Medium, CVSS 5.3
Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
PyPI apache-airflow-core +1 · Upgrade all 2 to 3.2.0 or later · < 3.2.0 · CVE-2026-30912 · GHSA-w7cf-2pmc-5m4c · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7551–7575 of 31,057 matching · newest first
- High, CVSS 7.5
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
PyPI apache-airflow-core · Upgrade to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2026-32228 · GHSA-h97w-pm3w-mwmc · amended
- High, CVSS 7.2
Apache Airflow allows code execution through crafted XCom payloads
PyPI apache-airflow-core +1 · Upgrade all 2 to 3.2.0 or later · < 3.2.0 · CVE-2026-25917 · GHSA-6ffj-2wg2-w45j · amended
- Low, CVSS 3.7
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
PyPI apache-airflow-core +1 · Upgrade all 2 to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2026-32690 · GHSA-w9r4-94fj-xp69 · amended
- Critical, CVSS 9.3
Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling
crates.io zebra-script · Upgrade to 5.0.2 or later · < 5.0.2 · +1 more package · CVE-2026-41583 · GHSA-8m29-fpq5-89jj
- Medium, CVSS 6.9
Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
crates.io zebra-rpc · Upgrade to 6.0.2 or later · >= 1.0.0-beta.45, < 6.0.2 · +1 more package · CVE-2026-41585 · GHSA-29x4-r6jv-ff4w
- Critical, CVSS 9.2
Zebra has rk Identity Point Panic in Transaction Verification
crates.io zebra-chain · Upgrade to 6.0.2 or later · < 6.0.2 · +1 more package · CVE-2026-41584 · GHSA-452v-w3gx-72wg
- Medium, CVSS 6.5
MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
NuGet mailkit · Upgrade to 4.16.0 or later · < 4.16.0 · CVE-2026-41319 · GHSA-9j88-vvj5-vhgr
- High, CVSS 8.7
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
PyPI pretalx · Upgrade to 2026.1.0 or later · < 2026.1.0 · CVE-2026-41241 · GHSA-cjcx-jfp2-f7m2 · amended
- Medium, CVSS 6.1
pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders
PyPI pretalx · Upgrade to 2026.1.0 or later · < 2026.1.0 · CVE-2026-41426 · GHSA-jm8c-9f3j-4378 · amended
- High, CVSS 8.3
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
PyPI dagster · Upgrade to 1.13.1 or later · <= 1.13.0 · +5 more packages · CVE-2026-41490 · GHSA-mjw2-v2hm-wj34 · amended
- Medium, CVSS 6.9
Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields
Go github.com/kubernetes-sigs/aws-efs-csi-driver · Upgrade to 1.7.8-0.20260416142831-51806c22c575 (pre-release) or later · < 1.7.8-0.20260416142831-51806c22c575 · CVE-2026-6437 · GHSA-mph4-q2vm-w2pw
- High, CVSS 8.8
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
Packagist yeswiki/yeswiki · Upgrade to 4.6.1 or later · <= 4.6.0 · CVE-2026-41143 · GHSA-f58v-p6j9-24c2
- Critical, CVSS 9.3
Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass
Go github.com/nhost/nhost · Upgrade to 0.0.0-20260417112436-ec8dab3f2cf4 (pre-release) or later · < 0.0.0-20260417112436-ec8dab3f2cf4 · CVE-2026-41574 · GHSA-6g38-8j4p-j3pr
- High, CVSS 7.8
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
Packagist phpunit/phpunit · Upgrade to 13.1.6 or 12.5.22 by release line · >= 12.5.21, <= 12.5.21; >= 13.1.5, <= 13.1.5 · CVE-2026-41570 · GHSA-qrr6-mg7r-m243
- Low, CVSS 3.8
Zio has SubFileSystem Path Confinement Bypass via Unresolved
..SegmentNuGet zio · Upgrade to 0.22.2 or later · <= 0.22.1 · GHSA-h39g-6x3c-7fq9
- Critical, CVSS 9.2
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41265 · GHSA-v38x-c887-992f · amended
- Medium, CVSS 6.3
Zebra: addr/addrv2 Deserialization Resource Exhaustion
crates.io zebra-network · Upgrade to 5.0.1 or later · < 5.0.1 · +1 more package · CVE-2026-40881 · GHSA-xr93-pcq3-pxf8
- High, CVSS 7.2
Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
crates.io zebra-consensus · Upgrade to 5.0.2 or later · < 5.0.2 · +1 more package · CVE-2026-40880 · GHSA-xvj8-ph7x-65gf
- High, CVSS 8.9
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
Packagist studio-42/elfinder · Upgrade to 2.1.67 or later · < 2.1.67 · CVE-2026-41247 · GHSA-8q4h-8crm-5cvc
- Medium, CVSS 5.3
OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths
npm openclaw · Upgrade to 2026.4.15 or later · < 2026.4.15 · CVE-2026-44111 · GHSA-f934-5rqf-xx47 · amended
- Medium, CVSS 6.3
OpenClaw: Webchat media embedding enforces local-root containment for tool-result files
npm openclaw · Upgrade to 2026.4.15 or later · >= 2026.4.7, < 2026.4.15 · CVE-2026-41389 · GHSA-mr34-9552-qr95 · amended
- Critical, CVSS 9.2
OpenClaw: Feishu webhook and card-action validation now fail closed
npm openclaw · Upgrade to 2026.4.15 or later · < 2026.4.15 · CVE-2026-44109 · GHSA-xh72-v6v9-mwhc · amended
- Critical, CVSS 9.2
OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
npm openclaw · Upgrade to 2026.4.15 or later · < 2026.4.15 · CVE-2026-43585 · GHSA-xmxx-7p24-h892 · amended
- Critical, CVSS 9.8
Remote Code Execution (RCE) via String Literal Injection into math-codegen
npm math-codegen · Upgrade to 0.4.3 or later · < 0.4.3 · CVE-2026-41507 · GHSA-p6x5-p4xf-cc4r · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.