High, CVSS 7.3
Below has Incorrect Permission Assignment for Critical Resource
crates.io below · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2025-27591 · GHSA-9mc5-7qhg-fp3w
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.3
Arbitrary Code Execution via Crafted Keras Config for Model Loading
PyPI keras · Upgrade to 3.9.0 or later · >= 3.0.0, < 3.9.0 · CVE-2025-1550 · GHSA-48g7-3x6r-xfhp · amended
- High, CVSS 7.0
Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 · Upgrade to 9.0.3 or 8.0.14 by release line; some affected versions have no fix yet · >= 9.0.0, <= 9.0.2; >= 8.0.0, <= 8.0.13; >= 6.0.0, <= 6.0.36 · +12 more packages · CVE-2025-24070 · GHSA-2865-hh9g-w894
- High, CVSS 8.6
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
Packagist simplesamlphp/saml2 · Upgrade to 5.0.0-alpha.20 (pre-release) or 4.17.0 by release line · >= 5.0.0-alpha.1, <= 5.0.0-alpha.19; <= 4.16.15 · +1 more package · CVE-2025-27773 · GHSA-46r4-f8gj-xg56
- High, CVSS 7.5
Mockoon has a Path Traversal and LFI in the static file serving endpoint
npm @mockoon/cli +1 · Upgrade all 2 to 9.2.0 or later · <= 9.1.0 · CVE-2025-59049 · GHSA-w7f9-wqc4-3wxr · amended
- High, CVSS 7.2
Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries
Go github.com/deislabs/ratify · Upgrade to 1.2.3 or later · < 1.2.3 · +1 more package · CVE-2025-27403 · GHSA-44f7-5fj5-h4px
- High, CVSS 8.5
Vela Server Has Insufficient Webhook Payload Data Verification
Go github.com/go-vela/server · Upgrade to 0.26.3 or 0.25.3 by release line · < 0.25.3; >= 0.26.0, <= 0.26.2 · CVE-2025-27616 · GHSA-9m63-33q3-xq5x
- High, CVSS 7.5
Local File Inclusion in Rack::Static
RubyGems rack · Upgrade to 3.1.12, 3.0.14 or 2.2.13 by release line · < 2.2.13; >= 3.0, < 3.0.14; >= 3.1, < 3.1.12 · CVE-2025-27610 · GHSA-7wqh-767x-r66v
- Critical, CVSS 9.2Exploited · CISA KEV
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Maven org.apache.tomcat:tomcat-catalina +1 · Upgrade all 2 to 11.0.3, 10.1.35 or 9.0.99 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100 · CVE-2025-24813 · GHSA-83qj-6fr2-vhqg
- High, CVSS 8.9
canvg Prototype Pollution vulnerability
npm canvg · Upgrade to 4.0.3 or 3.0.11 by release line · >= 4.0.0, < 4.0.3; < 3.0.11 · CVE-2025-25977 · GHSA-v2mw-5mch-w8c5 · amended
- Critical, CVSS 9.3
PlotAI eval vulnerability
PyPI plotai · Upgrade to 0.0.7 or later · < 0.0.7 · CVE-2025-1497 · GHSA-2hmp-5wqg-f24h · amended
- High, CVSS 8.7
Horcrux Double Sign Possibility
Go github.com/strangelove-ventures/horcrux/v3 · Upgrade to 3.3.2 or later · >= 3.1.0, < 3.3.2 · GHSA-6wxf-7784-62fp
- High, CVSS 7.5
Microsoft Security Advisory CVE-2025-24043 | WinDbg Remote Code Execution Vulnerability
NuGet dotnet-dump · Upgrade to 9.0.607501 or later · < 9.0.607501 · +2 more packages · CVE-2025-24043 · GHSA-hpw7-8qpc-34p3
- High, CVSS 7.5
com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public
Maven com.xwiki.confluencepro:application-confluence-migrator-pro-ui · Upgrade to 1.11.7 or later · <= 1.11.6 · CVE-2025-27604 · GHSA-3w9f-2pph-j5vc
- Critical, CVSS 9.1
com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations
Maven com.xwiki.confluencepro:application-confluence-migrator-pro-ui · Upgrade to 1.2.0 or later · >= 1.0, < 1.2.0 · CVE-2025-27603 · GHSA-6qvp-39mm-95v8
- High, CVSS 8.9
Vue I18n Allows Prototype Pollution in
handleFlatJsonnpm @intlify/message-resolver · Upgrade to 9.1.11 or later · >= 9.1.0, < 9.1.11 · +5 more packages · CVE-2025-27597 · GHSA-p2ph-7g93-hw3m · amended
- High, CVSS 7.7
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
npm axios · Upgrade to 1.8.2 or 0.30.0 by release line · >= 1.0.0, < 1.8.2; < 0.30.0 · CVE-2025-27152 · GHSA-jr5f-v2jv-69x6 · amended
- High, CVSS 7.5
DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api
NuGet opentelemetry.autoinstrumentation · Upgrade to 1.11.0 or later · >= 1.10.0-beta.1, < 1.11.0 · GHSA-vc29-vg52-6643
- High, CVSS 7.5
Out-of-bounds Write in SixLabors ImageSharp
NuGet sixlabors.imagesharp · Upgrade to 3.1.7 or 2.1.10 by release line · >= 3.0.0, < 3.1.7; < 2.1.10 · CVE-2025-27598 · GHSA-2cmq-823j-5qj8
- Critical, CVSS 9.3
Fleet has SAML authentication vulnerability due to improper SAML response validation
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.64.2, 4.63.2, 4.62.4 or 2 more by release line · >= 4.64.0, < 4.64.2; >= 4.63.0, < 4.63.2; >= 4.62.0, < 4.62.4; >= 4.54.0, < 4.58.1; < 4.53.2 · CVE-2025-27509 · GHSA-52jx-g6m5-h735
- High, CVSS 7.5
Emissary May Use a Broken or Risky Cryptographic Algorithm
Maven gov.nsa.emissary:emissary · Upgrade to 8.24.0 or later · <= 8.23.0 · CVE-2025-27508 · GHSA-hw43-fcmm-3m5g
- High, CVSS 8.9
Spacy-LLM Server-Side Template Injection (SSTI) vulnerability
PyPI spacy-llm · Upgrade to 0.7.3 or later · <= 0.7.2 · CVE-2025-25362 · GHSA-793v-gxfp-9q9h · amended
- Critical, CVSS 9.3
Volt Allows RCE Via User-Crafted Requests
Packagist livewire/volt · Upgrade to 1.7.0 or later · < 1.7.0 · CVE-2025-27517 · GHSA-v69f-5jxm-hwvv
- High, CVSS 8.7
OpenDJ Denial of Service (DoS) using alias loop
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 4.9.3 or later · < 4.9.3 · CVE-2025-27497 · GHSA-93qr-h8pr-4593
- Critical, CVSS 10.0
Lucee RCE/XXE Vulnerability
Maven org.lucee:lucee · Upgrade to 5.4.3.2, 5.3.12.1, 5.3.9.173 or 5.3.8.236 by release line; some affected versions have no fix yet · >= 5.3.10.79-RC, < 5.3.12.1; >= 5.4.0.65-RC, < 5.4.3.2; <= 5.3.7.59; >= 5.3.8.132-RC, < 5.3.8.236; >= 5.3.9.113, < 5.3.9.173 · CVE-2023-38693 · GHSA-vwjx-mmwm-pwrf
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.