High, CVSS 7.5
Apache Kylin Authentication Bypass Vulnerability
Maven org.apache.kylin:kylin +1 · Upgrade all 2 to 5.0.3 or later · >= 4.0.0, < 5.0.3 · CVE-2025-61733 · GHSA-mr9j-4j48-xcm2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.3
Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability
Maven org.apache.kylin:kylin +6 · Upgrade all 7 to 5.0.3 or later · >= 4.0.0, < 5.0.3 · CVE-2025-61735 · GHSA-f6m8-qm7j-fh65
- High, CVSS 8.8
Dolibarr vulnerable to RCE via the computed field parameter
Packagist dolibarr/dolibarr · Upgrade to 21.0.3 or later · < 21.0.3 · CVE-2025-56588 · GHSA-27hj-48r9-x2vx
- High, CVSS 7.1
Django vulnerable to SQL injection in column aliases
PyPI django · Upgrade to 5.2.7, 5.1.13 or 4.2.25 by release line · >= 4.2, < 4.2.25; >= 5.1, < 5.1.13; >= 5.2, < 5.2.7 · CVE-2025-59681 · GHSA-hpr9-3m2g-3j9p · amended
- High, CVSS 8.7
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user
npm @plone/volto · Upgrade to 19.0.0-alpha.6 (pre-release), 18.27.2, 17.22.2 or 16.34.1 by release line · < 16.34.1; >= 17.0.0, < 17.22.2; >= 18.0.0, < 18.27.2; >= 19.0.0-alpha.1, < 19.0.0-alpha.6 · CVE-2025-61668 · GHSA-m8rj-ppph-mj33 · amended
- High, CVSS 7.5
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Go github.com/argoproj/argo-cd/v2 · Upgrade to 2.14.20 or later · >= 2.9.0-rc1, <= 2.14.19 · +1 more package · CVE-2025-59538 · GHSA-gpx4-37g2-c8pv
- High, CVSS 7.5
figma-developer-mcp vulnerable to command injection in get_figma_data tool
npm figma-developer-mcp · Upgrade to 0.6.3 or later · <= 0.6.2 · CVE-2025-15061 · GHSA-gxw4-4fc5-9gr5 · amended
- High, CVSS 7.5
go-f3 module vulnerable to integer overflow leading to panic
Go github.com/filecoin-project/go-f3 · Upgrade to 0.8.7 or later · < 0.8.7 · CVE-2025-59942 · GHSA-g99p-47x7-mq88
- High, CVSS 8.7
MinIO Java Client XML Tag Value Substitution Vulnerability
Maven io.minio:minio · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2025-59952 · GHSA-h7rh-xfpj-hpcm
- Critical, CVSS 9.9
j178/prek-action vulnerable to arbitrary code injection in composite action
GitHub Actions j178/prek-action · Upgrade to 1.0.6 or later · <= 1.0.5 · GHSA-pwf7-47c3-mfhx
- High, CVSS 8.2
go-mail has insufficient address encoding when passing mail addresses to the SMTP client
Go github.com/wneessen/go-mail · Upgrade to 0.7.1 or later · < 0.7.1 · CVE-2025-59937 · GHSA-wpwj-69cm-q9c5
- High, CVSS 7.3
llama-index-core insecurely handles temporary files
PyPI llama-index-core · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2025-7647 · GHSA-cr7q-2w66-hjcm · amended
- High, CVSS 8.2
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
npm @apollo/explorer · Upgrade to 3.7.3 or later · < 3.7.3 · +1 more package · CVE-2025-59845 · GHSA-w87v-7w53-wwxv · amended
- Critical, CVSS 9.4
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass
npm get-jwks · Upgrade to 11.0.2 or later · <= 11.0.1 · CVE-2025-59936 · GHSA-qc2q-qhf3-235m · amended
- High, CVSS 7.6
Rancher update on users can deny the service to the admin
Go github.com/rancher/rancher · Upgrade to 2.12.2, 2.11.6, 2.10.10 or 2.9.12 by release line · >= 2.12.0, < 2.12.2; >= 2.11.0, < 2.11.6; >= 2.10.0, < 2.10.10; >= 2.9.0, < 2.9.12 · CVE-2024-58260 · GHSA-q82v-h4rq-5c86
- High, CVSS 8.0
Rancher CLI SAML authentication is vulnerable to phishing attacks
Go github.com/rancher/rancher · Upgrade to 2.12.2, 2.11.6, 2.10.10 or 2.9.12 by release line · >= 2.12.0, < 2.12.2; >= 2.11.0, < 2.11.6; >= 2.10.0, < 2.10.10; >= 2.9.0, < 2.9.12 · CVE-2024-58267 · GHSA-v3vj-5868-2ch2
- High, CVSS 7.7
Argument injection vulnerability in SonarQube Scan Action
GitHub Actions sonarsource/sonarqube-scan-action · Upgrade to 6.0.0 or later · >= 4.0.0, < 6.0.0 · CVE-2025-59844 · GHSA-5xq9-5g24-4g6f
- High, CVSS 8.9
Hutool allows remote code execution (RCE) via the QLExpressEngine class
Maven cn.hutool:hutool-extra · Upgrade to 5.8.40 or later · < 5.8.40 · CVE-2025-56769 · GHSA-gcfh-36x4-mgj6
- High, CVSS 7.5
Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
RubyGems rack · Upgrade to 2.2.18 or later · < 2.2.18 · CVE-2025-59830 · GHSA-625h-95r8-8xpm
- Critical, CVSS 9.9
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
Go github.com/gardener/gardener-extension-provider-azure · Upgrade to 1.55.0 or later · < 1.55.0 · +3 more packages · CVE-2025-59823 · GHSA-227x-7mh8-3cf6
- High, CVSS 7.5
PYSEC-2025-209
PyPI torch · Upgrade to 2.7.1 or later · < 2.7.1 · CVE-2025-55560
- High, CVSS 7.5
PYSEC-2025-208
PyPI torch · Upgrade to 2.7.1 or later · < 2.7.1 · CVE-2025-55558
- High, CVSS 7.5
PYSEC-2025-207
PyPI torch · Upgrade to 2.7.1 or later · < 2.7.1 · CVE-2025-55557
- High, CVSS 7.5
PYSEC-2025-205
PyPI torch · Upgrade to 2.7.1 or later · < 2.7.1 · CVE-2025-55553
- High, CVSS 7.5
PYSEC-2025-204
PyPI torch · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2025-55552
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.