High, CVSS 7.5
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
npm @apollo/gateway · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2025-32031 · GHSA-p2q6-pwh5-m6jr · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
npm @apollo/gateway · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2025-32030 · GHSA-q2f9-x4p4-7xmh · amended
- High, CVSS 7.5
Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing
crates.io apollo-router · Upgrade to 2.1.1 or 1.61.2 by release line · < 1.61.2; >= 2.0.0-alpha.0, < 2.1.1 · CVE-2025-32380 · GHSA-3j43-9v8v-cp3f
- High, CVSS 7.5
Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow
crates.io apollo-router · Upgrade to 2.1.1 or 1.61.2 by release line · < 1.61.2; >= 2.0.0-alpha.0, < 2.1.1 · CVE-2025-32033 · GHSA-84m6-5m72-45fp
- High, CVSS 7.5
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
crates.io apollo-router · Upgrade to 2.1.1 or 1.61.2 by release line · < 1.61.2; >= 2.0.0-alpha.0, < 2.1.1 · CVE-2025-32034 · GHSA-75m2-jhh5-j5g2
- High, CVSS 7.5
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
crates.io apollo-router · Upgrade to 2.1.1 or 1.61.2 by release line · < 1.61.2; >= 2.0.0-alpha.0, < 2.1.1 · CVE-2025-32032 · GHSA-94hh-jmq8-2fgp
- High, CVSS 7.1
Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
PyPI picklescan · Upgrade to 0.0.25 or later · < 0.0.25 · CVE-2025-46417 · GHSA-93mv-x874-956g · amended
- High, CVSS 7.0
js-object-utilities Vulnerable to Prototype Pollution
npm js-object-utilities · Upgrade to 2.2.1 or later · < 2.2.1 · CVE-2025-28269 · GHSA-hpqf-m68j-2pfx · amended
- High, CVSS 8.8
Apache Airflow Common SQL Provider Vulnerable to SQL Injection
PyPI apache-airflow-providers-common-sql · Upgrade to 1.24.1 or later · < 1.24.1 · CVE-2025-30473 · GHSA-5r62-mjf5-xwhj · amended
- Critical, CVSS 9.8
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
PyPI bentoml · Upgrade to 1.4.3 or later · >= 1.3.4, < 1.4.3 · CVE-2025-27520 · GHSA-33xw-247w-6hmc · amended
- High, CVSS 8.7
MinIO performs incomplete signature validation for unsigned-trailer uploads
Go github.com/minio/minio · Upgrade to 0.0.0-20250403145552-8c70975283f9 (pre-release) or later · < 0.0.0-20250403145552-8c70975283f9 · CVE-2025-31489 · GHSA-wg47-6jq2-q2hh
- High, CVSS 7.7
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
Maven org.xwiki.contrib.jira:jira-macro-default · Upgrade to 8.5.6 or later · >= 4.2, < 8.5.6 · CVE-2025-31487 · GHSA-wc53-4255-gw3f
- High, CVSS 7.5
GraphQL grant on a property might be cached with different objects
Packagist api-platform/graphql +1 · Upgrade all 2 to 4.1.5, 4.0.22 or 3.4.17 by release line · < 3.4.17; >= 4.0.0-alpha.1, < 4.0.22; >= 4.1.0-alpha.1, < 4.1.5 · CVE-2025-31485 · GHSA-428q-q3vv-3fq3
- High, CVSS 7.5
GraphQL query operations security can be bypassed
Packagist api-platform/graphql +1 · Upgrade all 2 to 4.1.5, 4.0.22 or 3.4.17 by release line · >= 4.0.0-alpha.1, < 4.0.22; < 3.4.17; >= 4.1.0-alpha.1, < 4.1.5 · CVE-2025-31481 · GHSA-cg3c-245w-728m
- High, CVSS 7.6
generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework
npm generator-jhipster-entity-audit · Upgrade to 5.9.1 or later · < 5.9.1 · CVE-2025-31119 · GHSA-7rmp-3g9f-cvq8 · amended
- High, CVSS 7.4
jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"
PyPI jupyterlab-git · Upgrade to 0.51.1 or later · < 0.51.1 · CVE-2025-30370 · GHSA-cj5w-8mjf-r5f8 · amended
- Critical, CVSS 9.9
pgAdmin 4 Vulnerable to Remote Code Execution
PyPI pgadmin4 · Upgrade to 9.2 or later · < 9.2 · CVE-2025-2945 · GHSA-g73c-fw68-pwx3 · amended
- Critical, CVSS 9.1
pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering
PyPI pgadmin4 · Upgrade to 9.2 or later · < 9.2 · CVE-2025-2946 · GHSA-2rrx-pphc-qfv9 · amended
- Critical, CVSS 9.3
Improper Scope Validation in the
openEndpoint oftauri-plugin-shellcrates.io tauri-plugin-shell +1 · Upgrade all 2 to 2.2.1 or later · < 2.2.1 · CVE-2025-31477 · GHSA-c9pr-q8gx-3mgp · amended
- High, CVSS 8.2
canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
GitHub Actions canonical/get-workflow-version-action · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2025-31479 · GHSA-26wh-cc3r-w6pj
- High, CVSS 8.8
Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution
Maven org.jenkins-ci.plugins:templating-engine · Upgrade to 2.5.4 or later · < 2.5.4 · CVE-2025-31722 · GHSA-4vjp-327p-w4qv
- High, CVSS 8.7
image-size Denial of Service via Infinite Loop during Image Processing
npm image-size · Upgrade to 2.0.2 or 1.2.1 by release line · >= 1.1.0, < 1.2.1; >= 2.0.0, < 2.0.2 · CVE-2025-71319 · GHSA-m5qc-5hw7-8vg7 · amended
- High, CVSS 7.5
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
npm @remix-run/express · Upgrade to 2.16.3 or later · >= 2.11.1, < 2.16.3 · +1 more package · CVE-2025-31137 · GHSA-4q56-crqp-v477 · amended
- High, CVSS 8.6
Yeswiki Path Traversal vulnerability allows arbitrary read of files
Packagist yeswiki/yeswiki · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2025-31131 · GHSA-w34w-fvp3-68xm
- High, CVSS 8.9
@alizeait/unflatto Prototype Pollution
npm @alizeait/unflatto · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2024-38988 · GHSA-q8jq-4rm5-4hm5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.