High, CVSS 8.7
quiche connection ID retirement can trigger an infinite loop
crates.io quiche · Upgrade to 0.24.5 or later · >= 0.15.0, < 0.24.5 · CVE-2025-7054 · GHSA-m3hh-f9gh-74c2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.4
SKOPS Card.get_model happily allows arbitrary code execution
PyPI skops · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2025-54886 · GHSA-378x-6p4f-8jgm · amended
- High, CVSS 8.7
XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
Maven org.xwiki.platform:xwiki-platform-oldcore +1 · Upgrade all 2 to 17.2.0-rc-1 (pre-release), 16.10.5 or 16.4.7 by release line · >= 1.1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.5; >= 17.0.0-rc-1, < 17.2.0-rc-1 · CVE-2025-54125 · GHSA-57q2-6cp4-9mq3
- High, CVSS 7.1
XWiki leaks password hashes and other accessible password properties
Maven org.xwiki.platform:xwiki-platform-oldcore +1 · Upgrade all 2 to 17.2.0-rc-1 (pre-release), 16.10.5 or 16.4.7 by release line · >= 9.8-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.5; >= 17.0.0-rc-1, < 17.2.0-rc-1 · CVE-2025-54124 · GHSA-r38m-cgpg-qj69
- High, CVSS 8.7
Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder
Go github.com/gofiber/fiber/v2 · Upgrade to 2.52.9 or later · <= 2.52.8 · CVE-2025-54801 · GHSA-qx2q-88mx-vhg7
- High, CVSS 7.5
mcp-package-docs vulnerable to command injection in several tools
npm mcp-package-docs · Upgrade to 0.1.28 or later · <= 0.1.27 · CVE-2025-54073 · GHSA-vf9j-h32g-2764 · amended
- High, CVSS 7.7
RatPanel can perform remote command execution without authorization
Go github.com/tnborg/panel · Upgrade to 2.5.6 or 0.0.0-20250707071915-4985eb2e1f38 (pre-release) by release line · >= 2.3.19, < 2.5.6; >= 0.0.0-20241111062800-91ecd04c2700, < 0.0.0-20250707071915-4985eb2e1f38 · CVE-2025-53534 · GHSA-fm3m-jrgm-5ppg
- High, CVSS 7.9
js-toml Prototype Pollution Vulnerability
npm js-toml · Upgrade to 1.0.2 or later · < 1.0.2 · CVE-2025-54803 · GHSA-65fc-cr5f-v7r2 · amended
- Critical, CVSS 9.8
pyLoad CNL Blueprint allows Path Traversal through
dlc_pathwhich leads to Remote Code Execution (RCE)PyPI pyload-ng · Upgrade to 0.5.0b3.dev90 (pre-release) or later · <= 0.5.0b3.dev89 · CVE-2025-54802 · GHSA-48rp-jc79-2264 · amended
- High, CVSS 7.5
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
PyPI copyparty · Upgrade to 1.18.9 or later · <= 1.18.8 · CVE-2025-54796 · GHSA-5662-2rj7-f2v6 · amended
- High, CVSS 8.7
Claude Code echo command allowed bypass of user approval prompt for command execution
npm @anthropic-ai/claude-code · Upgrade to 1.0.20 or later · < 1.0.20 · CVE-2025-54795 · GHSA-x56v-x2h6-7j34 · amended
- High, CVSS 7.7
Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access
npm @anthropic-ai/claude-code · Upgrade to 0.2.111 or later · < 0.2.111 · CVE-2025-54794 · GHSA-pmw4-pwvc-3hx2 · amended
- Critical, CVSS 10.0
The ADOdb sqlite3 driver allows SQL injection
Packagist adodb/adodb-php · Upgrade to 5.22.10 or later · <= 5.22.9 · CVE-2025-54119 · GHSA-vf2r-cxg9-p7rf
- Critical, CVSS 9.4
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
npm @nestjs/devtools-integration · Upgrade to 0.2.1 or later · <= 0.2.0 · CVE-2025-54782 · GHSA-85cg-cmq5-qjm7 · amended
- Critical, CVSS 9.1
Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration
Go github.com/hashicorp/vault · Upgrade to 1.20.1 or later · >= 0.8.0, < 1.20.1 · CVE-2025-6000 · GHSA-mr4h-qf9j-f665
- High, CVSS 7.2
Hashicorp Vault has Privilege Escalation Vulnerability
Go github.com/hashicorp/vault · Upgrade to 1.20.0 or later · >= 0.10.4, < 1.20.0 · CVE-2025-5999 · GHSA-6h4p-m86h-hhgh
- High, CVSS 8.1
1Panel agent certificate verification bypass leading to arbitrary command execution
Go github.com/1Panel-dev/1Panel/core · Upgrade to 2.0.6 or 0.0.0-20250730021757-04b9cbd87a15 (pre-release) by release line · >= 1.0.0, < 2.0.6; < 0.0.0-20250730021757-04b9cbd87a15 · CVE-2025-54424 · GHSA-8j63-96wh-wh3j
- High, CVSS 7.3
Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution
Go github.com/traefik/traefik/v3 · Upgrade to 3.5.0 or 3.4.5 by release line · <= 3.4.4; >= 3.5.0-rc1, <= 3.5.0-rc2 · +1 more package · CVE-2025-54386 · GHSA-q6gg-9f92-r9wg
- High, CVSS 8.4
OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size
PyPI openexr · Upgrade to 3.3.3 or later · >= 3.3.0, < 3.3.3 · CVE-2025-48071 · GHSA-h45x-qhg2-q375 · amended
- High, CVSS 7.0
@nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE
npm @nyariv/sandboxjs · Upgrade to 0.8.24 or later · < 0.8.24 · CVE-2025-34146 · GHSA-9qm3-6qrr-c76m · amended
- Critical, CVSS 9.1
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion
Go github.com/oauth2-proxy/oauth2-proxy/v7 · Upgrade to 7.11.0 or later · <= 7.10.0 · CVE-2025-54576 · GHSA-7rh7-c77v-6434
- High, CVSS 7.1
GitProxy Hidden Commits Injection
npm @finos/git-proxy · Upgrade to 1.19.2 or later · <= 1.19.1 · CVE-2025-54586 · GHSA-v98g-8rqx-g93g · amended
- High, CVSS 8.2
GitProxy New Branch Approval Exploit
npm @finos/git-proxy · Upgrade to 1.19.2 or later · <= 1.19.1 · CVE-2025-54585 · GHSA-39p2-8hq9-fwj6 · amended
- High, CVSS 7.0
GitProxy Backfile Parsing Exploit
npm @finos/git-proxy · Upgrade to 1.19.2 or later · <= 1.19.1 · CVE-2025-54584 · GHSA-xxmh-rf63-qwjv · amended
- High, CVSS 8.3
GitProxy Approval Bypass When Pushing Multiple Branches
npm @finos/git-proxy · Upgrade to 1.19.2 or later · <= 1.19.1 · CVE-2025-54583 · GHSA-qr93-8wwf-22g4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.