High, CVSS 8.7
Chall-Manager's scenario decoding process does not check for zip bombs
Go github.com/ctfer-io/chall-manager · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2025-53633 · GHSA-r7fm-3pqm-ww5w
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive
Go github.com/ctfer-io/chall-manager · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2025-53632 · GHSA-3gv2-v3jx-r9fh
- High, CVSS 8.7
DynamicPageList3 vulnerability exposes hidden/suppressed usernames
Packagist universal-omega/dynamic-page-list3 · Upgrade to 3.6.4 or later · < 3.6.4 · CVE-2025-53625 · GHSA-7pgw-q3qp-6pgq
- Critical, CVSS 10.0
docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token
npm docusaurus-plugin-content-gists · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2025-53624 · GHSA-qf34-qpr4-5pph · amended
- High, CVSS 8.0
Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page
Maven org.jenkins-ci.plugins:applitools-eyes · Upgrade to 1.16.6 or later · <= 1.16.5 · CVE-2025-53658 · GHSA-j4wf-9gx8-63f8
- Critical, CVSS 9.2
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
npm @builder.io/qwik-city · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2025-53620 · GHSA-qr9h-j6xg-2j72 · amended
- High, CVSS 7.5
@clerk/backend Performs Insufficient Verification of Data Authenticity
npm @clerk/backend · Upgrade to 2.4.0 or later · >= 2.0.0, < 2.4.0 · +8 more packages · CVE-2025-53548 · GHSA-9mp4-77wg-rwx9 · amended
- High, CVSS 8.8
Juju allows arbitrary executable uploads via authenticated endpoint without authorization
Go github.com/juju/juju · Upgrade to 0.0.0-20250619215741-4034aa13c7cf (pre-release) or later · < 0.0.0-20250619215741-4034aa13c7cf · CVE-2025-0928 · GHSA-4vc8-wvhw-m5gv
- Critical, CVSS 9.6
mcp-remote exposed to OS command injection via untrusted MCP server connections
npm mcp-remote · Upgrade to 0.1.16 or later · >= 0.0.5, < 0.1.16 · CVE-2025-6514 · GHSA-6xpm-ggf7-wc3p · amended
- High, CVSS 8.8
Juju zip slip vulnerability via authenticated endpoint
Go github.com/juju/juju · Upgrade to 0.0.0-20250619215741-6356e984b82a (pre-release) or later · < 0.0.0-20250619215741-6356e984b82a · CVE-2025-53513 · GHSA-24ch-w38v-xmh8
- High, CVSS 7.7
Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt
Go github.com/cosmos/cosmos-sdk · Upgrade to 0.53.3 or 0.50.14 by release line · < 0.50.14; >= 0.52.0-alpha.1, < 0.53.3 · GHSA-p22h-3m2v-cmgh
- High, CVSS 8.5
Helm vulnerable to Code Injection through malicious chart.yaml content
Go helm.sh/helm/v3 · Upgrade to 3.18.4 or 3.17.4 by release line · >= 3.18.0-rc.1, < 3.18.4; < 3.17.4 · CVE-2025-53547 · GHSA-557j-xg8c-q2mm
- High, CVSS 7.5
MCP Server Kubernetes vulnerable to command injection in several tools
npm mcp-server-kubernetes · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2025-53355 · GHSA-gjv4-ghm7-q58q · amended
- High, CVSS 8.9
Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary
Go github.com/babylonlabs-io/babylon/v2 · Upgrade to 2.1.0 or later · >= 2.0.0, < 2.1.0 · GHSA-rj53-j6jw-7f7g
- High, CVSS 7.5
Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection
npm node-code-sandbox-mcp · Upgrade to 1.3.0 or later · <= 1.2.0 · CVE-2025-53372 · GHSA-5w57-2ccq-8w95 · amended
- High, CVSS 7.5
LlamaIndex vulnerable to Path Traversal attack through its encode_image function
PyPI llama-index +1 · Upgrade all 2 to 0.12.41 or later · >= 0.12.27, < 0.12.41 · CVE-2025-6209 · GHSA-2rhq-96q8-4vjq · amended
- High, CVSS 7.5
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class
PyPI llama-index · Upgrade to 0.12.28 or later · >= 0.12.23, < 0.12.28 · +1 more package · CVE-2025-3046 · GHSA-fmrf-6jv9-qjc7 · amended
- High, CVSS 7.5
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser
PyPI llama-index-readers-papers · Upgrade to 0.3.2 or later · < 0.3.2 · +1 more package · CVE-2025-3225 · GHSA-w42r-mrx7-c633 · amended
- High, CVSS 8.7
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
PyPI mcp · Upgrade to 1.9.4 or later · < 1.9.4 · CVE-2025-53366 · GHSA-3qhf-m339-9g5v · amended
- High, CVSS 8.7
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service
PyPI mcp · Upgrade to 1.10.0 or later · < 1.10.0 · CVE-2025-53365 · GHSA-j975-95f5-7wqh · amended
- High, CVSS 8.6
Citizen Short Description stored XSS vulnerability through wikitext
Packagist starcitizentools/short-description · Upgrade to 4.0.1 or later · >= 4.0.0, < 4.0.1 · CVE-2025-53369 · GHSA-p85q-mww9-gwqf
- High, CVSS 8.6
Citizen vulnerable to Stored XSS through short descriptions
Packagist starcitizentools/citizen-skin · Upgrade to 3.4.0 or later · >= 1.9.4, < 3.4.0 · CVE-2025-53370 · GHSA-prmv-7r8c-794g
- High, CVSS 7.5
Next.JS vulnerability can lead to DoS via cache poisoning
npm next · Upgrade to 15.1.8 or later · >= 15.0.4-canary.51, < 15.1.8 · CVE-2025-49826 · GHSA-67rr-84xm-4c7r · amended
- High, CVSS 8.6
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
Packagist starcitizentools/citizen-skin · Upgrade to 3.4.0 or later · >= 1.9.4, < 3.4.0 · CVE-2025-53368 · GHSA-rq6g-6g94-jfr4
- High, CVSS 7.3
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix
npm @modelcontextprotocol/server-filesystem · Upgrade to 2025.7.1; some affected versions have no fix yet · <= 0.6.2; >= 2025.1.14, < 2025.7.1 · CVE-2025-53110 · GHSA-hc55-p739-j48w · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.