High, CVSS 7.5
vproxy Divide by Zero DoS Vulnerability
crates.io vproxy · Upgrade to 2.4.0 or later · <= 2.3.3 · CVE-2025-54581 · GHSA-7h24-c332-p48c
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.1
Bacula-web SQL Injection Vulnerability
Packagist bacula-web/bacula-web · Upgrade to 9.7.1 or later · < 9.7.1 · CVE-2025-45346 · GHSA-hq25-vp56-qr86
- High, CVSS 7.3
Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output
PyPI couchbase +1 · Upgrade all 2 to 3.2.6 or later · < 3.2.6 · CVE-2025-52490 · GHSA-pqhp-4xfc-hjgq · amended
- High, CVSS 7.1
Bugsink path traversal via event_id in ingestion
PyPI bugsink · Upgrade to 1.7.4, 1.6.4, 1.5.5 or 1.4.3 by release line · >= 1.7.0, < 1.7.4; >= 1.6.0, < 1.6.4; >= 1.5.0, < 1.5.5; < 1.4.3 · CVE-2025-54433 · GHSA-q78p-g86f-jg6q · amended
- Critical, CVSS 9.9
BentoML SSRF Vulnerability in File Upload Processing
PyPI bentoml · Upgrade to 1.4.19 or later · >= 1.4.0, < 1.4.19 · CVE-2025-54381 · GHSA-mrmq-3q62-6cc8 · amended
- High, CVSS 7.9
z-push/z-push-dev SQL Injection Vulnerability
Packagist z-push/z-push-dev · Upgrade to 2.7.6 or later · < 2.7.6 · CVE-2025-8264 · GHSA-w832-w3p8-cw29
- Critical, CVSS 9.8
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
Packagist codeigniter4/framework · Upgrade to 4.6.2 or later · < 4.6.2 · CVE-2025-54418 · GHSA-9952-gv64-x94c
- Critical, CVSS 9.9
smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
PyPI smolagents · Upgrade to 1.17.0 or later · < 1.17.0 · CVE-2025-5120 · GHSA-6v92-r5mx-h5fx · amended
- High, CVSS 8.8
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
npm linkifyjs · Upgrade to 4.3.2 or later · >= 4.3.1, <= 4.3.1 · CVE-2025-8101 · GHSA-95jq-xph2-cx9h · amended
- High, CVSS 8.3
HAX CMS API Lacks Authorization Checks
npm @haxtheweb/haxcms-nodejs +1 · Upgrade all 2 to 11.0.14 or later · < 11.0.14 · CVE-2025-54378 · GHSA-9jr9-8ff3-m894 · amended
- Critical, CVSS 9.1
tj-actions/branch-names has a Command Injection Vulnerability
GitHub Actions tj-actions/branch-names · Upgrade to 9.0.0 or later · <= 8.2.1 · CVE-2025-54416 · GHSA-gq52-6phf-x2r6
- High, CVSS 8.7
Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time
PyPI skops · Upgrade to 0.12.0 or later · < 0.12.0 · CVE-2025-54413 · GHSA-4v6w-xpmh-gfgp · amended
- High, CVSS 8.7
Skops has Inconsistent Trusted Type Validation that Enables Hidden
operatorMethods ExecutionPyPI skops · Upgrade to 0.12.0 or later · < 0.12.0 · CVE-2025-54412 · GHSA-m7f4-hrc6-fwg3 · amended
- High, CVSS 8.6
XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 17.3.0-rc-1 (pre-release) or 16.10.6 by release line · >= 1.0, < 16.10.6; >= 17.0.0-rc1, < 17.3.0-rc-1 · CVE-2025-54385 · GHSA-p9qm-p942-q3w5
- Critical, CVSS 9.3
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
Maven org.xwiki.platform:xwiki-platform-distribution-war · Upgrade to 17.3.0-rc-1 (pre-release) or 16.10.6 by release line · >= 9.4-rc-1, < 16.10.6; >= 17.0.0-rc-1, < 17.3.0-rc-1 · CVE-2025-32429 · GHSA-vr59-gm53-v7cq
- High, CVSS 7.5
ImageMagick has XMP profile write that triggers hang due to unbounded loop
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.7.0 or later · < 14.7.0 · CVE-2025-53015 · GHSA-vmhh-8rxq-fp9g
- High, CVSS 7.8
FastAPI Guard has a regex bypass
PyPI fastapi-guard · Upgrade to 3.0.2 or later · >= 3.0.1, <= 3.0.1 · CVE-2025-54365 · GHSA-rrf6-pxg8-684g · amended
- High, CVSS 7.7
Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service
Go github.com/kyverno/kyverno · Upgrade to 1.14.2 or later · <= 1.14.1 · CVE-2025-47281 · GHSA-r5p3-955p-5ggq
- High, CVSS 7.5
pyLoadhas Path Traversal Vulnerability injson/uploadEndpoint that allows Arbitrary File WritePyPI pyload-ng · Upgrade to 0.5.0b3.dev90 (pre-release) or later · >= 0.5.0b3.dev89, <= 0.5.0b3.dev89 · CVE-2025-54140 · GHSA-xqpg-92fq-grfg · amended
- High, CVSS 7.5
LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE
Packagist librenms/librenms · Upgrade to 25.7.0 or later · < 25.7.0 · CVE-2025-54138 · GHSA-gq96-8w38-hhj2
- High, CVSS 7.3
NodeJS version of the HAX CMS application is distributed with Default Secrets
npm @haxtheweb/haxcms-nodejs · Upgrade to 11.0.10 or later · < 11.0.10 · CVE-2025-54137 · GHSA-5fpv-5qvh-7cf3 · amended
- High, CVSS 7.1
HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service
npm @haxtheweb/haxcms-nodejs · Upgrade to 11.0.9 or later · < 11.0.9 · CVE-2025-54134 · GHSA-pjj3-j5j6-qj27 · amended
- High, CVSS 7.2
NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting
npm @haxtheweb/haxcms-nodejs · Upgrade to 11.0.8 or later · <= 11.0.7 · CVE-2025-54128 · GHSA-59g8-h59f-8hjp · amended
- Critical, CVSS 9.3
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
npm @haxtheweb/haxcms-nodejs · Upgrade to 11.0.7 or later · <= 11.0.6 · CVE-2025-54127 · GHSA-f38f-jvqj-mfg6 · amended
- High, CVSS 8.7
RageAgainstThePixel/setup-steamcmd leaked authentication token in job output logs
GitHub Actions rageagainstthepixel/setup-steamcmd · Upgrade to 1.3.0 or later · < 1.3.0 · GHSA-c5qx-p38x-qf5w
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.