High, CVSS 8.7
ses's global contour bindings leak into Compartment lexical scope
npm ses · Upgrade to 1.12.0 or later · < 1.12.0 · CVE-2025-32792 · GHSA-h9w6-f932-gq62 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.9
Whoogle allows attackers to execute arbitrary code via supplying a crafted search query
PyPI whoogle-search · Upgrade to 0.9.1 or later · < 0.9.1 · CVE-2024-53305 · GHSA-2689-cw26-6cpj · amended
- Critical, CVSS 9.6
NATS Server may fail to authorize certain Jetstream admin APIs
Go github.com/nats-io/nats-server/v2 · Upgrade to 2.11.1 or 2.10.27 by release line · >= 2.11.0-RC.1, < 2.11.1; >= 2.2.0, < 2.10.27 · CVE-2025-30215 · GHSA-fhg8-qxh5-7q3w
- Critical, CVSS 9.8
Dpanel's hard-coded JWT secret leads to remote code execution
Go github.com/donknap/dpanel · Upgrade to 1.6.1 or later · < 1.6.1 · CVE-2025-30206 · GHSA-j752-cjcj-w847
- Critical, CVSS 9.9
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR
Go github.com/argoproj/argo-events · Upgrade to 1.9.6 or later · < 1.9.6 · CVE-2025-32445 · GHSA-hmp7-x699-cvhq
- High, CVSS 8.3
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
NuGet cefsharp.wpf.hwndhost +6 · Upgrade all 7 to 134.3.90 or later · < 134.3.90 · GHSA-f87w-3j5w-v58p
- Critical, CVSS 9.0
TigerVNC accessible via the network and not just via a UNIX socket as intended
PyPI jupyter-remote-desktop-proxy · Upgrade to 3.0.1 or later · >= 3.0.0, < 3.0.1 · CVE-2025-32428 · GHSA-vrq4-9hc3-cgp7 · amended
- High, CVSS 7.5
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
Go golang.org/x/crypto · Upgrade to 0.35.0 or later · < 0.35.0 · CVE-2025-22869 · GHSA-hcg3-q754-cr77
- High, CVSS 7.1
SurrealDB CPU exhaustion via custom functions result in total DoS
crates.io surrealdb · Upgrade to 2.2.2, 2.1.5 or 2.0.5 by release line · >= 2.2.0, < 2.2.2; >= 2.1.0, < 2.1.5; < 2.0.5 · GHSA-pxw4-94j3-v9pf
- High, CVSS 7.1
SurrealDB memory exhaustion via string::replace using regex
crates.io surrealdb · Upgrade to 2.2.2, 2.1.5 or 2.0.5 by release line · >= 2.2.0, < 2.2.2; >= 2.1.0, < 2.1.5; < 2.0.5 · GHSA-3633-g6mg-p6qq
- Critical, CVSS 9.4
SurrealDB server-takeover via SurrealQL injection on backup import
crates.io surrealdb · Upgrade to 2.2.2, 2.1.5 or 2.0.5 by release line · >= 2.2.0, < 2.2.2; >= 2.1.0, < 2.1.5; < 2.0.5 · CVE-2025-71392 · GHSA-ccj3-5p93-8p42
- High, CVSS 7.1
SurrealDB has uncaught exception in Net module that leads to database crash
crates.io surrealdb · Upgrade to 2.2.2, 2.1.5 or 2.0.5 by release line · >= 2.2.0, < 2.2.2; >= 2.1.0, < 2.1.5; < 2.0.5 · GHSA-rq86-9m6r-cm3g
- High, CVSS 7.1
ibexa/fieldtype-richtext allows access to external entities in XML
Packagist ibexa/fieldtype-richtext · Upgrade to 4.6.19 or later · >= 4.6.0-beta1, < 4.6.19 · GHSA-cj3w-g42v-wcj6
- High, CVSS 7.1
ezsystems/ezplatform-richtext allows access to external entities in XML
Packagist ezsystems/ezplatform-richtext · Upgrade to 2.3.26 or later · >= 2.3.0-beta1, < 2.3.26 · GHSA-2jqj-5qv2-xvcg
- Critical, CVSS 9.0Exploited · CISA KEV
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a
__classArray KeyPackagist yiisoft/yii2 · Upgrade to 2.0.52 or later · < 2.0.52 · CVE-2024-58136 · GHSA-ggwg-cmwp-46r5
- High, CVSS 8.2
tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators
crates.io tendermint-light-client-verifier · Upgrade to 0.40.3 or later · < 0.40.3 · GHSA-6jrf-4jv4-r9mw
- Critical, CVSS 9.8
BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
PyPI bentoml · Upgrade to 1.4.8 or later · >= 1.0.0a1, < 1.4.8 · CVE-2025-32375 · GHSA-7v4r-c989-xh26 · amended
- High, CVSS 8.6
crud-query-parser SQL Injection vulnerability
npm crud-query-parser · Upgrade to 0.1.0 or later · < 0.1.0 · CVE-2025-32020 · GHSA-9r25-rp3p-h2w4 · amended
- High, CVSS 8.8
Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
NuGet umbraco.cms · Upgrade to 15.3.1 or 14.3.4 by release line · >= 14.0.0--preview004, < 14.3.4; >= 15.0.0-rc1, < 15.3.1 · CVE-2025-32017 · GHSA-q62r-8ppj-xvf4
- High, CVSS 7.6
Flowise Vulnerable to SQL Injection via
tableNameParameternpm flowise-components · Upgrade to 2.2.4 or later · <= 2.2.3 · CVE-2025-29189 · GHSA-gjx9-wg9x-7gvp · amended
- Critical, CVSS 9.1
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
Packagist spiral/roadrunner · Upgrade to 2025.1.0 or later · < 2025.1.0 · CVE-2025-22871 · GHSA-g9pc-8g42-g6vq
- High, CVSS 7.5
Joomla CMS Multi-Factor Authentication Bypass
Packagist joomla/joomla-cms · Upgrade to 5.2.6 or 4.4.13 by release line · >= 5.0.0, < 5.2.6; >= 4.0.0, < 4.4.13 · CVE-2025-25227 · GHSA-6423-85cc-8gf6
- High, CVSS 7.3
Shopware Vulnerable to Blind SQL-injection in DAL aggregations
Packagist shopware/core +1 · Upgrade all 2 to 6.7.0.0-rc2 (pre-release), 6.6.10.3 or 6.5.8.18 by release line · >= 6.7.0.0-rc1, <= 6.7.0.0-rc1; >= 6.6.0.0, <= 6.6.10.2; < 6.5.8.18 · CVE-2025-27892 · GHSA-8g35-7rmw-7f59
- High, CVSS 7.5
Shopware allows Denial Of Service via password length
Packagist shopware/core +1 · Upgrade all 2 to 6.7.0.0-rc2 (pre-release), 6.6.10.3 or 6.5.8.17 by release line · >= 6.6.0.0, < 6.6.10.3; >= 6.7.0.0-rc1, < 6.7.0.0-rc2; < 6.5.8.17 · CVE-2025-30151 · GHSA-cgfj-hj93-rmh2
- High, CVSS 7.5
Apollo Compiler Named Fragment Processing Vulnerability
crates.io apollo-compiler · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2025-31496 · GHSA-7mpv-9xg6-5r79
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.