High, CVSS 7.0
zizmor: Debug logging prints available GitHub credentials in cleartext
PyPI zizmor · Upgrade to 1.28.0 or later · >= 1.27.0, < 1.28.0 · CVE-2026-102289 · GHSA-f42p-wjw5-97qh · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.1
Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
Maven com.gradleup.shadow:com.gradleup.shadow.gradle.plugin · Upgrade to 9.6.0 or later · < 9.6.0 · CVE-2026-75598 · GHSA-rr8v-fxxf-c986 · amended
- High, CVSS 7.5
Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
PyPI code-graph-rag · Upgrade to 0.0.345 or later · < 0.0.345 · CVE-2026-77604 · GHSA-vvr2-h2jp-838m · amended
- High, CVSS 7.7
Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260622164202-8158452b3730 (pre-release) or later · < 0.0.0-20260622164202-8158452b3730 · CVE-2026-62662 · GHSA-q4xm-p75h-h9p3 · amended
- High, CVSS 8.7
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
npm @tsparticles/mcp-server · Upgrade to 4.3.1 or later · < 4.3.1 · CVE-2026-76892 · GHSA-4p8p-pjpq-2w7h · amended
- High, CVSS 7.5
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
npm @tsparticles/mcp-server · Upgrade to 4.3.1 or later · < 4.3.1 · CVE-2026-63655 · GHSA-447x-qqwf-m7xq · amended
- High, CVSS 7.5
ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
npm ag-psd · Upgrade to 31.0.1 or later · < 31.0.1 · CVE-2026-63501 · GHSA-6w3r-6hpr-hp6p · amended
- High, CVSS 7.3
traQ: Privilege escalation by OAuth prompt=none request
Go github.com/traPtitech/traQ · Upgrade to 1.0.0-rc.2.0.20260629134940-5510fe8aa9bb (pre-release) or later · < 1.0.0-rc.2.0.20260629134940-5510fe8aa9bb · CVE-2026-63198 · GHSA-8cfq-jgf7-8m27 · amended
- High, CVSS 7.3
traQ: XSS in the User Uploaded File Retrieval API
Go github.com/traPtitech/traQ · Upgrade to 1.0.0-rc.2.0.20260627142846-3db29e777166 (pre-release) or later · < 1.0.0-rc.2.0.20260627142846-3db29e777166 · CVE-2026-63197 · GHSA-p74g-f95m-7fx7 · amended
- High, CVSS 8.8
isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)
npm isomorphic-git · Upgrade to 1.38.6 or later · < 1.38.6 · CVE-2026-63395 · GHSA-9qw7-j9xw-fv9c · amended
- Critical, CVSS 9.3
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
PyPI fastapi-code-generator · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-63471 · GHSA-p2mm-64f6-gmpp · amended
- Critical, CVSS 9.3
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
PyPI fastapi-code-generator · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-63469 · GHSA-6xmv-cjr5-w3q8 · amended
- Critical, CVSS 9.3
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
PyPI fastapi-code-generator · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-63470 · GHSA-h667-4jj2-cgv4 · amended
- High, CVSS 8.2
zt-zip: Path traversal in fluent API unpack
Maven org.zeroturnaround:zt-zip · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-63436 · GHSA-52c6-99qm-3hqr · amended
- High, CVSS 8.2
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
PyPI loggingredactor · Upgrade to 0.0.7 or later · < 0.0.7 · CVE-2026-63417 · GHSA-w7qv-268h-9h3f · amended
- Critical, CVSS 9.9
LXD has restricted project bypass leading to arbitrary command execution
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-47w9-6r3f-938g · amended
- High, CVSS 7.7
LXD has project restriction bypass for custom volume copy across projects
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-7mr3-28h5-m5vx · amended
- High, CVSS 7.7
LXD has project restriction bypass in instance copy across projects
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-qx75-2p3r-pwm5 · amended
- High, CVSS 8.8
GeoNode has OS command injection via uploaded file layer name
PyPI geonode · Upgrade to 5.1.0 or later · < 5.1.0 · CVE-2026-33050 · GHSA-9fpx-fr6j-2vh6 · amended
- Critical, CVSS 9.9
LXD has arbitrary file write on client due to trusted image hash
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-pjff-c2wc-f6jm · amended
- Critical, CVSS 9.9
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-fmc8-p6q7-75cc · amended
- Critical, CVSS 9.9
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-vghh-5rfx-xhq8 · amended
- Critical, CVSS 9.9
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260203144152-d1c8ba15d160 (pre-release) or later · < 0.0.0-20260203144152-d1c8ba15d160 · GHSA-jpf8-86f3-wp38 · amended
- Critical, CVSS 9.9
LXD has arbitrary file write on host via
exec-outputsymlink in crafted imageGo github.com/canonical/lxd · Upgrade to 0.0.0-20260626085134-124f90100640 (pre-release) or later · < 0.0.0-20260626085134-124f90100640 · GHSA-9j25-mm2h-2f76 · amended
- High, CVSS 8.6
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
Go github.com/osac-project/osac-operator · Upgrade to 0.0.4 or later · < 0.0.4 · CVE-2026-62284 · GHSA-5w5g-j6hw-6p8f · amended
A vendor fix does not resolve your finding until you verify it in your own systems.