High, CVSS 8.6
LangChain serialization injection vulnerability enables secret extraction
npm langchain · Upgrade to 1.2.3 or 0.3.37 by release line · >= 1.0.0, < 1.2.3; < 0.3.37 · +1 more package · CVE-2025-68665 · GHSA-r399-636x-v7f6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 407 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.8
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
RubyGems httparty · Upgrade to 0.24.0 or later · <= 0.23.2 · CVE-2025-68696 · GHSA-hm5p-x4rq-38w4
- Critical, CVSS 9.3
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
PyPI langchain-core · Upgrade to 1.2.5 or 0.3.81 by release line · >= 1.0.0, < 1.2.5; < 0.3.81 · CVE-2025-68664 · GHSA-c67j-w6g6-q2cm · amended
- High, CVSS 7.5
Fedify has ReDoS Vulnerability in HTML Parsing Regex
npm @fedify/fedify · Upgrade to 1.9.2, 1.8.15, 1.7.14 or 1.6.13 by release line · < 1.6.13; >= 1.7.0, < 1.7.14; >= 1.8.0, < 1.8.15; >= 1.9.0, < 1.9.2 · CVE-2025-68475 · GHSA-rchf-xwx2-hm93 · amended
- High, CVSS 8.2
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential
Go github.com/kedacore/keda/v2 · Upgrade to 2.18.3 or 2.17.3 by release line · >= 2.18.0, < 2.18.3; < 2.17.3 · CVE-2025-68476 · GHSA-c4p6-qg4m-9jmr
- Critical, CVSS 9.9Exploited · CISA KEV
n8n Vulnerable to Remote Code Execution via Expression Injection
npm n8n · Upgrade to 1.121.1 or 1.120.4 by release line · >= 0.211.0, < 1.120.4; >= 1.121.0, < 1.121.1 · CVE-2025-68613 · GHSA-v98v-ff95-f3cp · amended
- High, CVSS 7.2
Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20251121122154-b57c297c6d7a (pre-release) or later · < 8.0.0-20251121122154-b57c297c6d7a · +1 more package · CVE-2025-14273 · GHSA-qvmc-92vg-6r35
- High, CVSS 7.1
External Control of File Name or Path in Langflow
PyPI langflow · Upgrade to 1.7.1 or later · < 1.7.1 · CVE-2025-68478 · GHSA-f43r-cc68-gpx4 · amended
- High, CVSS 7.7
Langflow vulnerable to Server-Side Request Forgery
PyPI langflow · Upgrade to 1.7.1 or later · < 1.7.1 · CVE-2025-68477 · GHSA-5993-7p27-66g5 · amended
- High, CVSS 7.5
Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization
Maven org.apache.nifi:nifi-asana-processors · Upgrade to 2.7.0 or later · >= 1.20.0, < 2.7.0 · CVE-2025-66524 · GHSA-v4p2-2w39-mhrj
- High, CVSS 7.5
Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments
Go github.com/elastic/beats · Upgrade to 9.2.3, 9.1.9 or 8.19.9 by release line · >= 8.6.0, < 8.19.9; >= 9.0.0, < 9.1.9; >= 9.2.0, < 9.2.3 · +1 more package · CVE-2025-68388 · GHSA-fj69-23m4-ccvv
- Critical, CVSS 9.1
Weblate is vulnerable to RCE through Git config file overwrite
PyPI weblate · Upgrade to 5.15.1 or later · < 5.15.1 · CVE-2025-68398 · GHSA-8vcg-cfxj-p5m3 · amended
- High, CVSS 7.7
Weblate has an arbitrary file read via symbolic links
PyPI weblate · Upgrade to 5.15.1 or later · < 5.15.1 · CVE-2025-68279 · GHSA-g925-f788-4jh7 · amended
- High, CVSS 8.5
nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
PyPI nbconvert · Upgrade to 7.17.0 or later · < 7.17.0 · CVE-2025-53000 · GHSA-xm59-rqc7-hhvf · amended
- High, CVSS 7.3
Storybook manager bundle may expose environment variables during build
npm storybook · Upgrade to 10.1.10, 9.1.17, 8.6.15 or 7.6.21 by release line · >= 7.0.0, < 7.6.21; >= 8.0.0, < 8.6.15; >= 9.0.0, < 9.1.17; >= 10.0.0, < 10.1.10 · CVE-2025-68429 · GHSA-8452-54wp-rmv6 · amended
- High, CVSS 7.3
tinacms is vulnerable to arbitrary code execution
npm tinacms · Upgrade to 3.1.1 or later · < 3.1.1 · +2 more packages · CVE-2025-68278 · GHSA-529f-9qwm-9628 · amended
- High, CVSS 7.5
jose4j is vulnerable to DoS via compressed JWE content
Maven org.bitbucket.b_c:jose4j · Upgrade to 0.9.6 or later · < 0.9.6 · CVE-2024-29371 · GHSA-3677-xxcr-wjqv
- Critical, CVSS 9.8
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
PyPI apache-airflow-providers-edge3 +1 · Upgrade all 2 to 2.0.0 or later · < 2.0.0 · CVE-2025-67895 · GHSA-66h8-3g48-6hx8 · amended
- High, CVSS 8.1
systeminformation has a Command Injection vulnerability in fsSize() function on Windows
npm systeminformation · Upgrade to 5.27.14 or later · < 5.27.14 · CVE-2025-68154 · GHSA-wphj-fx3q-84ch · amended
- High, CVSS 8.3
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
npm parse-server · Upgrade to 9.1.1-alpha.1 (pre-release) or 8.6.2 by release line · < 8.6.2; >= 9.0.0, < 9.1.1-alpha.1 · CVE-2025-68150 · GHSA-3f5f-xgrj-97pf · amended
- High, CVSS 7.5
Expr has Denial of Service via Unbounded Recursion in Builtin Functions
Go github.com/expr-lang/expr · Upgrade to 1.17.7 or later · < 1.17.7 · CVE-2025-68156 · GHSA-cfpf-hrx2-8rv6
- High, CVSS 7.5
@vitejs/plugin-rsc has an Arbitrary File Read via
/__vite_rsc_findSourceMapURLEndpointnpm @vitejs/plugin-rsc · Upgrade to 0.5.8 or later · < 0.5.8 · CVE-2025-68155 · GHSA-g239-q96q-x4qm · amended
- High, CVSS 8.7
SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference
Go github.com/emiago/sipgo · Upgrade to 1.0.0-alpha-1 (pre-release) or later · >= 0.3.0, < 1.0.0-alpha-1 · CVE-2025-68274 · GHSA-c623-f998-8hhv
- High, CVSS 8.6
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
npm better-auth · Upgrade to 1.4.5 or later · < 1.4.5 · CVE-2025-71399 · GHSA-x732-6j76-qmhm · amended
- High, CVSS 7.3
Libredesk has Improper Neutralization of HTML Tags in a Web Page
Go github.com/abhinavxd/libredesk · Upgrade to 0.8.6-beta (pre-release) or later · < 0.8.6-beta · CVE-2025-68927 · GHSA-wh6m-h6f4-rjf4
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.