Critical, CVSS 9.1
Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Packagist auth0/symfony · Upgrade to 5.4.0 or later · < 5.4.0 · GHSA-9wg9-93h9-j8ch
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
Packagist auth0/auth0-php · Upgrade to 8.14.0 or later · >= 8.0.0-BETA1, < 8.14.0 · CVE-2025-47275 · GHSA-g98g-r7gf-2r25
- High, CVSS 7.5
Tornado vulnerable to excessive logging caused by malformed multipart form data
PyPI tornado · Upgrade to 6.5 or later · < 6.5 · CVE-2025-47287 · GHSA-7cx3-6m66-7c5m · amended
- High, CVSS 7.6
label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.
PyPI label-studio · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2025-47783 · GHSA-8jhr-wpcm-hh4h · amended
- High, CVSS 8.9
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
PyPI motioneye · Upgrade to 0.43.1b4 (pre-release) or later · >= 0.43.1b1, < 0.43.1b4 · CVE-2025-47782 · GHSA-g5mq-prx7-c588 · amended
- High, CVSS 8.2
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt
Go github.com/babylonlabs-io/babylon · Upgrade to 1.1.0 or later · < 1.1.0 · GHSA-869w-47c6-fq8q
- High, CVSS 8.9
Babylon Finality Provider
MsgCommitPubRandListreplay attackGo github.com/babylonlabs-io/babylon · Upgrade to 1.1.0 or later · < 1.1.0 · GHSA-7mm3-vfg8-7rg6
- Critical, CVSS 9.3
BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference
Maven io.github.bonigarcia:webdrivermanager · Upgrade to 6.1.0 or later · >= 1.0.0, < 6.1.0 · CVE-2025-4641 · GHSA-pwm3-776c-8q7q
- Critical, CVSS 9.8
Apache IoTDB Vulnerable to Remote Code Execution
PyPI apache-iotdb +1 · Upgrade all 2 to 1.3.4 or later · >= 1.0.0, < 1.3.4 · CVE-2024-24780 · GHSA-f4rq-f4j9-f6rm · amended
- High, CVSS 8.0
Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability
NuGet microsoft.build.tasks.core · Upgrade to 17.14.8, 17.13.26, 17.12.36 or 4 more by release line · >= 15.8.166, <= 15.9.20; >= 16.0.461, <= 16.11.0; >= 17.0.0, <= 17.8.3; >= 17.9.5, <= 17.10.4; >= 17.11.4, <= 17.11.4; >= 17.12.6, <= 17.12.6; >= 17.13.9, <= 17.13.9 · CVE-2025-26646 · GHSA-h4j7-5rxr-p4wc
- Critical, CVSS 9.3
OPKSSH Vulnerable to Authentication Bypass
Go github.com/openpubkey/opkssh · Upgrade to 0.5.0 or later · < 0.5.0 · CVE-2025-4658 · GHSA-56wx-66px-9j66
- Critical, CVSS 9.3
OpenPubkey Vulnerable to Authentication Bypass
Go github.com/openpubkey/openpubkey · Upgrade to 0.10.0 or later · < 0.10.0 · CVE-2025-3757 · GHSA-537f-gxgm-3jjq
- High, CVSS 7.5
OXID eShop May Display User Information
Packagist oxid-esales/oxideshop-metapackage-ce · Upgrade to 6.5.5 or later · >= 6.0.0, < 6.5.5 · +2 more packages · CVE-2024-56526 · GHSA-qqcr-9jfc-35c4
- High, CVSS 7.5
LlamaIndex Vulnerable to Denial of Service (DoS)
PyPI llama-index · Upgrade to 0.12.21 or later · >= 0.12.15, < 0.12.21 · CVE-2025-1752 · GHSA-7c85-87cp-mr6g · amended
- High, CVSS 8.3
code-server's session cookie can be extracted by having user visit specially crafted proxy URL
npm code-server · Upgrade to 4.99.4 or later · < 4.99.4 · CVE-2025-47269 · GHSA-p483-wpfp-42cj · amended
- High, CVSS 7.5
Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit
Maven org.eclipse.jetty.http2:jetty-http2-common · Upgrade to 12.0.17 or later · >= 12.0.0, <= 12.0.16 · CVE-2025-1948 · GHSA-889j-63jv-qhr8
- High, CVSS 7.2
**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request
Maven org.eclipse.jetty:jetty-server · Upgrade to 9.4.57.v20241219 or later · >= 9.4.0, <= 9.4.56 · CVE-2024-13009 · GHSA-q4rv-gq96-w7c5
- High, CVSS 7.5
Rack has an Unbounded-Parameter DoS in Rack::QueryParser
RubyGems rack · Upgrade to 3.1.14, 3.0.16 or 2.2.14 by release line · < 2.2.14; >= 3.0, < 3.0.16; >= 3.1, < 3.1.14 · CVE-2025-46727 · GHSA-gjh7-p2fx-99vx
- High, CVSS 8.0
Graylog Allows Session Takeover via Insufficient HTML Sanitization
Maven org.graylog2:graylog2-server · Upgrade to 6.1.10 or 6.0.14 by release line · <= 6.0.13; >= 6.1.0, <= 6.1.9 · CVE-2025-46827 · GHSA-76vf-mpmx-777j
- High, CVSS 7.3
Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser
Maven org.graylog2:graylog2-server · Upgrade to 6.2.0 or later · < 6.2.0 · GHSA-q9q2-3ppx-mwqf
- High, CVSS 8.6
Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling
npm passport-wsfed-saml2 · Upgrade to 4.6.4 or later · >= 3.0.5, <= 4.6.3 · CVE-2025-46573 · GHSA-8gqj-226h-gm8r · amended
- Critical, CVSS 9.3
Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping
npm passport-wsfed-saml2 · Upgrade to 4.6.4 or later · >= 3.0.5, <= 4.6.3 · CVE-2025-46572 · GHSA-wjmp-wphq-jvqf · amended
- High, CVSS 8.0
ZITADEL Allows IdP Intent Token Reuse
Go github.com/zitadel/zitadel · Upgrade to 3.0.0, 2.71.9 or 2.70.10 by release line · >= 3.0.0-rc.1, <= 3.0.0-rc.3; < 2.70.10; >= 2.71.0, <= 2.71.8 · CVE-2025-46815 · GHSA-g4r8-mp7g-85fq
- Critical, CVSS 9.4
goshs route not protected, allows command execution
Go github.com/patrickhener/goshs · Upgrade to 1.0.5 or later · >= 0.3.4, <= 1.0.4 · CVE-2025-46816 · GHSA-rwj2-w85g-5cmm
- High, CVSS 8.0
Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
PyPI vllm · Upgrade to 0.10.0 or later · >= 0.5.2, < 0.10.0 · CVE-2025-30165 · GHSA-9pcc-gvx5-r5wm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.