Critical, CVSS 10.0
Step CA Has Authorization Bypass in ACME and SCEP Provisioners
Go github.com/smallstep/certificates · Upgrade to 0.29.0 or later · <= 0.28.4 · CVE-2025-44005 · GHSA-h8cp-697h-8c8p
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.8
Coder logs sensitive objects unsanitized
Go github.com/coder/coder/v2 · Upgrade to 2.28.4, 2.27.7 or 2.26.5 by release line · < 2.26.5; >= 2.27.0, < 2.27.7; >= 2.28.0, < 2.28.4 · CVE-2025-66411 · GHSA-jf75-p25m-pw74
- High, CVSS 8.7
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
npm @anthropic-ai/claude-code · Upgrade to 1.0.93 or later · < 1.0.93 · CVE-2025-66032 · GHSA-xq4m-mc3c-vvg3 · amended
- High, CVSS 7.3
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode
Go github.com/docker/mcp-gateway · Upgrade to 0.28.0 or later · <= 0.27.0 · CVE-2025-64443 · GHSA-46gc-mwh4-cc5r
- High, CVSS 7.6
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
Packagist aimeos/ai-cms-grapesjs · Upgrade to 2025.10.2, 2024.10.8, 2023.10.15 or 2 more by release line · >= 2021.04.1, < 2021.10.8; >= 2022.04.1, < 2022.10.9; >= 2023.04.1, < 2023.10.15; >= 2024.04.1, < 2024.10.8; >= 2025.04.1, < 2025.10.2 · CVE-2025-66468 · GHSA-424m-fj2q-g7vg
- High, CVSS 8.8
GrapesJsBuilder File Upload allows all file uploads
Packagist mautic/grapes-js-builder-bundle · Upgrade to 6.0.7, 5.2.9 or 4.4.18 by release line · >= 4.0.0, < 4.4.18; >= 5.0.0, < 5.2.9; >= 6.0.0, < 6.0.7 · CVE-2025-13827 · GHSA-5xw2-57jx-pgjp
- Critical, CVSS 9.0
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Packagist mautic/core · Upgrade to 6.0.7, 5.2.9 or 4.4.18 by release line · >= 4.0.0, < 4.4.18; >= 5.0.0, < 5.2.9; >= 6.0.0, < 6.0.7 · CVE-2025-13828 · GHSA-3fq7-c5m8-g86x
- High, CVSS 7.1
gokey allows secret recovery from a seed file without the master password
Go github.com/cloudflare/gokey · Upgrade to 0.2.0 or later · < 0.2.0 · CVE-2025-13353 · GHSA-69jw-4jj8-fcxm
- High, CVSS 7.1
vLLM vulnerable to remote code execution via transformers_utils/get_config
PyPI vllm · Upgrade to 0.11.1 or later · < 0.11.1 · CVE-2025-66448 · GHSA-8fr4-5q9j-m8gm · amended
- High, CVSS 7.6
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
PyPI mcp · Upgrade to 1.23.0 or later · < 1.23.0 · CVE-2025-66416 · GHSA-9h52-p55h-vw2f · amended
- High, CVSS 7.6
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
npm @modelcontextprotocol/sdk · Upgrade to 1.24.0 or later · < 1.24.0 · CVE-2025-66414 · GHSA-w48q-cv73-mx4w · amended
- High, CVSS 7.7
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66298 · GHSA-8535-hvm8-2hmv
- High, CVSS 8.7
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66294 · GHSA-662m-56v4-3r8f
- High, CVSS 7.4
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66297 · GHSA-858q-77wx-hhx6
- High, CVSS 8.8
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66295 · GHSA-h756-wh59-hhjv
- High, CVSS 8.5
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
npm @angular/compiler · Upgrade to 21.0.2, 20.3.15 or 19.2.17 by release line; some affected versions have no fix yet · >= 21.0.0-next.0, < 21.0.2; >= 20.0.0-next.0, < 20.3.15; >= 19.0.0-next.0, < 19.2.17; <= 18.2.14 · CVE-2025-66412 · GHSA-v4hv-rgfq-gp49 · amended
- High, CVSS 8.7
Gin-vue-admin has an arbitrary file deletion vulnerability
Go github.com/flipped-aurora/gin-vue-admin · Upgrade to 0.9.1-0.20251201084432-ee8d8d7e04d9 (pre-release) or later · < 0.9.1-0.20251201084432-ee8d8d7e04d9 · CVE-2025-66410 · GHSA-jrhg-82w2-vvj7
- High, CVSS 8.9
Keras Directory Traversal Vulnerability
PyPI keras · Upgrade to 3.12.0 or later · <= 3.11.3 · CVE-2025-12060 · GHSA-hjqc-jx6g-rwp9 · amended
- High, CVSS 8.2
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66305 · GHSA-m8vh-v6r6-w7p6
- High, CVSS 8.6
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66301 · GHSA-v8x2-fjv7-8hjh
- High, CVSS 8.5
Grav is vulnerable to Arbitrary File Read
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66300 · GHSA-p4ww-mcp9-j6f2
- High, CVSS 8.8
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66299 · GHSA-gjc5-8cfh-653x
- High, CVSS 8.8
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
Packagist getgrav/grav · Upgrade to 1.8.0-beta.27 (pre-release) or later · < 1.8.0-beta.27 · CVE-2025-66296 · GHSA-cjcp-qxvg-4rjm
- High, CVSS 8.9
Better Auth affected by external request basePath modification DoS
npm better-auth · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2025-71401 · GHSA-569q-mpph-wgww · amended
- High, CVSS 8.7
XWiki Jetty Package (XJetty) allows accessing any application file through URL
Maven org.xwiki.platform:xwiki-platform-tool-jetty-resources · Upgrade to 17.7.0, 17.4.4 or 16.10.11 by release line · >= 16.7.0, < 16.10.11; >= 17.0.0-rc-1, < 17.4.4; >= 17.5.0, < 17.7.0 · CVE-2025-55749 · GHSA-53gx-j3p6-2rw9
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.