High, CVSS 7.5
PYSEC-2025-203
PyPI torch · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2025-55551
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.7
Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions
npm @anthropic-ai/claude-code · Upgrade to 1.0.39 or later · < 1.0.39 · CVE-2025-59828 · GHSA-2jjv-qf24-vfm4 · amended
- High, CVSS 8.7
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
npm tar-fs · Upgrade to 3.1.1, 2.1.4 or 1.16.6 by release line · >= 3.0.0, < 3.1.1; >= 2.0.0, < 2.1.4; < 1.16.6 · CVE-2025-59343 · GHSA-vj76-c3g6-qr5v · amended
- Critical, CVSS 9.3
Apache IoTDB: Deserialization of untrusted Data
PyPI apache-iotdb +1 · Upgrade all 2 to 2.0.5 or later · >= 1.0.0, < 2.0.5 · CVE-2025-48459 · GHSA-776q-jw43-fhjx · amended
- Critical, CVSS 9.0
DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module
NuGet dotnetnuke.core · Upgrade to 10.1.0 or later · < 10.1.0 · CVE-2025-59545 · GHSA-2qxc-mf4x-wr29
- High, CVSS 8.2
Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink
npm @meshconnect/web-link-sdk · Upgrade to 3.3.2 or later · < 3.3.2 · CVE-2025-59430 · GHSA-vh3f-qppr-j97f · amended
- High, CVSS 8.7
git-comitersCommand Injection vulnerabilitynpm git-commiters · Upgrade to 0.1.2 or later · < 0.1.2 · CVE-2025-59831 · GHSA-g38c-wxjf-xrh6 · amended
- High, CVSS 7.5
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
PyPI authlib · Upgrade to 1.6.4 or later · < 1.6.4 · CVE-2025-59420 · GHSA-9ggr-2464-2j32 · amended
- High, CVSS 8.0
Mattermost Path Traversal vulnerability
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20250707221302-a8fa77f107ef (pre-release) or later · < 8.0.0-20250707221302-a8fa77f107ef · +1 more package · CVE-2025-9079 · GHSA-qx3f-6vq3-8j8m
- High, CVSS 8.7
The Keras
Model.load_modelmethod **silently** ignoressafe_mode=Trueand allows arbitrary code execution when a.h5/.hdf5file is loaded.PyPI keras · Upgrade to 3.11.3 or later · >= 3.0.0, < 3.11.3 · CVE-2025-9905 · GHSA-36rr-ww3j-vrjv · amended
- High, CVSS 8.6
Codex has sandbox bypass due to bug in path configuration logic
npm @openai/codex · Upgrade to 0.39.0 or later · >= 0.2.0, <= 0.38.0 · CVE-2025-59532 · GHSA-w5fx-fh39-j5rw · amended
- High, CVSS 8.7
Keras is vulnerable to Deserialization of Untrusted Data
PyPI keras · Upgrade to 3.11.0 or later · < 3.11.0 · CVE-2025-9906 · GHSA-36fq-jgmw-4r9c · amended
- Critical, CVSS 9.3
InvokeAI has External Control of File Name or Path
PyPI invokeai · Upgrade to 6.7.0 or later · < 6.7.0 · CVE-2025-6237 · GHSA-vv9c-xxg7-wmv7 · amended
- High, CVSS 8.2
Pingora update for MadeYouReset HTTP/2 vulnerability
crates.io pingora-core · Upgrade to 0.6.0 or later · < 0.6.0 · GHSA-393w-9x6h-8gc7
- High, CVSS 7.7
DragonFly's manager generates mTLS certificates for arbitrary IP addresses
Go github.com/dragonflyoss/dragonfly +1 · Upgrade all 2 to 2.1.0 or later · < 2.1.0 · CVE-2025-59353 · GHSA-255v-qv84-29p5
- Critical, CVSS 9.8
jinjava has Sandbox Bypass via JavaType-Based Deserialization
Maven com.hubspot.jinjava:jinjava · Upgrade to 2.8.1 or 2.7.5 by release line · >= 2.8.0, <= 2.8.0; >= 2.7.0, < 2.7.5 · CVE-2025-59340 · GHSA-m49c-g9wr-hv6v
- High, CVSS 7.7
Dragonfly vulnerable to server-side request forgery
Go github.com/dragonflyoss/dragonfly +1 · Upgrade all 2 to 2.1.0 or later · < 2.1.0 · CVE-2025-59346 · GHSA-g2rq-jv54-wcpr
- High, CVSS 7.7
Dragonfly doesn't have authentication enabled for some Manager’s endpoints
Go github.com/dragonflyoss/dragonfly +1 · Upgrade all 2 to 2.1.0 or later · < 2.1.0 · CVE-2025-59345 · GHSA-89vc-vf32-ch59
- High, CVSS 8.7
JasperReports has a Java deserialisation vulnerability
Maven net.sf.jasperreports:jasperreports · Upgrade to 7.0.4 or later · < 7.0.4 · CVE-2025-10492 · GHSA-7c3f-cg9x-f3gr
- Critical, CVSS 10.0
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
Maven org.springframework.cloud:spring-cloud-gateway-server-webflux · Upgrade to 4.3.1 or 4.2.5 by release line; some affected versions have no fix yet · >= 3.1.0, <= 3.1.10; >= 4.0.0, <= 4.1.10; >= 4.2.0, < 4.2.5; >= 4.3.0, < 4.3.1 · CVE-2025-41243 · GHSA-q2cj-h8fw-q4cc
- High, CVSS 7.5
Spring Framework annotation detection mechanism may result in improper authorization
Maven org.springframework:spring-core · Upgrade to 6.2.11; some affected versions have no fix yet · >= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, <= 6.2.10 · CVE-2025-41249 · GHSA-jmp9-x22r-554x
- High, CVSS 7.5
Spring Security annotation detection mechanism has authorization bypass
Maven org.springframework.security:spring-security-core · Upgrade to 6.5.4 or 6.4.10 by release line · >= 6.4.0, < 6.4.10; >= 6.5.0, < 6.5.4 · CVE-2025-41248 · GHSA-8v5q-rhf3-jphm
- High, CVSS 8.8
is-arrayish@0.3.3 contains malware after npm account takeover
npm is-arrayish · Upgrade to 0.3.4 or later · >= 0.3.3, < 0.3.4 · CVE-2025-59331 · GHSA-frh7-2f84-v9mw · amended
- High, CVSS 8.8
error-ex@1.3.3 contains malware after npm account takeover
npm error-ex · Upgrade to 1.3.4 or later · >= 1.3.3, < 1.3.4 · CVE-2025-59330 · GHSA-6jp5-hh4c-8c5h · amended
- High, CVSS 8.8
color-convert@3.1.1 contains malware after npm account takeover
npm color-convert · Upgrade to 3.1.2 or later · >= 3.1.1, < 3.1.2 · CVE-2025-59162 · GHSA-pxx3-g568-hxr4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.