High, CVSS 8.6
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
PyPI litellm · Upgrade to 1.83.7 or later · >= 1.80.5, < 1.83.7 · CVE-2026-42203 · GHSA-xqmj-j6mv-4862 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7401–7425 of 31,057 matching · newest first
- Medium, CVSS 6.5
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields
Packagist almirhodzic/nova-toggle-5 · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-42202 · GHSA-f5c8-m5vw-rmgq
- Medium, CVSS 5.7
AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache
PyPI aws-encryption-sdk · Upgrade to 4.0.5 or 3.3.1 by release line · >= 2.0.0, < 3.3.1; >= 4.0.0, < 4.0.5 · CVE-2026-6550 · GHSA-v638-38fc-rhfv · amended
- Medium, CVSS 6.2
Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior
crates.io grid · Upgrade to 1.0.1 or later · >= 0.17.0, <= 1.0.0 · CVE-2026-42199 · GHSA-38c5-483c-4qqp
- High, CVSS 7.1
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
Go github.com/QuantumNous/new-api · Upgrade to 0.12.10 or later · < 0.12.10 · CVE-2026-41432 · GHSA-xff3-5c9p-2mr4
- High, CVSS 7.5
russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler
crates.io russh · Upgrade to 0.60.1 or later · < 0.60.1 · CVE-2026-42189 · GHSA-f5v4-2wr6-hqmg · amended
- Medium, CVSS 5.3
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
npm rwsdk · Upgrade to 1.2.3 or later · >= 1.0.0-beta.50, <= 1.2.2 · CVE-2026-42190 · GHSA-m2m6-cff5-3w7c · amended
- High, CVSS 8.1
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
RubyGems erb · Upgrade to 6.0.4, 6.0.1.1, 4.0.4.1 or 4.0.3.1 by release line · < 4.0.3.1; >= 4.0.4, <= 4.0.4; >= 5.0.0, < 6.0.1.1; >= 6.0.2, < 6.0.4 · CVE-2026-41316 · GHSA-q339-8rmv-2mhv
- High, CVSS 7.5
liquidjs has a Denial of Service via circular block reference in layout
npm liquidjs · Upgrade to 10.25.7 or later · < 10.25.7 · CVE-2026-41311 · GHSA-4rc3-7j7w-m548 · amended
- Medium, CVSS 4.3
Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
PyPI apache-airflow · Upgrade to 3.2.1rc1 (pre-release) or later · < 3.2.1rc1 · CVE-2026-40690 · GHSA-w7rc-q6cm-f5gm · amended
- Medium, CVSS 4.3
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
PyPI apache-airflow · Upgrade to 3.2.1rc1 (pre-release) or later · < 3.2.1rc1 · CVE-2026-38743 · GHSA-p3v3-229h-mc63 · amended
- Medium, CVSS 6.1
PostCSS has XSS via Unescaped in its CSS Stringify Output
npm postcss · Upgrade to 8.5.10 or later · < 8.5.10 · CVE-2026-41305 · GHSA-qx2v-qp2m-jg93 · amended
- Medium, CVSS 6.3
Lemmy has SSRF in /api/v3/post via Webmention dispatch
crates.io lemmy_api_common · Upgrade to 0.19.18 or later · < 0.19.18 · CVE-2026-42180 · GHSA-3jvj-v6w2-h948
- Medium, CVSS 6.5
Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image
crates.io lemmy_api_common · Upgrade to 0.19.18 or later · < 0.19.18 · CVE-2026-42181 · GHSA-h6hf-9846-xwrq
- High, CVSS 8.1
Contour has Lua code injection via Cookie Path Rewrite Policy
Go github.com/projectcontour/contour · Upgrade to 1.33.4, 1.32.5 or 1.31.6 by release line · >= 1.19.0, < 1.31.6; >= 1.32.0, < 1.32.5; >= 1.33.0, < 1.33.4 · CVE-2026-41246 · GHSA-x4mj-7f9g-29h4
- Medium, CVSS 6.3
Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability
Maven org.apache.dolphinscheduler:dolphinscheduler +1 · Upgrade all 2 to 3.3.1 or later · >= 3.2.0, < 3.3.1 · CVE-2025-62233 · GHSA-f786-9c63-8xr8
- High, CVSS 8.8
Apache ActiveMQ Vulnerable to Code Injection
Maven org.apache.activemq:activemq-broker +2 · Upgrade all 3 to 6.2.5 or 5.19.6 by release line · < 5.19.6; >= 6.0.0, < 6.2.5 · CVE-2026-41044 · GHSA-mr6m-xj7v-3cv3
- Medium, CVSS 6.5
Apache ActiveMQ Vulnerable to Cross-site Scripting
Maven org.apache.activemq:activemq-broker +2 · Upgrade all 3 to 6.2.5 or 5.19.6 by release line · < 5.19.6; >= 6.0.0, < 6.2.5 · CVE-2026-41043 · GHSA-2jp3-2923-9h52
- High, CVSS 8.8
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
Maven org.apache.activemq:activemq-broker +2 · Upgrade all 3 to 6.2.5 or 5.19.6 by release line · < 5.19.6; >= 6.0.0, < 6.2.5 · CVE-2026-40466 · GHSA-w3w2-mpp5-92gm
- High, CVSS 8.1
Apache DolphinScheduler has an Incorrect Authorization Vulnerability
Maven org.apache.dolphinscheduler:dolphinscheduler · Upgrade to 3.4.1 or later · < 3.4.1 · CVE-2026-23902 · GHSA-72mv-wwvm-vgp5
- High, CVSS 7.5
Grafana Tempo has an Uncontrolled Resource Consumption issue
Go github.com/grafana/tempo · Upgrade to 2.10.2, 2.9.2 or 2.8.4 by release line · >= 1.3.0, < 2.8.4; >= 2.9.0, < 2.9.2; >= 2.10.0, < 2.10.2 · CVE-2026-21728 · GHSA-p4r4-xvrq-gvmc
- Low, CVSS 3.3
melange has Path Traversal via .PKGINFO in --persist-lint-results
Go chainguard.dev/melange · Upgrade to 0.43.4 or later · >= 0.32.0, < 0.43.4 · CVE-2026-29051 · GHSA-q2pw-xx38-p64j
- Medium, CVSS 6.1
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
Go chainguard.dev/melange · Upgrade to 0.43.4 or later · >= 0.32.0, < 0.43.4 · CVE-2026-29050 · GHSA-98f2-w9h9-7fp9
- Low, CVSS 2.2
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
npm @astrojs/cloudflare · Upgrade to 13.1.10 or later · < 13.1.10 · CVE-2026-41321 · GHSA-88gm-j2wx-58h6 · amended
- High, CVSS 8.8
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
npm openlearnx · Upgrade to 2.0.3 or later · < 2.0.3 · CVE-2026-41900 · GHSA-8h25-q488-4hxw · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.