Critical, CVSS 9.1
pgadmin4 has a Meta-Command Filter Command Execution
PyPI pgadmin4 · Upgrade to 9.11 or later · < 9.11 · CVE-2025-13780 · GHSA-fxmw-jcgr-w44v · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.0
gardenctl is vulnerable to Command Injection when used with non‑POSIX shells
Go github.com/gardener/gardenctl-v2 · Upgrade to 0.0.0-20251107111549-0bdc484cb5fb (pre-release) or later · < 0.0.0-20251107111549-0bdc484cb5fb · CVE-2025-67508 · GHSA-fw33-qpx7-rhx2
- High, CVSS 8.4
Race condition in the Okta Java SDK
Maven com.okta.sdk:okta-sdk-root · Upgrade to 20.0.1 or later · >= 11.0.0, <= 20.0.0 · CVE-2025-67505 · GHSA-j5gq-897m-2rff
- High, CVSS 8.7
Formio improperly authorized permission elevation through specially crafted request path
npm formio · Upgrade to 4.4.3 or 3.5.7 by release line · < 3.5.7; >= 4.0.0-rc.1, < 4.4.3 · CVE-2025-67718 · GHSA-m654-769v-qjv7 · amended
- High, CVSS 8.0
Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability
Maven io.jenkins.plugins:coverage · Upgrade to 2.3056 or later · < 2.3056 · CVE-2025-67641 · GHSA-v3f3-rf6r-43x5
- High, CVSS 7.5
Jenkins has a Denial of service vulnerability in HTTP-based CLI
Maven org.jenkins-ci.main:cli +1 · Upgrade all 2 to 2.541 or 2.528.3 by release line · >= 2.529, < 2.541; < 2.528.3 · CVE-2025-67635 · GHSA-9p56-p6mw-w8qc
- Critical, CVSS 9.3
Ibexa User Bundle is missing password change validation
Packagist ibexa/user · Upgrade to 5.0.4 or later · >= 5.0.0-beta1, < 5.0.4 · CVE-2025-67719 · GHSA-x93p-w2ch-fg67
- High, CVSS 7.5
ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only)
NuGet magick.net-q8-x86 +5 · Upgrade all 6 to 14.10.0 or later · < 14.10.0 · CVE-2025-66628 · GHSA-6hjr-v6g4-3fm8
- High, CVSS 8.7
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
Maven org.xwiki.rendering:xwiki-rendering-xml · Upgrade to 17.6.0-rc-1 (pre-release), 17.4.3 or 16.10.10 by release line · < 16.10.10; >= 17.0.0-rc-1, < 17.4.3; >= 17.5.0-rc-1, < 17.6.0-rc-1 · CVE-2025-66474 · GHSA-9xc6-c2rm-f27p
- High, CVSS 8.7
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 17.7.0-rc-1 (pre-release), 17.4.4 or 16.10.11 by release line · < 16.10.11; >= 17.0.0-rc-1, < 17.4.4; >= 17.5.0-rc-1, < 17.7.0-rc-1 · CVE-2025-66473 · GHSA-cc84-q3v3-mhgf
- High, CVSS 8.2
Apache Struts has a Denial of Service vulnerability
Maven org.apache.struts:struts2-core · Upgrade to 7.1.1 or 6.8.0 by release line · >= 2.0.0, < 6.8.0; >= 7.0.0, < 7.1.1 · CVE-2025-66675 · GHSA-rg58-xhh7-mqjw
- High, CVSS 7.3
LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQLite checkpointer list method
PyPI langgraph-checkpoint-sqlite · Upgrade to 3.0.1 or later · < 3.0.1 · CVE-2025-67644 · GHSA-9rwj-6rc7-p77c · amended
- Critical, CVSS 9.3
Robocode has an insecure temporary file creation vulnerability in the AutoExtract component
Maven net.sf.robocode:robocode.battle · Upgrade to 1.9.5.6 or later · < 1.9.5.6 · CVE-2025-14307 · GHSA-2mxr-rc97-xrj2
- Critical, CVSS 10.0
Robocode vulnerable to Directory Traversal in recursivelyDelete Method
Maven net.sf.robocode:robocode.core · Upgrade to 1.9.5.6 or later · < 1.9.5.6 · CVE-2025-14306 · GHSA-j8r2-47rx-qhw4
- High, CVSS 7.1
Shopware Storefront Reflected XSS in Storefront Login Page
Packagist shopware/storefront +1 · Upgrade all 2 to 6.7.5.1 or 6.6.10.10 by release line · >= 6.4.6.0, < 6.6.10.10; >= 6.7.0.0, < 6.7.5.1 · CVE-2025-67648 · GHSA-6w82-v552-wjw2
- Critical, CVSS 9.3
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Packagist onelogin/php-saml · Upgrade to 4.3.1, 3.8.1 or 2.21.1 by release line · < 2.21.1; >= 3.0.0, < 3.8.1; >= 4.0.0, < 4.3.1 · GHSA-5j8p-438x-rgg5
- Critical, CVSS 9.4
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
Packagist neuron-core/neuron-ai · Upgrade to 2.8.12 or later · <= 2.8.11 · CVE-2025-67510 · GHSA-898v-775g-777c
- High, CVSS 8.2
Neuron MySQLSelectTool “read-only” bypass via
SELECT ... INTO OUTFILE(file write → potential RCE)Packagist neuron-core/neuron-ai · Upgrade to 2.8.12 or later · <= 2.8.11 · CVE-2025-67509 · GHSA-j8g6-5gqc-mq36
- High, CVSS 8.1
Filament multi-factor authentication (app) recovery codes can be used multiple times
Packagist filament/filament · Upgrade to 4.3.1 or later · >= 4.0.0, < 4.3.1 · CVE-2025-67507 · GHSA-pvcv-q3q7-266g
- High, CVSS 7.5
Elysia affected by arbitrary code injection through cookie config
npm elysia · Upgrade to 1.4.18 or later · < 1.4.18 · CVE-2025-66457 · GHSA-8vch-m3f4-q8jf · amended
- Critical, CVSS 9.1
Elysia vulnerable to prototype pollution with multiple standalone schema validation
npm elysia · Upgrade to 1.4.17 or later · >= 1.4.0, < 1.4.17 · CVE-2025-66456 · GHSA-hxj9-33pp-j2cc · amended
- High, CVSS 7.5
NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
PyPI nicegui · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2025-66645 · GHSA-hxp3-63hc-5366 · amended
- High, CVSS 8.0
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
Go github.com/zitadel/zitadel · Upgrade to 4.7.1 or 1.80.0-v2.20.0.20251208091519-4c879b47334e (pre-release) by release line; some affected versions have no fix yet · < 1.80.0-v2.20.0.20251208091519-4c879b47334e; >= 1.83.4, <= 1.87.5; >= 4.0.0-rc.1, < 4.7.1 · +1 more package · CVE-2025-67495 · GHSA-v959-qxv6-6f8p
- High, CVSS 8.1
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login
Go github.com/zitadel/zitadel · Upgrade to 4.7.1 or 1.80.0-v2.20.0.20251208091519-4c879b47334e (pre-release) by release line; some affected versions have no fix yet · < 1.80.0-v2.20.0.20251208091519-4c879b47334e; >= 1.83.4, <= 1.87.5; >= 4.0.0-rc.1, < 4.7.1 · +1 more package · CVE-2026-29067 · GHSA-pfrf-9r5f-73f5
- Critical, CVSS 9.3
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
Go github.com/zitadel/zitadel · Upgrade to 4.7.1 or 1.80.0-v2.20.0.20251208091519-4c879b47334e (pre-release) by release line; some affected versions have no fix yet · < 1.80.0-v2.20.0.20251208091519-4c879b47334e; >= 1.83.4, <= 1.87.5; >= 4.0.0-rc.1, < 4.7.1 · +1 more package · CVE-2025-67494 · GHSA-7wfc-4796-gmg5
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.