Medium, CVSS 5.3
OpenMeter: SQL injection through meter creation
Go github.com/openmeterio/openmeter · Upgrade to 1.0.0-beta.228 (pre-release) or later · < 1.0.0-beta.228 · CVE-2026-8462 · GHSA-wc3v-3457-c8cm
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5626–5650 of 30,985 matching · newest first
- Critical, CVSS 9.1
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
Maven org.apache.fory:fory-core · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-50076 · GHSA-8f39-v287-78jf
- Low, CVSS 2.2
OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
PyPI neutron · Upgrade to 28.0.1 or later · < 28.0.1 · CVE-2026-50266 · GHSA-qmc5-gv6v-8p22 · amended
- Low, CVSS 1.1
milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery
Go github.com/milvus-io/milvus · Upgrade to 0.10.3-0.20260602041816-3d932f1c3e06 (pre-release) or later · < 0.10.3-0.20260602041816-3d932f1c3e06 · CVE-2026-10814 · GHSA-jh6h-v6mp-h22v
- Medium, CVSS 5.3
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47676 · GHSA-2gcr-mfcq-wcc3 · amended
- Medium, CVSS 5.3
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47674 · GHSA-xrhx-7g5j-rcj5 · amended
- Medium, CVSS 4.3
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47675 · GHSA-3hrh-pfw6-9m5x · amended
- Medium, CVSS 4.8
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
npm hono · Upgrade to 4.12.21 or later · < 4.12.21 · CVE-2026-47673 · GHSA-f577-qrjj-4474 · amended
- Medium, CVSS 5.4
Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
Go github.com/nhost/nhost · Upgrade to 0.0.0-20260518172022-e407511627d2 (pre-release) or later · < 0.0.0-20260518172022-e407511627d2 · CVE-2026-47671 · GHSA-64cj-qvx5-m4f3
- High, CVSS 7.5
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)
Go github.com/klever-io/klever-go · Upgrade to 1.7.17 or later · < 1.7.17 · GHSA-74m6-4hjp-7226
- Low, CVSS 2.1
kas's late signature validation may allow unnoticed repository manipulations
PyPI kas · Upgrade to 5.3 or later · >= 4.8, < 5.3 · CVE-2026-47192 · GHSA-4vqc-wpwg-vh7j · amended
- High, CVSS 7.5
React Router vulnerable to Denial of Service via reflected user input in single-fetch
npm react-router · Upgrade to 7.14.0 or later · >= 7.0.0, < 7.14.0 · +1 more package · CVE-2026-34077 · GHSA-rxv8-25v2-qmq8 · amended
- High, CVSS 8.3
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
Go github.com/nuclio/nuclio · Upgrade to 0.0.0-20260513101907-1915cd26d514 (pre-release) or later · < 0.0.0-20260513101907-1915cd26d514 · CVE-2026-45730 · GHSA-m8xg-8xg9-mxhm
- High, CVSS 7.6
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
npm better-auth · Upgrade to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-45337 · GHSA-cq3f-vc6p-68fh · amended
- Medium, CVSS 4.9
matrix-sdk-ui: Incomplete edit validation
crates.io matrix-sdk-ui · Upgrade to 0.16.1 or later · < 0.16.1 · CVE-2026-45057 · GHSA-h97m-27fx-42rx
- Medium, CVSS 6.9
Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
crates.io matrix-sdk-crypto · Upgrade to 0.16.1 or later · >= 0.12.0, < 0.16.1 · CVE-2026-45056 · GHSA-wfq4-36m3-9g42
- Medium, CVSS 5.3
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
PyPI strawberry-graphql · Upgrade to 0.315.7 or later · >= 0.172.0, <= 0.315.6 · CVE-2026-47707 · GHSA-fr49-mhgj-crfc · amended
- Medium, CVSS 5.3
Strawberry GraphQL has a Circular Fragment Reference DOS
PyPI strawberry-graphql · Upgrade to 0.315.7 or later · >= 0.71.0, <= 0.315.6 · CVE-2026-47706 · GHSA-qfwv-87qj-98xq · amended
- Medium, CVSS 6.3
Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret
RubyGems doorkeeper-openid_connect · Upgrade to 1.10.0 or later · >= 1.9.0, <= 1.9.0 · CVE-2026-44476 · GHSA-m6vc-f87m-cc2h
- Medium, CVSS 6.1
WebOb: Location header normalization during redirect leads to open redirect - again
PyPI webob · Upgrade to 1.8.10 or later · <= 1.8.9 · CVE-2026-44889 · GHSA-fh3h-vg37-cc95 · amended
- High, CVSS 7.5
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44496 · GHSA-hfxv-24rg-xrqf · amended
- High, CVSS 7.5
Allocation of Resources Without Limits or Throttling in Axios
npm axios · Upgrade to 1.16.0 or later · >= 1.7.0, < 1.16.0 · CVE-2026-44488 · GHSA-777c-7fjr-54vf · amended
- High, CVSS 8.2
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44487 · GHSA-p92q-9vqr-4j8v · amended
- High, CVSS 7.5
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44486 · GHSA-j5f8-grm9-p9fc · amended
- Medium, CVSS 6.5Exploited · CISA KEV
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
PyPI starlette · Upgrade to 1.0.1 or later · <= 1.0.0 · CVE-2026-48710 · GHSA-86qp-5c8j-p5mr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.