Critical, CVSS 9.4
goshs route not protected, allows command execution
Go github.com/patrickhener/goshs · Upgrade to 1.0.5 or later · >= 0.3.4, <= 1.0.4 · CVE-2025-46816 · GHSA-rwj2-w85g-5cmm
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.0
Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
PyPI vllm · Upgrade to 0.10.0 or later · >= 0.5.2, < 0.10.0 · CVE-2025-30165 · GHSA-9pcc-gvx5-r5wm · amended
- High, CVSS 7.5
PYSEC-2025-242
PyPI fastapi-guard · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2025-46814 · GHSA-77q8-qmj7-x7pp
- High, CVSS 7.1
Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Maven org.apache.parquet:parquet-avro · Upgrade to 1.15.2 or later · < 1.15.2 · CVE-2025-46762 · GHSA-53wx-pr6q-m3j5
- High, CVSS 7.8
Langroid Allows XXE Injection via XMLToolMessage
PyPI langroid · Upgrade to 0.53.4 or later · < 0.53.4 · CVE-2025-46726 · GHSA-pw95-88fg-3j6f · amended
- High, CVSS 7.8
OpenVM allows the byte decomposition of pc in AUIPC chip to overflow
crates.io openvm · Upgrade to 1.1.0 or later · >= 1.0.0, <= 1.0.0 · CVE-2025-46723 · GHSA-jf2r-x3j4-23m7
- High, CVSS 7.3
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
Packagist craftcms/cms · Upgrade to 5.6.15 or 4.14.13 by release line · >= 4.0.0-RC1, <= 4.14.12; >= 5.0.0-RC1, <= 5.6.14 · CVE-2025-46731 · GHSA-7c58-g782-9j38
- Critical, CVSS 9.3
Browser Use allows bypassing
allowed_domainsby putting a decoy domain in http auth username portion of a URLPyPI browser-use · Upgrade to 0.1.45 or later · < 0.1.45 · CVE-2025-47241 · GHSA-x39x-9qw5-ghrf · amended
- Critical, CVSS 9.1
PYSEC-2025-179
PyPI pycti · Upgrade to 6.4.11 or later · >= 6.4.8, < 6.4.11 · CVE-2025-24977 · GHSA-mf88-g2wq-p7qm
- Critical, CVSS 9.1
WSO2 API Manager XML External Entity (XXE) vulnerability
Maven org.wso2.am:am-distribution-parent · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2025-2905 · GHSA-h94w-8qhg-3xmc
- High, CVSS 7.4
OPA server Data API HTTP path injection of Rego
Go github.com/open-policy-agent/opa +2 · Upgrade all 3 to 1.4.0 or later · < 1.4.0 · CVE-2025-46569 · GHSA-6m8w-jc87-6cr7
- Critical, CVSS 10.0
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
Packagist adodb/adodb-php · Upgrade to 5.22.9 or later · <= 5.22.8 · CVE-2025-46337 · GHSA-8x27-jwjr-8545
- High, CVSS 8.2
Keycloak hostname verification
Maven org.keycloak:keycloak-services · Upgrade to 26.2.2 or later · < 26.2.2 · CVE-2025-3501 · GHSA-hw58-3793-42gg
- Critical, CVSS 9.0
org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content
Maven org.xwiki.contrib.markdown:syntax-markdown-commonmark12 · Upgrade to 8.9 or later · >= 8.2, < 8.9 · CVE-2025-46558 · GHSA-8g2j-rhfh-hq3r
- High, CVSS 8.4
Any user with view access to the XWiki space can change the authenticator
Maven org.xwiki.platform:xwiki-platform-security-authentication-ui · Upgrade to 16.10.0-rc-1 (pre-release), 16.4.6 or 15.10.14 by release line · >= 15.3-rc-1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1 · CVE-2025-46557 · GHSA-f9c6-2f9p-82jj
- High, CVSS 7.2
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin
Go volcano.sh/volcano · Upgrade to 1.12.0-alpha.2 (pre-release), 1.11.2, 1.11.0-network-topology-preview.3 (pre-release) or 2 more by release line · < 1.9.1; >= 1.10.0-alpha.0, < 1.10.2; >= 1.11.0-network-topology-preview.0, < 1.11.0-network-topology-preview.3; >= 1.11.0, < 1.11.2; >= 1.12.0-alpha.0, < 1.12.0-alpha.2 · CVE-2025-32777 · GHSA-hg79-fw4p-25p8
- High, CVSS 8.7
Homograph attack allows Unicode lookalike characters to bypass validation.
npm base-x · Upgrade to 5.0.1, 4.0.1 or 3.0.11 by release line · >= 5.0.0, <= 5.0.0; >= 4.0.0, <= 4.0.0; <= 3.0.10 · CVE-2025-27611 · GHSA-xq7p-g2vc-g82p · amended
- Critical, CVSS 9.4
ShowDoc unrestricted file upload vulnerability
Packagist showdoc/showdoc · Upgrade to 2.8.7 or later · < 2.8.7 · CVE-2025-0520 · GHSA-6jmr-r7p6-f5wr
- High, CVSS 8.5
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
Go github.com/kyverno/kyverno · Upgrade to 1.14.0 or 1.13.5 by release line · < 1.13.5; >= 1.14.0-alpha.1, < 1.14.0 · CVE-2025-46342 · GHSA-jrr2-x33p-6hvc
- Critical, CVSS 10.0
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
PyPI vllm · Upgrade to 0.8.5 or later · >= 0.6.5, < 0.8.5 · CVE-2025-32444 · GHSA-hj4w-hm2g-p6w5 · amended
- High, CVSS 7.5
Data exposure via ZeroMQ on multi-node vLLM deployment
PyPI vllm · Upgrade to 0.8.5 or later · >= 0.5.2, < 0.8.5 · CVE-2025-30202 · GHSA-9f8f-2vmf-885j · amended
- High, CVSS 7.4
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
Packagist yeswiki/yeswiki · Upgrade to 4.5.4 or later · <= 4.5.3 · CVE-2025-46347 · GHSA-88xg-v53p-fpvf
- Critical, CVSS 10.0
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
Packagist yeswiki/yeswiki · Upgrade to 4.5.4 or later · <= 4.5.3 · CVE-2025-46348 · GHSA-wc9g-6j9w-hr95
- Critical, CVSS 9.0
org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
Maven org.xwiki.platform:xwiki-platform-security-requiredrights-default · Upgrade to 16.2.0 or 15.10.8 by release line · >= 15.9-rc-1, < 15.10.8; >= 16.0.0-rc-1, < 16.2.0 · CVE-2025-32974 · GHSA-mvgm-3rw2-7j4r
- Critical, CVSS 9.0
org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
Maven org.xwiki.platform:xwiki-platform-component-wiki · Upgrade to 16.8.0-rc-1 (pre-release), 16.4.3 or 15.10.12 by release line · >= 15.9-rc-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.8.0-rc-1 · CVE-2025-32973 · GHSA-x7wv-5qg4-vmr6
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.