High, CVSS 8.7
buildalon/setup-steamcmd leaked authentication token in job output logs
GitHub Actions buildalon/setup-steamcmd · Upgrade to 1.1.0 or later · < 1.1.0 · GHSA-mj96-mh85-r574
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.4
form-data uses unsafe random function in form-data for choosing boundary
npm form-data · Upgrade to 4.0.4, 3.0.4 or 2.5.4 by release line · < 2.5.4; >= 3.0.0, < 3.0.4; >= 4.0.0, < 4.0.4 · CVE-2025-7783 · GHSA-fjxv-7rqg-78g4 · amended
- High, CVSS 8.0
Alchemy Non-SMA and Webauthn Account Security Advisory
npm @account-kit/smart-contracts · Upgrade to 4.52.0 or later · >= 4.42.0, <= 4.51.0 · GHSA-56r6-ccm5-8hg3 · amended
- High, CVSS 7.5
@translated/lara-mcp vulnerable to command injection in import_tmx tool
npm @translated/lara-mcp · Upgrade to 0.0.12 or later · <= 0.0.11 · CVE-2025-53832 · GHSA-xj5p-8h7g-76m7 · amended
- High, CVSS 7.6
Cadwyn vulnerable to XSS on the docs page
PyPI cadwyn · Upgrade to 5.4.3 or later · < 5.4.3 · CVE-2025-53528 · GHSA-2gxp-6r36-m97r · amended
- High, CVSS 7.2
Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access
Maven org.apache.jena:jena · Upgrade to 5.5.0 or later · < 5.5.0 · CVE-2025-50151 · GHSA-xg9p-p463-3qjp
- High, CVSS 8.3
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering
npm @nuxtjs/mdc · Upgrade to 0.17.2 or later · < 0.17.2 · CVE-2025-54075 · GHSA-cj6r-rrr9-fg82 · amended
- High, CVSS 7.5Exploited · CISA KEV
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
npm napi-postinstall · Upgrade to 0.3.2 or later · >= 0.3.1, <= 0.3.1 · +5 more packages · CVE-2025-54313 · GHSA-f29h-pxvx-f335 · amended
- High, CVSS 7.0
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
Go chainguard.dev/apko · Upgrade to 0.29.5 or later · >= 0.27.0, < 0.29.5 · CVE-2025-53945 · GHSA-x6ph-r535-3vjw
- High, CVSS 7.5
golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
Go golang.org/x/oauth2 · Upgrade to 0.27.0 or later · < 0.27.0 · CVE-2025-22868 · GHSA-6v2p-p543-phr9
- High, CVSS 7.6
Grafana is vulnerable to XSS attacks through open redirects and path traversal
Go github.com/grafana/grafana · Upgrade to 1.9.2-0.20250521205822-0ba0b99665a9 (pre-release) or later · < 1.9.2-0.20250521205822-0ba0b99665a9 · CVE-2025-6023 · GHSA-vqph-p5vc-g644
- Critical, CVSS 9.0
NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path
Go github.com/NVIDIA/k8s-device-plugin · Upgrade to 0.17.3 or later · < 0.17.3 · +3 more packages · CVE-2025-23266 · GHSA-vmg3-7v43-9g23
- High, CVSS 8.5
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook
Go github.com/NVIDIA/k8s-device-plugin · Upgrade to 0.17.3 or later · < 0.17.3 · +3 more packages · CVE-2025-23267 · GHSA-67jc-hmvg-q4c7
- High, CVSS 7.5
Multer vulnerable to Denial of Service via unhandled exception from malformed request
npm multer · Upgrade to 2.0.2 or later · >= 1.4.4-lts.1, < 2.0.2 · CVE-2025-7338 · GHSA-fjgf-rc76-4x9p · amended
- Critical, CVSS 9.2Exploited · CISA KEV
Livewire is vulnerable to remote command execution during component property update hydration
Packagist livewire/livewire · Upgrade to 3.6.4 or later · >= 3.0.0-beta.1, < 3.6.4 · CVE-2025-54068 · GHSA-29cq-5w36-x7w3
- Critical, CVSS 9.8
pyLoad vulnerable to XSS through insecure CAPTCHA
PyPI pyload-ng · Upgrade to 0.20 or later · < 0.20 · CVE-2025-53890 · GHSA-8w3f-4r8f-pf53 · amended
- Critical, CVSS 9.9
XWiki Rendering is vulnerable to RCE attacks when processing nested macros
Maven org.xwiki.rendering:xwiki-rendering-transformation-macro · Upgrade to 14.10, 14.4.7 or 13.10.11 by release line · >= 4.2-milestone-1, < 13.10.11; >= 14.0, < 14.4.7; >= 14.5, < 14.10 · CVE-2025-53836 · GHSA-32mf-57h2-64x9
- Critical, CVSS 9.0
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
Maven org.xwiki.rendering:xwiki-rendering-syntax-xhtml · Upgrade to 14.10 or later · >= 5.4.5, < 14.10 · CVE-2025-53835 · GHSA-w3wh-g4m9-783p
- Critical, CVSS 10.0
LaRecipe is vulnerable to Server-Side Template Injection attacks
Packagist binarytorch/larecipe · Upgrade to 2.8.1 or later · < 2.8.1 · CVE-2025-53833 · GHSA-jv7x-xhv2-p5v2
- Critical, CVSS 9.3
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
RubyGems job-iteration · Upgrade to 1.11 or later · < 1.11 · CVE-2025-53623 · GHSA-6qjf-g333-pv38
- High, CVSS 8.8
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
Maven org.apache.jackrabbit:jackrabbit-core +1 · Upgrade all 2 to 2.23.2-beta (pre-release), 2.22.1 or 2.20.17 by release line · >= 2.23.0-beta, < 2.23.2-beta; >= 2.20.0, < 2.20.17; >= 2.22.0, < 2.22.1 · CVE-2025-53689 · GHSA-44c3-38h8-9fh9
- High, CVSS 7.5
Apache Zeppelin exposes server resources to unauthenticated attackers
Maven org.apache.zeppelin:zeppelin-interpreter +1 · Upgrade all 2 to 0.12.0 or later · >= 0.10.1, < 0.12.0 · CVE-2024-41169 · GHSA-7pgf-ppxw-8624
- High, CVSS 7.5
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
Maven org.apache.tomcat:tomcat-coyote +1 · Upgrade all 2 to 11.0.9, 10.1.43 or 9.0.107 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100 · CVE-2025-53506 · GHSA-25xr-qj8w-c4vf
- High, CVSS 7.5
Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits
Maven org.apache.tomcat:tomcat-catalina +1 · Upgrade all 2 to 11.0.9, 10.1.43 or 9.0.107 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100 · CVE-2025-52520 · GHSA-wr62-c79q-cv37
- High, CVSS 8.7
Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout
Go github.com/ctfer-io/chall-manager · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2025-53634 · GHSA-ggmv-j932-q89q
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.