Low, CVSS 1.7
rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.9.0, < 0.10.78 · CVE-2026-41677 · GHSA-xmgf-hq76-4vx2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7451–7475 of 31,057 matching · newest first
- High, CVSS 7.2
rust-openssl has incorrect bounds assertion in aes key wrap
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.10.24, < 0.10.78 · CVE-2026-41678 · GHSA-8c75-8mhr-p7r9 · amended
- High, CVSS 8.1
rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.10.39, < 0.10.78 · CVE-2026-41681 · GHSA-ghm9-cr32-g9qj · amended
- High, CVSS 8.3
rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.9.24, < 0.10.78 · CVE-2026-41898 · GHSA-hppc-g8h3-xhp3 · amended
- Medium, CVSS 6.3
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
npm uuid · Upgrade to 13.0.1, 12.0.1 or 11.1.1 by release line · >= 12.0.0, < 12.0.1; >= 13.0.0, < 13.0.1; < 11.1.1 · CVE-2026-41907 · GHSA-w5hq-g745-h8pq · amended
- High, CVSS 7.1
SiYuan: Path Traversal via Double URL Encoding in
/export/Endpoint (Incomplete Fix Bypass for CVE-2026-30869)Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.5 or later · < 3.6.5 · CVE-2026-41894 · GHSA-hjh7-r5w8-5872 · amended
- High, CVSS 7.2
MCPHub has Path Traversal via Malicious MCPB Manifest Name
npm @samanhappy/mcphub · Upgrade to 0.12.13 or later · < 0.12.13 · CVE-2026-79743 · GHSA-p3h2-2j4p-p83g · amended
- Medium, CVSS 6.3
Gitea has insecure default SSH settings
Go code.gitea.io/gitea · Upgrade to 1.25.0 or later · < 1.25.0 · GHSA-3m6q-h5gj-7mrw
- Medium, CVSS 4.9
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Packagist flarum/core · Upgrade to 2.0.0-rc.1 (pre-release) or 1.8.16 by release line · <= 1.8.15; >= 2.0.0-beta.1, <= 2.0.0-beta.8 · CVE-2026-41887 · GHSA-xjvc-pw2r-6878
- High, CVSS 7.5
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
npm locize · Upgrade to 4.0.21 or later · < 4.0.21 · CVE-2026-41886 · GHSA-w937-fg2h-xhq2 · amended
- Medium, CVSS 6.5
i18next-locize-backend has URL Injection via Unsanitized Path Parameters
npm i18next-locize-backend · Upgrade to 9.0.2 or later · < 9.0.2 · CVE-2026-41885 · GHSA-mgcp-mfp8-3q45 · amended
- High, CVSS 8.6
i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header
npm i18next-http-middleware · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-41683 · GHSA-c3h8-g69v-pjrg · amended
- High, CVSS 7.5
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
npm @nocobase/database · Upgrade to 2.0.39 or later · < 2.0.39 · CVE-2026-41640 · GHSA-4948-f92q-f432 · amended
- High, CVSS 7.2
@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing
checkSQLCallnpm @nocobase/plugin-collection-sql · Upgrade to 2.0.39 or later · < 2.0.39 · CVE-2026-41641 · GHSA-wrwh-c28m-9jjh · amended
- Medium, CVSS 6.1
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
npm fast-xml-parser · Upgrade to 5.7.0 or later · < 5.7.0 · CVE-2026-41650 · GHSA-gh4j-gqv2-49f6 · amended
- Medium, CVSS 5.3
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
Go github.com/projectdiscovery/nuclei/v3 · Upgrade to 3.8.0 or later · >= 3.0.0, < 3.8.0 · CVE-2026-41645 · GHSA-jm34-66cf-qpvr
- Medium, CVSS 5.5
Nuclei: Local File Read via require() Module Loader Bypass
Go github.com/projectdiscovery/nuclei/v3 · Upgrade to 3.8.0 or later · >= 3.0.0, < 3.8.0 · CVE-2026-41646 · GHSA-29rg-wmcw-hpf4
- High, CVSS 8.3
monetr: Server-side request forgery in Lunch Flow link creation and refresh
Go github.com/monetr/monetr · Upgrade to 1.12.5 or later · < 1.12.5 · CVE-2026-41644 · GHSA-29v9-frvh-c426
- Medium, CVSS 6.4
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
npm marko · Upgrade to 5.38.36 or later · < 5.38.36 · +1 more package · CVE-2026-41591 · GHSA-x9fj-57fh-c8wq · amended
- High, CVSS 7.5
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
Go github.com/free5gc/pcf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-41135 · GHSA-98cp-84m9-q3qp
- Medium, CVSS 5.0
OpenFGA has Improper Policy Enforcement
Go github.com/openfga/openfga · Upgrade to 1.14.1 or later · < 1.14.1 · CVE-2026-41131 · GHSA-57j5-qwp2-vqp6
- Critical, CVSS 9.6
nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
crates.io nimiq-block · Upgrade to 1.7.2 or later · < 1.7.2 · CVE-2026-33471 · GHSA-6973-8887-87ff · amended
- Medium, CVSS 6.5
DDEV has ZipSlip path traversal in tar and zip archive extraction
Go github.com/ddev/ddev · Upgrade to 1.25.2 or later · < 1.25.2 · CVE-2026-32885 · GHSA-x2xq-qhjf-5mvg
- Medium, CVSS 6.9
Inspektor Gadget uses unsanitized ANSI Escape Sequences In
columnsOutput ModeGo github.com/inspektor-gadget/inspektor-gadget · Upgrade to 0.49.1 or later · < 0.49.1 · CVE-2026-25996 · GHSA-34r5-6j7w-235f
- Low, CVSS 3.3
uutils coreutils has an Improper Handling of Unicode Encoding Issue
crates.io coreutils · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-35375 · GHSA-vx9m-xjwf-8cqm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.