Medium, CVSS 4.5
bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby
RubyGems bcrypt · Upgrade to 3.1.22 or later · <= 3.1.21 · CVE-2026-33306 · GHSA-f27w-vcwj-c954
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8951–8975 of 31,057 matching · newest first
- Medium, CVSS 4.7
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
npm @dicebear/initials +1 · Upgrade all 2 to 9.4.1, 8.0.3, 7.1.4 or 2 more by release line · >= 5.0.0, <= 5.4.3; >= 6.0.0, <= 6.1.3; >= 7.0.0, <= 7.1.3; >= 8.0.0, <= 8.0.2; >= 9.0.0, <= 9.4.0 · CVE-2026-33311 · GHSA-mr9r-mww3-v6gv · amended
- Medium, CVSS 6.5
Ella Core panics on malformed ULNASTransport Message without a Request Type
Go github.com/ellanetworks/core · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-33283 · GHSA-3366-gw57-fcm5
- High, CVSS 7.5
Ella Core panics on malformed NGAP Location Report
Go github.com/ellanetworks/core · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-33282 · GHSA-826q-wrq4-p23x
- Medium, CVSS 6.5
Ella Core panics on invalid PDU Session IDs in NGAP messages
Go github.com/ellanetworks/core · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-33281 · GHSA-q669-4gmv-g8mf
- Critical, CVSS 9.9
Langflow has an Arbitrary File Write (RCE) via v2 API
PyPI langflow · Upgrade to 1.9.0 or later · >= 1.2.0, < 1.9.0 · CVE-2026-33309 · GHSA-g2j9-7rj2-gm6c · amended
- High, CVSS 8.9
Prototype Pollution via parse() in NodeJS flatted
npm flatted · Upgrade to 3.4.2 or later · <= 3.4.1 · CVE-2026-33228 · GHSA-rf6f-7fwh-wjgh · amended
- Medium, CVSS 6.6
Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets
Go github.com/juju/juju · Upgrade to 0.0.0-20260319091847-d06919eb03ec (pre-release) or later · >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec · CVE-2026-32694 · GHSA-5cj2-rqqf-hx9p
- High, CVSS 8.8
Juju has unauthorized access to out-of-scope Kubernetes secrets
Go github.com/juju/juju · Upgrade to 0.0.0-20260319091847-d06919eb03ec (pre-release) or later · >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec · CVE-2026-32693 · GHSA-439w-v2p7-pggc
- High, CVSS 7.6
Juju has unauthorized update of out-of-scope Vault secrets
Go github.com/juju/juju · Upgrade to 0.0.0-20260319091847-d06919eb03ec (pre-release) or later · >= 0.0.0-20230919230135-f6a66aa91eec, < 0.0.0-20260319091847-d06919eb03ec · CVE-2026-32692 · GHSA-89x7-5m5m-mcmm
- Medium, CVSS 6.5
Denial of service via non-terminating SYLT frame parsing loop in tinytag
PyPI tinytag · Upgrade to 2.2.1 or later · <= 2.2.0 · CVE-2026-32889 · GHSA-f4rq-2259-hv29 · amended
- High, CVSS 7.1
Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
Go github.com/modelcontextprotocol/go-sdk · Upgrade to 1.4.1 or later · <= 1.4.0 · CVE-2026-33252 · GHSA-89xv-2j6f-qhc8
- High, CVSS 8.2
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
Packagist phpseclib/phpseclib · Upgrade to 3.0.50, 2.0.52 or 1.0.27 by release line · >= 3.0.0, <= 3.0.49; >= 2.0.0, <= 2.0.51; >= 0.1.1, <= 1.0.26 · CVE-2026-32935 · GHSA-94g3-g5v7-q4jg
- Critical, CVSS 9.0
qui CORS Misconfiguration: Arbitrary Origins Trusted
Go github.com/autobrr/qui · Upgrade to 1.15.0 or later · < 1.15.0 · CVE-2026-30924 · GHSA-h8vw-ph9r-xpch
- Critical, CVSS 10.0
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
Go github.com/smallstep/certificates · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-30836 · GHSA-q4r8-xm5f-56gw
- High, CVSS 7.1
ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor
PyPI ormar · Upgrade to 0.23.1 or later · <= 0.23.0 · CVE-2026-27953 · GHSA-f964-whrq-44h8 · amended
- Medium, CVSS 6.2
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Go github.com/tomwright/dasel/v3 · Upgrade to 3.3.2 or later · >= 3.0.0, < 3.3.2 · CVE-2026-33320 · GHSA-4fcp-jxh7-23x8
- High, CVSS 8.3
Ruby JSON has a format string injection vulnerability
RubyGems json · Upgrade to 2.19.2, 2.17.1.2 or 2.15.2.1 by release line · >= 2.18.0, < 2.19.2; >= 2.16.0, < 2.17.1.2; >= 2.14.0, < 2.15.2.1 · CVE-2026-33210 · GHSA-3m6g-2423-7cp3
- High, CVSS 8.7
Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing
crates.io salvo · Upgrade to 0.89.3 or later · < 0.89.3 · CVE-2026-33241 · GHSA-pp9r-xg4c-8j4x
- High, CVSS 7.5
Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass
crates.io salvo · Upgrade to 0.89.3 or later · >= 0.39.0, <= 0.89.2 · CVE-2026-33242 · GHSA-f842-phm9-p4v4
- High, CVSS 8.2
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
Go github.com/modelcontextprotocol/go-sdk · Upgrade to 1.4.1 or later · <= 1.4.0 · GHSA-q382-vc8q-7jhj
- Medium, CVSS 4.3
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
Packagist wwbn/avideo · Upgrade to 26.0 or later · <= 25.0 · CVE-2026-33238 · GHSA-4wmm-6qxj-fpj4
- Medium, CVSS 5.5
AVideo has SSRF in Scheduler Plugin via callbackURL Missing
isSSRFSafeURL()ValidationPackagist wwbn/avideo · Upgrade to 26.0 or later · <= 25.0 · CVE-2026-33237 · GHSA-v467-g7g7-hhfh
- Medium, CVSS 5.3
Juju affected by timing ownership claim attack on new external back-end secrets
Go github.com/juju/juju · Upgrade to 3.6.19 or later · >= 3.0.0, < 3.6.19 · CVE-2026-32691 · GHSA-gfgr-6hrj-85ww
- High, CVSS 8.1
NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
PyPI nltk · Upgrade to 3.9.4 or later · < 3.9.4 · CVE-2026-33236 · GHSA-469j-vmhf-r6v7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.