High, CVSS 8.1
Salt has minion event bus authorization bypass vulnerability
PyPI salt · Upgrade to 3007.4 or 3006.12 by release line · >= 3007.0, < 3007.4; >= 3006.0, < 3006.12 · CVE-2025-22236 · GHSA-jh7c-xh74-h76f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
XWiki allows SQL injection in query endpoint of REST API with Oracle
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 16.10.2, 16.4.7 or 15.10.16 by release line · >= 1.0, < 15.10.16; >= 16.0.0-rc-1, < 16.4.7; >= 16.5.0-rc-1, < 16.10.2 · CVE-2024-56158 · GHSA-prwh-7838-xf82
- High, CVSS 7.5
Drupal Admin Audit Trail Allocation of Resources Without Limits or Throttling vulnerability
Packagist drupal/admin_audit_trail · Upgrade to 1.0.5 or later · < 1.0.5 · CVE-2025-48448 · GHSA-pwj7-5c7c-mwjc
- High, CVSS 8.8
Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability
Packagist drupal/commerce_alphabank_redirect · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2025-48446 · GHSA-48wx-8736-jgx2
- High, CVSS 8.8
Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability
Packagist drupal/commerce_eurobank_redirect · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2025-48445 · GHSA-q9h3-r6wr-p3j3
- High, CVSS 8.1
Hashicorp Nomad Incorrect Privilege Assignment vulnerability
Go github.com/hashicorp/nomad · Upgrade to 1.10.2 or later · < 1.10.2 · CVE-2025-4922 · GHSA-rx97-6c62-55mf
- High, CVSS 7.5
Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 9.0.6 or 8.0.17 by release line · >= 9.0.0, <= 9.0.5; >= 8.0.0, <= 8.0.16 · CVE-2025-30399 · GHSA-266m-wp2v-x7mq
- High, CVSS 8.2
pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
Maven org.postgresql:postgresql · Upgrade to 42.7.7 or later · >= 42.7.4, < 42.7.7 · CVE-2025-49146 · GHSA-hq9p-pm7w-8p54
- High, CVSS 7.5
GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx
Maven org.geoserver:gs-wfs · Upgrade to 2.25.2 or 2.24.4 by release line · >= 1.0.0, < 2.24.4; >= 2.25.0, < 2.25.2 · GHSA-68cf-j696-wvv9
- High, CVSS 8.2
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Maven org.geonetwork-opensource:gn-web-app +1 · Upgrade all 2 to 4.4.8 or 4.2.13 by release line · >= 4.4.0, <= 4.4.7; >= 4.2.0, <= 4.2.12 · GHSA-2p76-gc46-5fvc
- High, CVSS 8.2
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
Maven org.geoserver:gs-wfs +1 · Upgrade all 2 to 2.27.1, 2.26.3 or 2.25.7 by release line · >= 2.27.0, <= 2.27.0; >= 2.26.0, <= 2.26.2; <= 2.25.6 · CVE-2025-30220 · GHSA-jj54-8f66-c5pc
- High, CVSS 7.5
GeoServer Infinite Loop Vulnerability in Jiffle process
Maven org.geoserver.extension:gs-wps-core +2 · Upgrade all 3 to 2.26.3 or 2.25.7 by release line · >= 2.26.0, <= 2.26.2; <= 2.25.6 · CVE-2025-30145 · GHSA-gr67-pwcv-76gf
- High, CVSS 7.7
Erxes Incorrect Access Control vulnerability
npm erxes · Upgrade to 1.6.1 or later · < 1.6.1 · CVE-2024-57190 · GHSA-7rhv-xm4q-wh42 · amended
- High, CVSS 7.7
Erxes Path Traversal vulnerability
npm erxes · Upgrade to 1.6.2 or later · < 1.6.2 · CVE-2024-57186 · GHSA-rq9r-qvwg-829q · amended
- Critical, CVSS 9.1
Magneto contains stored XSS vulnerability
Packagist magento/community-edition · Upgrade to 2.4.8-p1 (pre-release), 2.4.7-p6 (pre-release), 2.4.6-p11 (pre-release) or 2.4.5-p13 (pre-release) by release line; some affected versions have no fix yet · >= 2.4.8-beta1, < 2.4.8-p1; >= 2.4.7-beta1, < 2.4.7-p6; < 2.4.5-p13; >= 2.4.7, <= 2.4.7; >= 2.4.8, <= 2.4.8; >= 2.4.5, <= 2.4.5; >= 2.4.6-p1, < 2.4.6-p11; >= 2.4.6, <= 2.4.6 · CVE-2025-47110 · GHSA-j934-vjh5-vf9r
- Critical, CVSS 9.3
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
Maven org.geoserver.main:gs-main +1 · Upgrade all 2 to 2.25.0 or later · < 2.25.0 · CVE-2024-34711 · GHSA-mc43-4fqr-c965
- High, CVSS 7.5
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
Maven org.geoserver:gs-wfs +1 · Upgrade all 2 to 2.25.2 or 2.24.4 by release line · >= 2.0.0, < 2.24.4; >= 2.25.0, < 2.25.2 · CVE-2024-29198 · GHSA-5gw5-jccf-6hxw
- Critical, CVSS 9.9
GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Maven org.geotools:gt-xsd-core +1 · Upgrade all 2 to 33.1, 32.3, 31.7 or 28.6.1 by release line · >= 33.0, <= 33.0; >= 32.0, < 32.3; >= 29.0, <= 31.6; < 28.6.1 · GHSA-826p-4gcg-35vw
- High, CVSS 8.5
HaxCMS-PHP Command Injection Vulnerability
npm @haxtheweb/haxcms-nodejs · Upgrade to 11.0.3 or later · < 11.0.3 · CVE-2025-49141 · GHSA-g4cf-pp4x-hqgw · amended
- High, CVSS 7.5
Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)
Go github.com/pion/interceptor · Upgrade to 0.1.39 or later · >= 0.1.36, < 0.1.39 · CVE-2025-49140 · GHSA-f26w-gh5m-qq77
- Critical, CVSS 9.8
BackendAI Missing Authentication for Critical Function
PyPI backend-ai · Upgrade to 25.19.0rc1 (pre-release) or 25.15.6 by release line · < 25.15.6; >= 25.16.0rc1, < 25.19.0rc1 · CVE-2025-49652 · GHSA-ww28-4m4v-cq4j · amended
- High, CVSS 8.5
Hax CMS Stored Cross-Site Scripting vulnerability
Packagist elmsln/haxcms · Upgrade to 11.0.0 or later · < 11.0.0 · CVE-2025-49137 · GHSA-2vc4-3hx7-v7v7
- Critical, CVSS 9.0
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
Go github.com/knadh/listmonk · Upgrade to 5.0.2 or later · >= 4.0.0, < 5.0.2 · CVE-2025-49136 · GHSA-jc7g-x28f-3v3h
- High, CVSS 7.5
CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification
Go github.com/coredns/coredns · Upgrade to 1.12.2 or later · < 1.12.2 · CVE-2025-47950 · GHSA-cvx7-x8pj-x2gw
- High, CVSS 8.1
Apache InLong Deserialization of Untrusted Data Vulnerability
Maven org.apache.inlong:inlong-manager · Upgrade to 2.1.0 or later · >= 1.13.0, < 2.1.0 · CVE-2025-27531 · GHSA-62gc-8jr5-x9pm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.