High, CVSS 7.4
Apache Thrift has an issue with Java TSSLTransportFactory hostname verification
Bitnami thrift +1 · Upgrade all 2 to 0.23.0 or later · < 0.23.0 · CVE-2026-41603 · GHSA-gf47-qgg5-9g9q · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7326–7350 of 31,057 matching · newest first
- High, CVSS 7.5
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability
Go github.com/apache/thrift · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-41602 · GHSA-wf45-q9ch-q8gh
- High, CVSS 8.7
Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion
npm thrift · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-41636 · GHSA-r67j-r569-jrwp · amended
- Medium, CVSS 5.9
Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
Maven org.springframework.ai:spring-ai-advisors-vector-store · Upgrade to 1.1.5 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5 · CVE-2026-40966 · GHSA-v6x6-pjxw-3pv2
- High, CVSS 8.8
Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()
Maven org.springframework.ai:spring-ai-azure-cosmos-db-store · Upgrade to 1.1.5 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5 · CVE-2026-40978 · GHSA-63c8-m9m2-cvr3
- Medium, CVSS 6.5
Spring AI Vulnerable to OOM by attacker-controlled PDF
Maven org.springframework.ai:spring-ai-pdf-document-reader · Upgrade to 1.1.5 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5 · CVE-2026-40980 · GHSA-26gg-9gv2-v27j
- Medium, CVSS 6.1
Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory
Maven org.springframework.ai:spring-ai-transformers · Upgrade to 1.1.5 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5 · CVE-2026-40979 · GHSA-r5hp-3cgj-j6xv
- High, CVSS 8.6
Spring AI has a VectorStore FilterExpression Converter injection
Maven org.springframework.ai:spring-ai-vector-store · Upgrade to 1.1.5 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5 · CVE-2026-40967 · GHSA-qc4j-qjqx-vr58
- Medium, CVSS 6.6
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
PyPI ironic · Upgrade to 35.0.1 or later · < 35.0.1 · CVE-2026-42510 · GHSA-wqpv-c3pp-3m58 · amended
- Medium, CVSS 5.0
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification
Maven org.springframework.boot:spring-boot-cassandra · Upgrade to 4.0.6 or 3.5.14 by release line; some affected versions have no fix yet · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32 · CVE-2026-40974 · GHSA-mqvw-jfmh-93qq
- Medium, CVSS 4.8
Spring Boot's random value property source uses a weak PRNG unsuitable for secrets
Maven org.springframework.boot:spring-boot-cassandra · Upgrade to 4.0.6 or 3.5.14 by release line; some affected versions have no fix yet · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32 · CVE-2026-40975 · GHSA-m4x9-hx6x-2c43
- High, CVSS 7.0
Spring Boot accepts predictable temp directory without ownership verification
Maven org.springframework.boot:spring-boot · Upgrade to 4.0.6 or 3.5.14 by release line; some affected versions have no fix yet · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32 · CVE-2026-40973 · GHSA-wwpq-f5c3-7hvx
- Critical, CVSS 9.1
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
Maven org.springframework.boot:spring-boot · Upgrade to 4.0.6 or later · >= 4.0.0, < 4.0.6 · CVE-2026-40976 · GHSA-8v8j-3hxp-93wr
- Medium, CVSS 4.7
Spring Boot's PID file write follows symlinks at predictable default path
Maven org.springframework.boot:spring-boot-cassandra · Upgrade to 4.0.6 or 3.5.14 by release line; some affected versions have no fix yet · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32 · CVE-2026-40977 · GHSA-5368-6h4h-gr29
- Medium, CVSS 5.0
Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker
Maven org.springframework.boot:spring-boot-rabbitmq · Upgrade to 4.0.6 or 3.5.14 by release line · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14 · CVE-2026-40971 · GHSA-9vc8-qppq-wvxc
- High, CVSS 7.5
Spring Boot DevTools remote secret comparison is vulnerable to timing attacks
Maven org.springframework.boot:spring-boot-devtools · Upgrade to 4.0.6 or 3.5.14 by release line; some affected versions have no fix yet · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32 · CVE-2026-40972 · GHSA-56v8-86gj-66jp
- Medium, CVSS 5.0
Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.
Maven org.springframework.boot:spring-boot-elasticsearch · Upgrade to 4.0.6 or later · >= 4.0.0, < 4.0.6 · CVE-2026-40970 · GHSA-c96x-rpm4-349p
- Low, CVSS 2.9
vLLM makes Use of Uninitialized Resource
PyPI vllm · Upgrade to 0.19.1 or later · < 0.19.1 · CVE-2026-7141 · GHSA-x368-4g9h-fvv4 · amended
- Low, CVSS 2.1
Wooey has an Incorrect Privilege Assignment issue
PyPI wooey · Upgrade to 0.13.3rc1 (pre-release) or later · < 0.13.3rc1 · CVE-2026-7142 · GHSA-w65c-cmxj-qrhm · amended
- Medium, CVSS 6.5
Apache Storm's Improper Handling of TLS Client Authentication Failure Leads to Anonymous Principal Assignment
Maven org.apache.storm:storm-client · Upgrade to 2.8.7 or later · < 2.8.7 · CVE-2026-41081 · GHSA-j2q8-xx3q-8fqh
- Medium, CVSS 5.3
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
PyPI pip · Upgrade to 26.1 or later · < 26.1 · CVE-2026-6357 · GHSA-jp4c-xjxw-mgf9 · amended
- Medium, CVSS 4.8
Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade
Maven org.apache.storm:storm-metrics-prometheus · Upgrade to 2.8.7 or later · >= 2.6.3, < 2.8.7 · CVE-2026-40557 · GHSA-82fm-wpc2-5pmp
- Medium, CVSS 6.3
Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data
Maven org.apache.camel:camel-consul · Upgrade to 4.18.1 or 4.14.6 by release line · >= 3.0.0, < 4.14.6; >= 4.15.0, < 4.18.1 · CVE-2026-27172 · GHSA-5rc6-9qfp-8vwg
- Critical, CVSS 9.4
Apache Camel's Camel-Mail component is vulnerable to Camel message header injection
Maven org.apache.camel:camel-mail · Upgrade to 4.18.1 or 4.14.6 by release line · >= 3.0.0, < 4.14.6; >= 4.15.0, < 4.18.1 · CVE-2026-33454 · GHSA-2vqf-x7g4-7c2g
- Critical, CVSS 10.0
Apache camel-coap allows header injection that can lead to remote code execution
Maven org.apache.camel:camel-coap · Upgrade to 4.18.1 or 4.14.6 by release line · >= 4.14.0, <= 4.14.5; >= 4.18.0, < 4.18.1 · CVE-2026-33453 · GHSA-695c-x5gc-94gj
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.