Critical, CVSS 9.3
laravel-auth0 SDK Deserialization of Untrusted Data vulnerability
Packagist auth0/login · Upgrade to 7.2.2 or later · >= 7.0.0-BETA1, <= 7.2.1 · GHSA-c42h-56wx-h85q
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability
Packagist auth0/symfony · Upgrade to 5.1.0 or later · >= 5.0.0-BETA0, <= 5.0.0 · GHSA-98j6-67v3-mw34
- Critical, CVSS 9.8
llama_index vulnerable to SQL Injection
PyPI llama-index · Upgrade to 0.12.28 or later · < 0.12.28 · CVE-2025-1793 · GHSA-v3c8-3pr6-gr7p · amended
- Critical, CVSS 9.3
Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data
Packagist auth0/wordpress · Upgrade to 5.1.0 or later · >= 5.0.0-BETA0, <= 5.0.1 · GHSA-862m-5253-832r
- High, CVSS 8.7
Multer vulnerable to Denial of Service via unhandled exception
npm multer · Upgrade to 2.0.1 or later · >= 1.4.4-lts.1, < 2.0.1 · CVE-2025-48997 · GHSA-g5hg-p3ph-g8qg · amended
- High, CVSS 7.5
AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
PyPI astrbot · Upgrade to 3.5.13 or later · >= 3.4.4, <= 3.5.12 · CVE-2025-48957 · GHSA-cq37-g2qp-3c2p · amended
- High, CVSS 7.7
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
npm @auth0/nextjs-auth0 · Upgrade to 4.6.1 or later · >= 4.0.1, <= 4.6.0 · CVE-2025-48947 · GHSA-f3fg-mf2q-fj3f · amended
- High, CVSS 7.3
Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
PyPI jupyter-core · Upgrade to 5.8.1 or later · < 5.8.1 · CVE-2025-30167 · GHSA-33p9-3p43-82vq
- High, CVSS 7.7
Deno's AES GCM authentication tags are not verified
crates.io deno · Upgrade to 2.1.7 or later · >= 1.46.0, < 2.1.7 · +1 more package · CVE-2025-24015 · GHSA-2x3r-hwv5-p32x
- Critical, CVSS 9.3
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Packagist auth0/auth0-php · Upgrade to 8.3.1 or later · >= 8.0.0-BETA3, < 8.3.1 · CVE-2025-48951 · GHSA-v9m8-9xxp-q492
- Critical, CVSS 9.8
billboard.js allows prototype pollution via the function generate
npm billboard.js · Upgrade to 3.15.1 or later · < 3.15.1 · CVE-2025-49223 · GHSA-65p9-j6pg-72hj · amended
- High, CVSS 8.7
tar-fs can extract outside the specified dir with a specific tarball
npm tar-fs · Upgrade to 3.0.9, 2.1.3 or 1.16.5 by release line · < 1.16.5; >= 2.0.0, < 2.1.3; >= 3.0.0, < 3.0.9 · CVE-2025-48387 · GHSA-8cj5-5rvv-wf4v · amended
- High, CVSS 7.5
quic-go Has Panic in Path Probe Loss Recovery Handling
Go github.com/quic-go/quic-go · Upgrade to 0.50.1 or later · >= 0.50.0, < 0.50.1 · CVE-2025-29785 · GHSA-j972-j939-p2v3
- Critical, CVSS 9.8
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
PyPI llama-index +1 · Upgrade all 2 to 0.12.21 or later · >= 0.12.19, < 0.12.21 · CVE-2025-1750 · GHSA-6mcc-q3mg-3qg6 · amended
- High, CVSS 8.3
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions
Go github.com/grafana/grafana · Upgrade to 0.0.0-20250521183405-c7a690348df7 (pre-release) or later · >= 0.0.0-20250114093457-36d6fad421fb, < 0.0.0-20250521183405-c7a690348df7 · CVE-2025-3260 · GHSA-3px7-c4j3-576r
- Critical, CVSS 9.9Exploited · CISA KEV
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
Packagist roundcube/roundcubemail · Upgrade to 1.6.11 or 1.5.10 by release line · < 1.5.10; >= 1.6.0, < 1.6.11 · CVE-2025-49113 · GHSA-8j8w-wwqc-x596
- High, CVSS 7.1
Apache Superset: Improper authorization bypass on row level security via SQL Injection
PyPI apache-superset · Upgrade to 4.1.2 or later · < 4.1.2 · CVE-2025-48912 · GHSA-8w7f-8pr9-xgwj · amended
- High, CVSS 8.6
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Maven org.springframework.cloud:spring-cloud-gateway-server · Upgrade to 4.2.3, 4.1.8 or 3.1.10 by release line; some affected versions have no fix yet · >= 4.2.0, < 4.2.3; >= 4.1.0, < 4.1.8; >= 4.0.0, <= 4.0.9; < 3.1.10 · +1 more package · CVE-2025-41235 · GHSA-6j2q-c73v-97c5
- High, CVSS 7.4
Navidrome Transcoding Permission Bypass Vulnerability Report
Go github.com/navidrome/navidrome · Upgrade to 0.56.0 or later · <= 0.55.2 · CVE-2025-48948 · GHSA-f238-rggp-82m3
- High, CVSS 8.9
Navidrome allows SQL Injection via role parameter
Go github.com/navidrome/navidrome · Upgrade to 0.56.0 or later · >= 0.55.0, <= 0.55.2 · CVE-2025-48949 · GHSA-5wgp-vjxm-3x2r
- High, CVSS 8.7
PHPOffice Math allows XXE when processing an XML file in the MathML format
Packagist phpoffice/math · Upgrade to 0.3.0 or later · <= 0.2.0 · CVE-2025-48882 · GHSA-42hm-pq2f-3r7m
- Critical, CVSS 9.1
Fabio allows HTTP clients to manipulate custom headers it adds
Go github.com/fabiolb/fabio · Upgrade to 1.6.6 or later · <= 1.6.5 · CVE-2025-48865 · GHSA-q7p4-7xjv-j3wf
- High, CVSS 8.8
Apache Commons Improper Access Control vulnerability
Maven commons-beanutils:commons-beanutils · Upgrade to 1.11.0 or later · >= 1.0, <= 1.10.1 · +1 more package · CVE-2025-48734 · GHSA-wxr5-93ph-8wr9
- High, CVSS 7.0
Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin
PyPI redshift-connector · Upgrade to 2.1.7 or later · >= 2.0.872, <= 2.1.6 · CVE-2025-5279 · GHSA-r244-wg5g-6w2r · amended
- High, CVSS 7.3
Contrast workload secrets leak to logs on INFO level
Go github.com/edgelesssys/contrast · Upgrade to 1.8.1 or later · <= 1.8.0 · GHSA-h5f8-crrq-4pw8
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.