High, CVSS 7.2
Casdoor is vulnerable to Improper Authorization
Go github.com/casdoor/casdoor · Upgrade to 2.63.0 or later · < 2.63.0 · CVE-2025-61524 · GHSA-5m9m-j5p7-m7f9
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.3
FlowiseAI/Flosise has File Upload vulnerability
npm flowise · Upgrade to 3.0.8 or later · >= 3.0.7, <= 3.0.7 · CVE-2025-61687 · GHSA-35g6-rrw3-v6xc · amended
- High, CVSS 8.1
Deno is Vulnerable to Command Injection on Windows During Batch File Execution
crates.io deno · Upgrade to 2.5.2 or later · < 2.5.2 · CVE-2025-61787 · GHSA-m2gf-x3f6-8hq3
- High, CVSS 8.7
FuelVM is vulnerable to heap memory allocation re-use bug
crates.io fuel-vm · Upgrade to 0.60.1 or 0.59.3 by release line · < 0.59.3; >= 0.60.0, < 0.60.1 · GHSA-2pgj-5cv2-6xxw
- Critical, CVSS 9.3
Melis Platform CMS Unauthenticated Admin Account Creation
Packagist melisplatform/melis-core · Upgrade to 5.3.11 or later · < 5.3.11 · CVE-2025-10352 · GHSA-p3vc-g9f9-mgw4
- Critical, CVSS 9.3
Melis Platform CMS Unauthenticated File Upload Leading to RCE
Packagist melisplatform/melis-cms-slider · Upgrade to 5.3.1 or later · < 5.3.1 · CVE-2025-10353 · GHSA-chw4-gjvw-3gxc
- Critical, CVSS 9.3
Melis Platform CMS SQL Injection
Packagist melisplatform/melis-cms · Upgrade to 5.3.4 or later · < 5.3.4 · CVE-2025-10351 · GHSA-mrmx-jfw8-qhgv
- High, CVSS 7.1
vLLM is vulnerable to Server-Side Request Forgery (SSRF) through
MediaConnectorclassPyPI vllm · Upgrade to 0.11.0 or later · >= 0.5.0, < 0.11.0 · CVE-2025-6242 · GHSA-3f6c-7fw2-ppm4 · amended
- High, CVSS 7.6
LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities
PyPI llamafactory · Upgrade to 0.9.4 or later · <= 0.9.3 · CVE-2025-61784 · GHSA-527m-2xhr-j27g · amended
- Critical, CVSS 9.3
Akka.Remote TLS did not properly implement certificate-based authentication
NuGet akka.remote +1 · Upgrade all 2 to 1.5.52 or later · >= 1.2.0, < 1.5.52 · CVE-2025-61778 · GHSA-jhpv-4q4f-43g5
- High, CVSS 7.5
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
RubyGems rack · Upgrade to 3.2.2, 3.1.17 or 2.2.19 by release line · < 2.2.19; >= 3.1, < 3.1.17; >= 3.2, < 3.2.2 · CVE-2025-61772 · GHSA-wpv5-97wm-hp9c
- High, CVSS 7.5
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
RubyGems rack · Upgrade to 3.2.2, 3.1.17 or 2.2.19 by release line · < 2.2.19; >= 3.1, < 3.1.17; >= 3.2, < 3.2.2 · CVE-2025-61771 · GHSA-w9pc-fmgc-vxvw
- High, CVSS 7.5
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
RubyGems rack · Upgrade to 3.2.2, 3.1.17 or 2.2.19 by release line · < 2.2.19; >= 3.1, < 3.1.17; >= 3.2, < 3.2.2 · CVE-2025-61770 · GHSA-p543-xpfm-54cp
- High, CVSS 7.5
vLLM is vulnerable to timing attack at bearer auth
PyPI vllm · Upgrade to 0.11.0 or later · < 0.11.0 · CVE-2025-59425 · GHSA-wr9h-g72x-mwhm · amended
- High, CVSS 8.7
pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding
npm pdfmake · Upgrade to 0.3.0-beta.17 (pre-release) or later · >= 0.3.0-beta.1, < 0.3.0-beta.17 · CVE-2025-11362 · GHSA-rj3r-r7hh-jxfq · amended
- Critical, CVSS 9.6
SillyTavern Web Interface Vulnerable DNS Rebinding
npm sillytavern · Upgrade to 1.13.4 or later · < 1.13.4 · CVE-2025-59159 · GHSA-7cxj-w27x-x78q · amended
- High, CVSS 7.5
Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
PyPI litestar · Upgrade to 2.18.0 or later · >= 2.17.0, <= 2.17.0 · CVE-2025-59152 · GHSA-hm36-ffrh-c77c · amended
- Critical, CVSS 9.3
XWiki Platform is vulnerable to HQL injection via wiki and space search REST API
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 17.4.2 or 16.10.9 by release line · >= 17.0.0-rc-1, < 17.4.2; >= 4.3-milestone-1, < 16.10.9 · CVE-2025-52472 · GHSA-gprp-h92g-gc2h
- High, CVSS 7.5
LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing
PyPI langchain-text-splitters · Upgrade to 0.3.9 or later · < 0.3.9 · CVE-2025-6985 · GHSA-m42m-m8cr-8m58 · amended
- Critical, CVSS 9.2
XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
Maven org.xwiki.contrib.oidc:oidc-authenticator · Upgrade to 2.18.2 or later · >= 2.17.1, < 2.18.2 · CVE-2025-49594 · GHSA-f2hf-pfrj-vrm7
- Critical, CVSS 9.3
Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
npm flowise · Upgrade to 3.0.8 or later · < 3.0.8 · CVE-2025-50538 · GHSA-964p-j4gg-mhwc · amended
- High, CVSS 8.1
phpMyFAQ duplicate email registration allows multiple accounts with the same email
Packagist thorsten/phpmyfaq · Upgrade to 4.0.13 or later · >= 4.0.7, < 4.0.13 · CVE-2025-59943 · GHSA-9wj2-4hcm-r74j
- High, CVSS 8.7
Claude Code can execute commands prior to the startup trust dialog
npm @anthropic-ai/claude-code · Upgrade to 1.0.111 or later · < 1.0.111 · CVE-2025-59536 · GHSA-4fgq-fpq9-mr3g · amended
- High, CVSS 7.1
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
Go github.com/lxc/lxd · Upgrade to 6.5.0, 5.21.4 or 0.0.0-20250827065555-0494f5d47e41 (pre-release) by release line · >= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41; >= 4.0.0, < 5.21.4; >= 6.0.0, < 6.5.0 · CVE-2025-54287 · GHSA-w2hg-2v4p-vmh6
- High, CVSS 7.5
Apache Kylin Files or Directories Accessible to External Parties
Maven org.apache.kylin:kylin +6 · Upgrade all 7 to 5.0.3 or later · >= 4.0.0, < 5.0.3 · CVE-2025-61734 · GHSA-p86w-w5rh-m3hx
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.