High, CVSS 8.8
jooby-pac4j: deserialization of untrusted data
Maven io.jooby:jooby-pac4j · Upgrade to 3.7.0 or 2.17.0 by release line · < 2.17.0; >= 3.0.0.M1, < 3.7.0 · CVE-2025-31129 · GHSA-7c5v-895v-w4q5
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Rancher: Restricted Administrator can change Administrator's passwords
Go github.com/rancher/rancher · Upgrade to 2.10.4, 2.9.8 or 2.8.14 by release line · >= 2.8.0, < 2.8.14; >= 2.9.0, < 2.9.8; >= 2.10.0, < 2.10.4 · CVE-2025-23391 · GHSA-8p83-cpfg-fj3g
- Critical, CVSS 9.3
Apache Pinot Vulnerable to Authentication Bypass
Maven org.apache.pinot:pinot-controller +2 · Upgrade all 3 to 1.3.0 or later · >= 0.8.0, < 1.3.0 · CVE-2024-56325 · GHSA-6jwp-4wvj-6597
- Critical, CVSS 10.0
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
Maven org.apache.parquet:parquet-avro · Upgrade to 1.15.1 or later · < 1.15.1 · CVE-2025-30065 · GHSA-2c59-37c4-qrx5
- High, CVSS 8.1
Drupal OAuth2 Server Missing Authorization vulnerability
Packagist drupal/oauth2_server · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2025-31691 · GHSA-4f8q-mwgc-3mwc
- High, CVSS 7.2
Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing
Packagist drupal/tfa · Upgrade to 1.10.0 or later · < 1.10.0 · CVE-2025-31694 · GHSA-hf6c-fgp3-jfch
- High, CVSS 8.1
Drupal Authenticator Login Missing Authorization vulnerability
Packagist drupal/alogin · Upgrade to 2.0.6 or later · < 2.0.6 · CVE-2025-31681 · GHSA-jwpx-6c4p-q4jq
- High, CVSS 7.2
Drupal Open Social Missing Authorization vulnerability
Packagist goalgorilla/open_social · Upgrade to 12.4.10 or 12.3.11 by release line · < 12.3.11; >= 12.4.0, < 12.4.10 · CVE-2025-31686 · GHSA-m9w8-wxvp-c9gv
- High, CVSS 7.7
Redoc Prototype Pollution via
Module.mergeObjectsComponentnpm redoc · Upgrade to 2.4.0 or later · < 2.4.0 · CVE-2024-57083 · GHSA-9rhg-254w-fh9x · amended
- High, CVSS 7.5
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
npm tar-fs · Upgrade to 3.0.7, 2.1.2 or 1.16.4 by release line · < 1.16.4; >= 2.0.0, < 2.1.2; >= 3.0.0, < 3.0.7 · CVE-2024-12905 · GHSA-pq67-2wwv-3xjx · amended
- High, CVSS 7.5
Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow
Go github.com/NethermindEth/juno · Upgrade to 0.12.5 or later · < 0.12.5 · CVE-2025-29072 · GHSA-wq32-8rp4-w2mc
- High, CVSS 8.1
Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks
PyPI mesop · Upgrade to 0.14.1 or later · < 0.14.1 · CVE-2025-30358 · GHSA-f3mf-hm6v-jfhh · amended
- High, CVSS 7.1
Synapse vulnerable to federation denial of service via malformed events
PyPI matrix-synapse · Upgrade to 1.127.1 or later · < 1.127.1 · CVE-2025-30355 · GHSA-v56r-hwv5-mxg6 · amended
- High, CVSS 8.6
Directus's webhook trigger flows can leak sensitive data
npm directus · Upgrade to 11.5.0 or later · >= 9.12.0, < 11.5.0 · CVE-2025-30353 · GHSA-fm3h-p9wm-h74h · amended
- High, CVSS 8.0
Frappe vulnerable to information disclosure leading to account takeover
PyPI frappe · Upgrade to 15.51.0 or 14.89.0 by release line · < 14.89.0; >= 15.0.0, < 15.51.0 · CVE-2025-30214 · GHSA-qrv3-jc3h-f3m6 · amended
- Critical, CVSS 9.8
ingress-nginx admission controller RCE escalation
Go k8s.io/ingress-nginx · Upgrade to 1.12.1 or 1.11.5 by release line · < 1.11.5; >= 1.12.0-beta.0, < 1.12.1 · CVE-2025-1974 · GHSA-mgvx-rpfc-9mpv
- High, CVSS 8.8
ingress-nginx controller - configuration injection via unsanitized mirror annotations
Go k8s.io/ingress-nginx · Upgrade to 1.12.1 or 1.11.5 by release line · < 1.11.5; >= 1.12.0-beta.0, < 1.12.1 · CVE-2025-1098 · GHSA-vg63-w3p9-jc9m
- High, CVSS 8.8
ingress-nginx controller - configuration injection via unsanitized auth-url annotation
Go k8s.io/ingress-nginx · Upgrade to 1.12.1 or 1.11.5 by release line · < 1.11.5; >= 1.12.0-beta.0, < 1.12.1 · CVE-2025-24514 · GHSA-fwwp-xcxw-39vq
- High, CVSS 8.8
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation
Go k8s.io/ingress-nginx · Upgrade to 1.12.1 or 1.11.5 by release line · < 1.11.5; >= 1.12.0-beta.0, < 1.12.1 · CVE-2025-1097 · GHSA-823x-fv5p-h7hw
- High, CVSS 7.5
Apache Commons VFS Has Relative Path Traversal Vulnerability
Maven org.apache.commons:commons-vfs2 · Upgrade to 2.10.0 or later · < 2.10.0 · CVE-2025-27553 · GHSA-9q4x-fr4m-jp86
- High, CVSS 7.8
nossrf Server-Side Request Forgery (SSRF)
npm nossrf · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2025-2691 · GHSA-vm77-mr48-27wj · amended
- Critical, CVSS 9.8
InvokeAI Deserialization of Untrusted Data vulnerability
PyPI invokeai · Upgrade to 5.4.3rc2 (pre-release) or later · >= 5.3.1, < 5.4.3rc2 · CVE-2024-12029 · GHSA-mcrp-whpw-jp68 · amended
- High, CVSS 8.7
Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form
crates.io redlib · Upgrade to 0.36.0 or later · < 0.36.0 · CVE-2025-30160 · GHSA-g8vq-v3mg-7mrg
- Critical, CVSS 9.1
Authorization Bypass in Next.js Middleware
npm next · Upgrade to 15.2.3, 14.2.25, 13.5.9 or 12.3.5 by release line · >= 13.0.0, < 13.5.9; >= 14.0.0, < 14.2.25; >= 15.0.0, < 15.2.3; >= 12.0.0, < 12.3.5 · CVE-2025-29927 · GHSA-f82v-jwr5-mffw · amended
- High, CVSS 7.5
Mattermost Fails to Enforce MFA on Plugin Endpoints
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 10.5.1, 10.4.3, 10.3.4 or 9.11.9 by release line · >= 10.4.0, < 10.4.3; >= 10.3.0, < 10.3.4; >= 9.11.0, < 9.11.9; >= 10.5.0, <= 10.5.0 · CVE-2025-25068 · GHSA-72qv-j8vr-xvfv
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.