High, CVSS 8.8
imagemagick: integer overflows in MNG magnification
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.8.0 or later · < 14.8.0 · CVE-2025-55154 · GHSA-qp29-wxp5-wh82
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
PyPI langflow · Upgrade to 1.5.1 or later · <= 1.5.0 · +1 more package · CVE-2025-57760 · GHSA-4gv9-mp8m-592r · amended
- High, CVSS 7.6
imagemagick: heap-buffer overflow read in MNG magnification with alpha
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.8.0 or later · < 14.8.0 · CVE-2025-55004 · GHSA-cjc8-g9w8-chfw
- High, CVSS 7.4
ImageMagick has a Stack Buffer Overflow in image.c
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.7.0 or later · < 14.7.0 · CVE-2025-53101 · GHSA-qh3h-j545-h8c9
- High, CVSS 8.8
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
Maven org.apache.cassandra:cassandra-all · Upgrade to 4.0.17 or later · >= 4.0.16, <= 4.0.16 · CVE-2025-26467 · GHSA-5c4f-pxmx-xcm4
- High, CVSS 8.7
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
Packagist phpoffice/phpspreadsheet · Upgrade to 5.0.0, 3.10.0, 2.4.0 or 2 more by release line · < 1.30.0; >= 2.0.0, < 2.1.12; >= 2.2.0, < 2.4.0; >= 3.0.0, < 3.10.0; >= 4.0.0, < 5.0.0 · CVE-2025-54370 · GHSA-rx7m-68vc-ppxh
- High, CVSS 8.6
gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks
Go github.com/consensys/gnark · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2025-57801 · GHSA-95v9-hv42-pwrj
- High, CVSS 7.6
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
PyPI picklescan · Upgrade to 0.0.28 or later · <= 0.0.27 · CVE-2025-71348 · GHSA-vv6j-3g6g-2pvj · amended
- High, CVSS 7.6
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
PyPI picklescan · Upgrade to 0.0.28 or later · <= 0.0.27 · CVE-2025-71370 · GHSA-vr7h-p6mm-wpmh · amended
- High, CVSS 8.1
UnoPim has Broken Access Control
Packagist unopim/unopim · Upgrade to 0.3.1 or later · <= 0.3.0 · CVE-2025-55741 · GHSA-8p2f-fx4q-75cx
- High, CVSS 7.7
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
PyPI pyload-ng · Upgrade to 0.5.0b3.dev92 (pre-release) or later · < 0.5.0b3.dev92 · CVE-2025-57751 · GHSA-9gjj-6gj7-c4wj · amended
- High, CVSS 8.1
@musistudio/claude-code-router has improper CORS configuration
npm @musistudio/claude-code-router · Upgrade to 1.0.34 or later · < 1.0.34 · CVE-2025-57755 · GHSA-8hmm-4crw-vm2c · amended
- Critical, CVSS 9.1
sha.js is missing type checks leading to hash rewind and passing on crafted data
npm sha.js · Upgrade to 2.4.12 or later · <= 2.4.11 · CVE-2025-9288 · GHSA-95m3-7q98-8xr5 · amended
- Critical, CVSS 9.1
cipher-base is missing type checks, leading to hash rewind and passing on crafted data
npm cipher-base · Upgrade to 1.0.5 or later · <= 1.0.4 · CVE-2025-9287 · GHSA-cpq7-6gpm-g9rc · amended
- High, CVSS 8.8
vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
PyPI vllm · Upgrade to 0.10.1.1 or later · >= 0.10.0, < 0.10.1.1 · CVE-2025-9141 · GHSA-79j6-g2m3-jgfw · amended
- High, CVSS 7.3
UnoPim vulnerable to remote code execution through Arbitrary File upload
Packagist unopim/unopim · Upgrade to 0.2.1 or later · <= 0.2.0 · CVE-2025-55743 · GHSA-v22v-xwh7-2vrm
- High, CVSS 7.5
vllm API endpoints vulnerable to Denial of Service Attacks
PyPI vllm · Upgrade to 0.10.1.1 or later · >= 0.1.0, < 0.10.1.1 · CVE-2025-48956 · GHSA-rxc4-3w6r-4v47 · amended
- Critical, CVSS 9.3
Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF
Maven org.apache.tika:tika-parsers · Upgrade to 2.0.0-ALPHA (pre-release) or later · >= 1.13, < 2.0.0-ALPHA · +1 more package · CVE-2025-54988 · GHSA-p72g-pv48-7w9x
- High, CVSS 7.7
Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
Maven org.eclipse.jetty.http2:jetty-http2-common · Upgrade to 12.1.0.beta3 or 12.0.25 by release line · >= 12.0.0, <= 12.0.24; >= 12.1.0.alpha0, <= 12.1.0.beta2 · +1 more package · CVE-2025-5115 · GHSA-mmxm-8w33-wc4h
- Critical, CVSS 9.3
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
npm directus · Upgrade to 11.9.3 or later · >= 10.8.0, < 11.9.3 · +1 more package · CVE-2025-55746 · GHSA-mv33-9f6j-pfmc · amended
- High, CVSS 7.1
Liferay Portal Vulnerable to Cross-Site Request Forgery
Maven com.liferay.portal:release.portal.bom · Upgrade to 7.4.3.120-ga120 (pre-release) or later · >= 7.0.0-a1, < 7.4.3.120-ga120 · CVE-2025-43748 · GHSA-p9gc-59hf-x48p
- Critical, CVSS 9.8
screenshot-desktop vulnerable to command Injection via
formatoptionnpm screenshot-desktop · Upgrade to 1.15.2 or later · < 1.15.2 · CVE-2025-55294 · GHSA-gjx4-2c7g-fm94 · amended
- Critical, CVSS 10.0
HydrAIDE Authentication Bypass Vulnerability
Go github.com/hydraide/hydraide · Upgrade to 2.2.1 or 0.0.0-20250816184905-1256db38c33c (pre-release) by release line · >= 2.1.1, < 2.2.1; < 0.0.0-20250816184905-1256db38c33c · GHSA-qp7j-x725-g67f
- High, CVSS 8.7
Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
npm n8n · Upgrade to 1.98.2 or later · >= 1.77.0, < 1.98.2 · CVE-2025-52478 · GHSA-hfmv-hhh3-43f2 · amended
- Critical, CVSS 9.0
Capsule tenant owners with "patch namespace" permission can hijack system namespaces label
Go github.com/projectcapsule/capsule · Upgrade to 0.10.4 or later · < 0.10.4 · CVE-2025-55205 · GHSA-fcpm-6mxq-m5vv
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.