Medium, CVSS 5.1
JupyterHub has an Open Redirect Vulnerability
PyPI jupyterhub · Upgrade to 5.4.4 or later · <= 5.4.3 · CVE-2026-33709 · GHSA-3vff-hjqv-m7h8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8251–8275 of 31,057 matching · newest first
- High, CVSS 8.8
Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims
PyPI oauthenticator · Upgrade to 17.4.0 or later · < 17.4.0 · CVE-2026-33175 · GHSA-rrvg-cxh4-qhrv · amended
- Critical, CVSS 9.6
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
npm @budibase/backend-core · Upgrade to 3.33.4 or later · < 3.33.4 · CVE-2026-31818 · GHSA-7r9j-r86q-7g45 · amended
- High, CVSS 7.1
Juju has a resource poisoning vulnerability
Go github.com/juju/juju · Upgrade to 0.0.0-20260120044552-26ff93c903d5 (pre-release) or later · < 0.0.0-20260120044552-26ff93c903d5 · CVE-2025-68153 · GHSA-245v-p8fj-vwm2
- Medium, CVSS 6.9
Juju: Read All Controller Logs From Compromised Workload
Go github.com/juju/juju · Upgrade to 0.0.0-20250623030540-c91a1f404695 (pre-release) or later · < 0.0.0-20250623030540-c91a1f404695 · CVE-2025-68152 · GHSA-j6f6-jp3p-53mw
- Medium, CVSS 6.5
vLLM: Unauthenticated OOM Denial of Service via Unbounded
nParameter in OpenAI API ServerPyPI vllm · Upgrade to 0.19.0 or later · >= 0.1.0, < 0.19.0 · CVE-2026-34756 · GHSA-3mwp-wvh9-7528 · amended
- Medium, CVSS 5.3
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35544 · GHSA-xpqh-grpw-4xmg
- Low, CVSS 3.7
Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35537 · GHSA-rxj3-rrwm-pj4r
- Medium, CVSS 6.1
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35539 · GHSA-x4q5-8j5g-hpjc
- Medium, CVSS 5.3
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35545 · GHSA-w846-74jr-76cv
- Medium, CVSS 4.2
Roundcube Webmail: Incorrect password comparison in the password plugin
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35541 · GHSA-46pv-mj2g-93gh
- Medium, CVSS 5.3
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35543 · GHSA-j2g6-8rvg-7mf6
- Low, CVSS 3.1
Roundcube Webmail: Unsanitized IMAP SEARCH command arguments
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35538 · GHSA-8jr8-v43g-5c57
- Medium, CVSS 5.3
Roundcube: Bypass of remote image blocking via crafted BODY background attribute
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35542 · GHSA-5hf6-crg4-fg59
- Medium, CVSS 5.4
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Packagist roundcube/roundcubemail · Upgrade to 1.7-rc5 (pre-release) or later · >= 1.7-beta, < 1.7-rc5 · CVE-2026-35540 · GHSA-vxg2-hhgr-37fx
- Critical, CVSS 9.8
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
Go github.com/patrickhener/goshs · Upgrade to 1.1.5-0.20260401172448-237f3af891a9 (pre-release) or later · < 1.1.5-0.20260401172448-237f3af891a9 · CVE-2026-35393 · GHSA-jg56-wf8x-qrv5
- Critical, CVSS 9.8
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
Go github.com/patrickhener/goshs · Upgrade to 1.1.5-0.20260401172448-237f3af891a9 (pre-release) or later · < 1.1.5-0.20260401172448-237f3af891a9 · CVE-2026-35392 · GHSA-g8mv-vp7j-qp64
- Critical, CVSS 9.1
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
npm fast-jwt · Upgrade to 6.2.0 or later · >= 0.0.1, < 6.2.0 · CVE-2026-35039 · GHSA-rp9m-7r4c-75qg · amended
- Low, CVSS 2.1
Signal K Server: Arbitrary Prototype Read via
fromField Bypassnpm signalk-server · Upgrade to 2.24.0 or later · < 2.24.0 · CVE-2026-35038 · GHSA-qh3j-mrg8-f234 · amended
- Critical, CVSS 9.4
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 31.0.0.0 or later · <= 0.28.6.0 · CVE-2026-34989 · GHSA-vr2g-rhm5-q4jr
- High, CVSS 7.2
Ajenti has an authorization bypass during custom package installation
PyPI ajenti-panel · Upgrade to 2.2.15 or later · < 2.2.15 · CVE-2026-35175 · GHSA-73jv-44c3-j5p2 · amended
- Critical, CVSS 9.8
Kedro has Arbitrary Code Execution via Malicious Logging Configuration
PyPI kedro · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-35171 · GHSA-9cqf-439c-j96r · amended
- High, CVSS 8.8
OpenSTAManager: SQL Injection via Aggiornamenti Module
Packagist devcode-it/openstamanager · Upgrade to 2.10.2 or later · <= 2.10.1 · CVE-2026-35168 · GHSA-2fr7-cc4f-wh98
- High, CVSS 7.1
Kedro: Path Traversal in versioned dataset loading via unsanitized version string
PyPI kedro · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-35167 · GHSA-6326-w46w-ppjw · amended
- Medium, CVSS 5.3
DOMPurify ADD_ATTR predicate skips URI validation
npm dompurify · Upgrade to 3.3.2 or later · <= 3.3.1 · CVE-2026-65912 · GHSA-cjmm-f4jc-qw8r · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.