA-vvj3-c3rp-c85p
- High, CVSS 8.8
PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
PyPI pytorch +1 · Upgrade all 2 to 2.10.0 or later · < 2.10.0 · CVE-2026-24747 · GHSA-63cw-57p8-fm3p · amended
- Critical, CVSS 10.0
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
npm @nyariv/sandboxjs · Upgrade to 0.8.26 or later · < 0.8.26 · CVE-2026-23830 · GHSA-wxhw-j4hc-fmq6 · amended
- High, CVSS 7.7
Kyverno Denial of Service via Context Variable Amplification in Policy Engine
Go github.com/kyverno/kyverno · Upgrade to 1.16.3 or 1.15.3 by release line · < 1.15.3; >= 1.16.0-rc.1, < 1.16.3 · CVE-2026-23881 · GHSA-r2rj-wwm5-x6mq
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.