Medium, CVSS 6.9
imageproc has fragile bounds check when sampling from image
crates.io imageproc · Upgrade to 0.26.2, 0.25.1 or 0.24.1 by release line · >= 0.24.0, <= 0.24.0; >= 0.25.0, <= 0.25.0; >= 0.26.0, < 0.26.2 · GHSA-5qv7-j6w5-fr4m
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6801–6825 of 30,985 matching · newest first
- Medium, CVSS 6.5
ShellHub has cross-tenant IDOR in
GET /api/namespaces/:tenantvia API Key bypasses membership checkGo github.com/shellhub-io/shellhub · Upgrade to 0.24.2 or later · <= 0.24.1 · CVE-2026-44426 · GHSA-vwx9-7qcf-gg7f
- Medium, CVSS 6.9
hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression
crates.io hickory-proto · Upgrade to 0.26.1 or later · >= 0.3.1, < 0.26.1 · CVE-2026-123608 · GHSA-q2qq-hmj6-3wpp · amended
- Medium, CVSS 6.5
Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change
Go github.com/daptin/daptin · Upgrade to 0.11.8 or later · < 0.11.8 · GHSA-258c-965c-p3hc
- High, CVSS 7.5
Talos Linux has a local privilege escalation from untrusted workloads
Go github.com/siderolabs/talos · Upgrade to 1.12.7 or later · < 1.12.7 · GHSA-m38g-vww2-mvgx
- Medium, CVSS 6.5
Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users
Go github.com/kubetail-org/kubetail/modules/dashboard · Upgrade to 0.14.0 or later · < 0.14.0 · +1 more package · CVE-2026-44514 · GHSA-v8j7-hp7c-738f
- High, CVSS 7.4
katalyst-koi: Session cookies can be replayed after user logout
RubyGems katalyst-koi · Upgrade to 5.6.0 or 4.20.0 by release line · < 4.20.0; >= 5.0.0, < 5.6.0 · CVE-2026-44511 · GHSA-4cx3-3c38-j9vv
- Medium, CVSS 6.2
go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth
Go github.com/ipld/go-ipld-prime · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-42328 · GHSA-w239-58x2-q8p5
- Medium, CVSS 5.8
CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content
RubyGems css_parser · Upgrade to 2.1.0 or 1.22.0 by release line · >= 2.0.0, < 2.1.0; < 1.22.0 · CVE-2026-44312 · GHSA-ff6c-w6qf-7xqc
- High, CVSS 8.2
Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI
Go github.com/free5gc/pcf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-42083 · GHSA-6rgm-gr97-x3j5
- Critical, CVSS 9.6
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Go github.com/argoproj/argo-cd/v3 · Upgrade to 3.3.9 or 3.2.11 by release line · >= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.9 · CVE-2026-42880 · GHSA-3v3m-wc6v-x4x3
- High, CVSS 7.5
rust-zserio has Unbounded Memory Allocation
crates.io rust-zserio · Upgrade to 0.5.4 or later · <= 0.5.3 · GHSA-fpf5-4jw8-67x8
- High, CVSS 8.6
Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
PyPI aegra-api · Upgrade to 0.9.7 or later · >= 0.9.0, < 0.9.7 · CVE-2026-44504 · GHSA-m98r-6667-4wq7 · amended
- High, CVSS 7.0
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Go github.com/microsoft/kiota-http-go · Upgrade to 1.5.5 or later · < 1.5.5 · +4 more packages · CVE-2026-44503 · GHSA-7j59-v9qr-6fq9 · amended
- Critical, CVSS 9.9
Fleet: Helm impersonation bypass of
RESTClientGetterretainscluster-adminduring template renderingGo github.com/rancher/fleet · Upgrade to 0.15.1, 0.14.5, 0.13.10 or 2 more by release line · >= 0.15.0, < 0.15.1; >= 0.14.0, < 0.14.5; >= 0.13.0, < 0.13.10; >= 0.12.0, < 0.12.14; >= 0.11.0, < 0.11.13 · CVE-2026-41050 · GHSA-765j-qfrp-hm3j
- High, CVSS 8.4
Rancher Extensions have arbitrary file access via path traversal
Go github.com/rancher/rancher · Upgrade to 2.14.1, 2.13.5, 2.12.9 or 2.11.13 by release line · >= 2.14.0, < 2.14.1; >= 2.13.0, < 2.13.5; >= 2.12.0, < 2.12.9; >= 2.10.11, < 2.11.13 · CVE-2026-25705 · GHSA-5v3h-x4wf-5c35
- High, CVSS 7.2
Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
Go github.com/aws/amazon-ecs-agent · Upgrade to 1.103.0 or later · >= 1.47.0, <= 1.102.2 · GHSA-fc67-c4hg-q653
- Critical, CVSS 9.4
Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.32.0 or later · <= 8.30.1 · CVE-2026-42596 · GHSA-4vmc-gm8v-m35h
- High, CVSS 7.5
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.32.0 or later · <= 8.31.0 · CVE-2026-42594 · GHSA-r33j-c622-r6qp
- High, CVSS 7.5
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Maven io.netty:netty-codec-http2 +1 · Upgrade all 2 to 4.2.13.Final or 4.1.133.Final by release line · >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final · CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv
- Medium, CVSS 6.8
Netty Redis Codec Encoder has a CRLF Injection Issue
Maven io.netty:netty-codec-redis · Upgrade to 4.2.13.Final or 4.1.133.Final by release line · >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final · CVE-2026-42586 · GHSA-rgrr-p7gp-5xj7
- Medium, CVSS 6.5
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding
Maven io.netty:netty-codec-http · Upgrade to 4.2.13.Final or 4.1.133.Final by release line · >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final · CVE-2026-42585 · GHSA-38f8-5428-x5cv
- High, CVSS 7.3
Netty has HttpClientCodec response desynchronization
Maven io.netty:netty-codec-http · Upgrade to 4.2.13.Final or 4.1.133.Final by release line · >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final · CVE-2026-42584 · GHSA-57rv-r2g8-2cj3
- High, CVSS 7.5
Netty Lz4FrameDecoder is vulnerable to resource exhaustion
Maven io.netty:netty-codec-compression · Upgrade to 4.2.13.Final or later · <= 4.2.12.Final · +1 more package · CVE-2026-42583 · GHSA-mj4r-2hfc-f8p6
- High, CVSS 7.5
Netty HTTP/3 QPACK literal unbounded allocation
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.13.Final or later · >= 4.2.0.Final, <= 4.2.12.Final · CVE-2026-42582 · GHSA-2c5c-chwr-9hqw
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.