Medium, CVSS 6.1
Kanidm: Stored HTML injection in "passkey-enrolment" partial via displayname → htmx-driven authenticated request forgery
crates.io kanidm · Upgrade to 1.9.3 or later · <= 1.9.2 · GHSA-gpxg-fx2g-qxj2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6851–6875 of 30,985 matching · newest first
- Low, CVSS 2.3
webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed
crates.io webauthn-rs-core +1 · Upgrade all 2 to 0.6.1-dev (pre-release) or 0.5.5 by release line · <= 0.5.4; >= 0.6.0-dev, <= 0.6.0-dev · GHSA-22w3-693w-x895
- Medium, CVSS 5.4
ShellHub has crash-DoS via field injection in filter and sort-by parameters
Go github.com/shellhub-io/shellhub · Upgrade to 0.24.2 or later · <= 0.24.1 · CVE-2026-44425 · GHSA-47r2-v3x6-wff9
- Medium, CVSS 5.5
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening
npm @axonflow/openclaw · Upgrade to 2.0.0 or later · < 2.0.0 · GHSA-cqmh-pcgr-q42f · amended
- Medium, CVSS 6.5
ShellHub has cross-tenant IDOR in
GET /api/sessions/:uidthat discloses SSH session dataGo github.com/shellhub-io/shellhub · Upgrade to 0.24.2 or later · <= 0.24.1 · CVE-2026-44423 · GHSA-9w9c-9w8m-w89q
- Medium, CVSS 6.5
ShellHub has cross-tenant IDOR in
GET /api/devices/:uidthat discloses device data of any namespaceGo github.com/shellhub-io/shellhub · Upgrade to 0.24.2 or later · <= 0.24.1 · CVE-2026-44424 · GHSA-j72x-xfwg-783f
- Medium, CVSS 5.9
axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Maven com.getaxonflow:axonflow-sdk · Upgrade to 7.0.0 or later · < 7.0.0 · GHSA-248h-974q-xrc2
- Medium, CVSS 5.9
axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
npm @axonflow/sdk · Upgrade to 6.0.0 or later · < 6.0.0 · GHSA-mph8-9v29-pm42 · amended
- Medium, CVSS 5.9
axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Go github.com/getaxonflow/axonflow-sdk-go/v5 · Upgrade to 5.7.0 or later · < 5.7.0 · GHSA-mhc4-qq83-fmrr
- Medium, CVSS 5.9
axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
PyPI axonflow · Upgrade to 6.7.0 or later · < 6.7.0 · GHSA-7f4h-6264-89fr · amended
- Critical, CVSS 9.1
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
Go github.com/getaxonflow/axonflow · Upgrade to 7.5.0 or later · < 7.5.0 · GHSA-9h64-2846-7x7f
- High, CVSS 7.5
Netty epoll transport denial of service via RST on half-closed TCP connection
Maven io.netty:netty-transport-classes-epoll · Upgrade to 4.2.13.Final or later · >= 4.2.0.Final, < 4.2.13.Final · CVE-2026-42577 · GHSA-rwm7-x88c-3g2p
- High, CVSS 7.1
Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
PyPI keras · Upgrade to 3.13.2 or 3.12.1 by release line · >= 3.0.0, <= 3.12.0; >= 3.13.0, < 3.13.2 · CVE-2026-0897 · GHSA-mgx6-5cf9-rr43 · amended
- High, CVSS 7.5
Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
NuGet nerdbank.messagepack · Upgrade to 1.1.62 or later · < 1.1.62 · CVE-2026-44375 · GHSA-2cwq-pwfr-wcw3
- Medium, CVSS 4.3
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
npm @backstage/plugin-catalog-backend-module-unprocessed · Upgrade to 0.6.11 or later · < 0.6.11 · +2 more packages · CVE-2026-44374 · GHSA-p7g9-rp3g-mgfg · amended
- High, CVSS 7.7
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
Packagist getgrav/grav-plugin-form · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-42845 · GHSA-w4rc-p66m-x6qq
- Medium, CVSS 5.3
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
npm nitro · Upgrade to 3.0.260429-beta (pre-release) or later · < 3.0.260429-beta · +1 more package · CVE-2026-44372 · GHSA-9phm-9p8f-hw5m · amended
- Medium, CVSS 5.3
Nitro has a proxy scope bypass via percent-encoded path traversal in
routeRulesnpm nitro · Upgrade to 3.0.260429-beta (pre-release) or later · < 3.0.260429-beta · +1 more package · CVE-2026-44373 · GHSA-5w89-w975-hf9q · amended
- Medium, CVSS 6.9
pyquorum: Timing side‑channel in mul_mod
PyPI pyquorum · Upgrade to 0.2.1 or later · < 0.2.1 · CVE-2026-44368 · GHSA-7r92-3jgr-r65q · amended
- Low, CVSS 2.7
MediaMTX affected by CVE-2026-27143 due to vulnerable dependency
Go github.com/bluenviron/mediamtx · Upgrade to 1.18.0 or later · >= 1.15.0, < 1.18.0 · GHSA-2ccx-cjjh-r2j8
- Medium, CVSS 5.8
misp-modules has unsafe remote resource fetching in expansion
PyPI misp-modules · Upgrade to 3.0.8 or later · < 3.0.8 · CVE-2026-44363 · GHSA-fhq3-2gf3-8f3j · amended
- Critical, CVSS 9.1
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
npm fast-jwt · Upgrade to 6.2.4 or later · <= 6.2.3 · CVE-2026-44351 · GHSA-gmvf-9v4p-v8jc · amended
- Medium, CVSS 6.1
Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component
Go github.com/kyverno/policy-reporter-ui · Upgrade to 2.5.2 or later · <= 2.5.1 · CVE-2026-44245 · GHSA-q98m-7w8c-w388
- High, CVSS 7.1
Daptin fuzzy search injects unvalidated column name into raw SQL
Go github.com/daptin/daptin · Upgrade to 0.11.5 or later · <= 0.11.4 · CVE-2026-44349 · GHSA-pwqg-q8pg-pp6r
- High, CVSS 8.4
PraisonAI has unauthenticated RCE via
tool_override.py(CVE-2026-40287 patch bypass)PyPI praisonai · Upgrade to 4.6.32 or later · >= 4.5.139, <= 4.6.31 · CVE-2026-44334 · GHSA-xcmw-grxf-wjhj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.