High, CVSS 8.7
esm.sh: Legacy Route Path Traversal Can Lead to RCE
Go github.com/esm-dev/esm.sh · Upgrade to 0.0.0-20260508100112-1960055e1d53 (pre-release) or later · < 0.0.0-20260508100112-1960055e1d53 · CVE-2026-44593 · GHSA-3636-h3vx-6465
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6501–6525 of 30,985 matching · newest first
- Medium, CVSS 6.0
HashiCorp Nomad vulnerable to symlink attack
Go github.com/hashicorp/nomad · Upgrade to 1.11.0-rc.1.0.20260512123500-2a09fd62c238 (pre-release) or later · < 1.11.0-rc.1.0.20260512123500-2a09fd62c238 · CVE-2026-6959 · GHSA-3934-423w-4jq3
- High, CVSS 8.8
HashiCorp Nomad vulnerable to a path traversal
Go github.com/hashicorp/nomad · Upgrade to 1.11.0-rc.1.0.20260511152149-cd7240c4099a (pre-release) or later · < 1.11.0-rc.1.0.20260511152149-cd7240c4099a · CVE-2026-7474 · GHSA-hx53-77qj-8663
- Medium, CVSS 6.0
HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack
Go github.com/hashicorp/nomad-driver-exec2 · Upgrade to 0.1.2 or later · < 0.1.2 · CVE-2026-8052 · GHSA-wqwc-x3rc-2xw6
- Critical, CVSS 9.1
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
Maven com.azure:azure-security-keyvault-keys · Upgrade to 4.10.6 or later · < 4.10.6 · CVE-2026-33117 · GHSA-97jf-46m3-8953
- High, CVSS 7.5
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-41284 · GHSA-gx5v-xp9w-j4cg
- High, CVSS 7.3
Apache Tomcat - WebSocket authentication header exposure
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-42498 · GHSA-fv25-8xcx-gqjc
- Critical, CVSS 9.8
Apache Tomcat - HTTP/2 request headers not validated
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118 · CVE-2026-41293 · GHSA-r29c-68gh-xp6x
- Critical, CVSS 9.8
Apache Tomcat - Digest authenticator will authenticate any unknown user
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-43512 · GHSA-h6fc-48rj-7qqh
- Critical, CVSS 9.8
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
PyPI kubectl-mcp-server +1 · Upgrade all 2 to 1.2.0 or later · < 1.2.0 · CVE-2025-65719 · GHSA-94gr-w3q5-rfqr · amended
- High, CVSS 7.5
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-43513 · GHSA-5mp6-jrq3-r938
- Critical, CVSS 9.1
Apache Tomcat - Security constraints not correctly applied
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-43515 · GHSA-5m62-pw8w-7w9f
- Low, CVSS 3.7
Apache Tomcat - AJP secret compared in non-constant time
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-43514 · GHSA-9m89-8frq-c98c
- Critical, CVSS 9.3
OpenClaude Sandbox Bypass via Model-Controlled
dangerouslyDisableSandboxInputnpm openclaude · Upgrade to 0.5.1 or later · < 0.5.1 · CVE-2026-42074 · GHSA-m77w-p5jj-xmhg · amended
- Medium, CVSS 6.5
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
npm @gitlawb/openclaude · Upgrade to 0.5.1 or later · < 0.5.1 · CVE-2026-42073 · GHSA-c73c-x77g-854r · amended
- Critical, CVSS 9.1
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
npm sealed-env +1 · Upgrade all 2 to 0.1.0-alpha.4 (pre-release) or later · < 0.1.0-alpha.4 · CVE-2026-45091 · GHSA-x3r2-fj3r-g5mv · amended
- High, CVSS 8.2
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via
outputOptionGo github.com/hahwul/dalfox/v2 · Upgrade to 2.13.0 or later · <= 2.12.0 · CVE-2026-45089 · GHSA-8hf9-3q64-q2qf
- High, CVSS 7.5
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via
custom-payload-fileGo github.com/hahwul/dalfox/v2 · Upgrade to 2.13.0 or later · <= 2.12.0 · CVE-2026-45088 · GHSA-35wr-x7v6-9fv2
- Critical, CVSS 10.0
Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via
found-actionGo github.com/hahwul/dalfox/v2 · Upgrade to 2.13.0 or later · <= 2.12.0 · CVE-2026-45087 · GHSA-v25v-m36w-jp4h
- High, CVSS 8.7
protobuf.js: Code injection in pbjs static output from crafted schema names
npm protobufjs-cli · Upgrade to 2.0.2 or 1.2.1 by release line · <= 1.2.0; >= 2.0.0, <= 2.0.1 · CVE-2026-44295 · GHSA-6r35-46g8-jcw9 · amended
- Medium, CVSS 5.3
protobuf.js: Denial of service from crafted field names in generated code
npm protobufjs · Upgrade to 8.0.2 or 7.5.6 by release line · <= 7.5.5; >= 8.0.0, <= 8.0.1 · CVE-2026-44294 · GHSA-2pr8-phx7-x9h3 · amended
- High, CVSS 7.7
protobuf.js: Code injection through bytes field defaults in generated toObject code
npm protobufjs · Upgrade to 8.0.2 or 7.5.6 by release line · <= 7.5.5; >= 8.0.0, <= 8.0.1 · CVE-2026-44293 · GHSA-66ff-xgx4-vchm · amended
- Medium, CVSS 5.3
protobuf.js: Prototype injection in generated message constructors
npm protobufjs · Upgrade to 8.0.2 or 7.5.6 by release line · <= 7.5.5; >= 8.0.0, <= 8.0.1 · CVE-2026-44292 · GHSA-fx83-v9x8-x52w · amended
- High, CVSS 8.1
protobuf.js: Code generation gadget after prototype pollution
npm protobufjs · Upgrade to 8.0.2 or 7.5.6 by release line · <= 7.5.5; >= 8.0.0, <= 8.0.1 · CVE-2026-44291 · GHSA-75px-5xx7-5xc7 · amended
- High, CVSS 7.5
protobuf.js: Process-wide denial of service through unsafe option paths
npm protobufjs · Upgrade to 8.0.2 or 7.5.6 by release line · <= 7.5.5; >= 8.0.0, <= 8.0.1 · CVE-2026-44290 · GHSA-jvwf-75h9-cwgg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.