High, CVSS 8.5
Copier's safe template has arbitrary filesystem read/write access
PyPI copier · Upgrade to 9.9.1 or later · < 9.9.1 · CVE-2025-55201 · GHSA-3xw7-v6cj-5q8h · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code
npm @anthropic-ai/claude-code · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2025-55284 · GHSA-x5gv-jw7f-j6xj · amended
- High, CVSS 7.5
HashiCorp go-getter Vulnerable to Symlink Attacks
Go github.com/hashicorp/go-getter · Upgrade to 1.7.9 or later · < 1.7.9 · CVE-2025-8959 · GHSA-wjrx-6529-hcj3
- High, CVSS 7.0
Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
crates.io youki · Upgrade to 0.5.5 or later · < 0.5.5 · CVE-2025-54867 · GHSA-j26p-6wx7-f3pw
- Critical, CVSS 9.2
Active Storage allowed transformation methods that were potentially unsafe
RubyGems activestorage · Upgrade to 8.0.2.1, 7.2.2.2 or 7.1.5.2 by release line · >= 8.0, < 8.0.2.1; >= 7.2, < 7.2.2.2; >= 5.2.0, < 7.1.5.2 · CVE-2025-24293 · GHSA-r4mg-4433-c7g3
- Critical, CVSS 10.0
Spree has Remote Command Execution vulnerability in search functionality
RubyGems spree · Upgrade to 0.60.2 or later · < 0.60.2 · CVE-2011-10019 · GHSA-97vm-c39p-jr86
- High, CVSS 7.1
External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access
Go github.com/external-secrets/external-secrets · Upgrade to 0.19.2 or later · >= 0.15.0, < 0.19.2 · CVE-2025-55196 · GHSA-fcxq-v2r3-cc8h
- High, CVSS 8.2
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
Maven io.grpc:grpc-netty-shaded · Upgrade to 1.75.0 or later · < 1.75.0 · +1 more package · CVE-2025-55163 · GHSA-prj3-ccx8-p6x4
- High, CVSS 7.5
Apache Tomcat Improper Resource Shutdown or Release vulnerability
Maven org.apache.tomcat:tomcat-coyote +1 · Upgrade all 2 to 11.0.10, 10.1.44 or 9.0.108 by release line · >= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108 · CVE-2025-48989 · GHSA-gqp3-2cvr-x8m3
- High, CVSS 8.8
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
PyPI keras · Upgrade to 3.11.0 or later · >= 3.0.0, < 3.11.0 · CVE-2025-8747 · GHSA-c9rc-mg46-23w3 · amended
- High, CVSS 8.8
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
npm content-security-policy-parser · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2025-55164 · GHSA-w2cq-g8g3-gm83 · amended
- High, CVSS 8.9
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
PyPI picklescan · Upgrade to 0.0.27 or later · < 0.0.27 · CVE-2025-71325 · GHSA-9gvj-pp9x-gcfr · amended
- High, CVSS 7.8
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
PyPI pyload-ng · Upgrade to 0.5.0b3.dev91 (pre-release) or later · < 0.5.0b3.dev91 · CVE-2025-55156 · GHSA-pwh4-6r3m-j2rf · amended
- High, CVSS 8.5
Komari vulnerable to 2FA Authentication Bypass
Go github.com/komari-monitor/komari · Upgrade to 0.0.0-20250809064056-cc3d54bff4c6 (pre-release) or later · < 0.0.0-20250809064056-cc3d54bff4c6 · GHSA-jhmr-57cj-q6g9
- High, CVSS 8.6
Komari vulnerable to Cross-site WebSocket Hijacking
Go github.com/komari-monitor/komari · Upgrade to 0.0.0-20250809073044-53171affcaf0 (pre-release) or later · < 0.0.0-20250809073044-53171affcaf0 · GHSA-q355-h244-969h
- High, CVSS 7.5
Mattermost Confluence Plugin has Improper Validation of Specified Type of Input
Go github.com/mattermost/mattermost-plugin-confluence · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2025-54525 · GHSA-3cg3-3mmr-w8hj
- High, CVSS 7.5
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions
Go github.com/mattermost/mattermost-plugin-confluence · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2025-52931 · GHSA-vc77-c2hx-h5x2
- High, CVSS 7.2
Mattermost Confluence Plugin is Missing Authentication for Critical Function
Go github.com/mattermost/mattermost-plugin-confluence · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2025-44004 · GHSA-6ff3-jgxh-vffj
- High, CVSS 7.1
The AuthKit Remix Library renders sensitive auth data in HTML
npm @workos-inc/authkit-remix · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2025-55009 · GHSA-v3gr-w9gf-23cx · amended
- High, CVSS 7.1
The AuthKit React Router Library rendered sensitive auth data in HTML
npm @workos-inc/authkit-react-router · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2025-55008 · GHSA-vqvc-9q8x-vmq6 · amended
- Critical, CVSS 9.1
Privileged OpenBao Operator May Execute Code on the Underlying Host
Go github.com/openbao/openbao · Upgrade to 2.3.2 or 0.0.0-20250806194004-a14053c9679d (pre-release) by release line · >= 0.1.0, < 2.3.2; < 0.0.0-20250806194004-a14053c9679d · CVE-2025-54997 · GHSA-xp75-r577-cvhp
- High, CVSS 7.2
OpenBao Root Namespace Operator May Elevate Token Privileges
Go github.com/openbao/openbao · Upgrade to 2.3.2 or 0.0.0-20250806193240-9b0b5d4f345f (pre-release) by release line · >= 0.1.0, < 2.3.2; < 0.0.0-20250806193240-9b0b5d4f345f · CVE-2025-54996 · GHSA-vf84-mxrq-crqc
- High, CVSS 8.7
@fedify/fedify has Improper Authentication and Incorrect Authorization
npm @fedify/fedify · Upgrade to 1.8.5, 1.7.9, 1.6.8 or 3 more by release line · < 1.3.20; >= 1.4.0-dev.585, < 1.4.13; >= 1.5.0-dev.636, < 1.5.5; >= 1.6.0-dev.754, < 1.6.8; >= 1.7.0-pr.251.885, < 1.7.9; >= 1.8.0-dev.909, < 1.8.5 · CVE-2025-54888 · GHSA-6jcc-xgcr-q3h4 · amended
- High, CVSS 8.1
Apache Seata: Deserialization of untrusted Data in Apache Seata Server
Maven org.apache.seata:seata-serializer-fury · Upgrade to 2.5.0 or later · >= 2.4.0, <= 2.4.0 · CVE-2025-53606 · GHSA-g358-g2pq-c46j
- Critical, CVSS 9.1
JWE is missing AES-GCM authentication tag validation in encrypted JWE
RubyGems jwe · Upgrade to 1.1.1 or later · <= 1.1.0 · CVE-2025-54887 · GHSA-c7p4-hx26-pr73
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.