High, CVSS 7.5
Unauthenticated remote shutdown in nltk.app.wordnet_app
PyPI nltk · Upgrade to 3.9.4 or later · <= 3.9.3 · CVE-2026-33231 · GHSA-jm6w-m3j8-898g · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8976–9000 of 31,057 matching · newest first
- High, CVSS 7.7
Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File
npm @anthropic-ai/claude-code · Upgrade to 2.1.53 or later · < 2.1.53 · CVE-2026-33068 · GHSA-mmgp-wc2j-qcv7 · amended
- High, CVSS 8.1
Arbitrary file write via tar traversal in mlflow
PyPI mlflow · Upgrade to 3.9.0rc0 (pre-release) or later · < 3.9.0rc0 · CVE-2025-15031 · GHSA-fhff-qmm8-h2fp · amended
- Medium, CVSS 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk
PyPI nltk · Upgrade to 3.9.4 or later · <= 3.9.3 · CVE-2026-33230 · GHSA-gfwx-w7gr-fvh7 · amended
- Low, CVSS 2.1
Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload
Go github.com/nhost/nhost · Upgrade to 0.0.0-20260318074820-c4bd53f042d7 (pre-release) or later · < 0.0.0-20260318074820-c4bd53f042d7 · CVE-2026-33221 · GHSA-g9f6-9775-hffm
- Critical, CVSS 9.6
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
Go github.com/tektoncd/pipeline · Upgrade to 1.10.2, 1.9.2, 1.6.1 or 2 more by release line · >= 1.0.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2 · CVE-2026-33211 · GHSA-j5q5-j9gm-2w5c
- Medium, CVSS 5.3
JustHTML has a Sanitizer Bypass (in Markdown)
PyPI justhtml · Upgrade to 1.12.0 or later · <= 1.11.0 · CVE-2026-8445 · GHSA-3rcm-vjrc-p45j · amended
- Medium, CVSS 5.3
JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)
PyPI justhtml · Upgrade to 1.12.0 or later · <= 1.11.0 · CVE-2026-8630 · GHSA-qvc2-mg72-jjhx · amended
- High, CVSS 7.5
Unsigned SAML LogoutRequest Acceptance in gosaml2
Go github.com/russellhaering/gosaml2 · Upgrade to 0.11.0 or later · <= 0.10.0 · GHSA-pcgw-qcv5-h8ch
- High, CVSS 8.7
gosaml2 CBC Padding Panic — Unauthenticated Process Crash
Go github.com/russellhaering/gosaml2 · Upgrade to 0.11.0 or later · <= 0.10.0 · GHSA-hwqm-qvj9-4jr2
- High, CVSS 7.5
validateSignature Loop Variable Capture Signature Bypass in goxmldsig
Go github.com/russellhaering/goxmldsig · Upgrade to 1.6.0 or later · <= 1.5.0 · CVE-2026-33487 · GHSA-479m-364c-43vc
- Medium, CVSS 5.1
Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
PyPI nltk · Upgrade to 3.9.4 or later · <= 3.9.3 · CVE-2026-66393 · GHSA-rf74-v2fm-23pw · amended
- Low, CVSS 2.3
mo has a XSS via inline SVG script tags in Markdown rendering
Go github.com/k1LoW/mo · Upgrade to 0.18.5 or later · <= 0.18.4 · GHSA-vccx-p757-pv6h
- High, CVSS 7.5
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
Packagist kelvinmo/simplejwt · Upgrade to 1.1.1 or later · <= 1.1.0 · CVE-2026-33204 · GHSA-xw36-67f8-339x
- High, CVSS 8.7
free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
Go github.com/free5gc/udm · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33192 · GHSA-5rvc-5cwx-g5x8
- High, CVSS 8.7
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
Go github.com/free5gc/udm · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33191 · GHSA-p9hg-pq3q-v9gv
- High, CVSS 7.5
SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · < 3.6.2 · CVE-2026-33203 · GHSA-3g9h-9hp4-654v · amended
- Medium, CVSS 6.8
SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · < 3.6.2 · CVE-2026-33194 · GHSA-vm69-h85x-8p85 · amended
- Critical, CVSS 9.1
gRPC-Go has an authorization bypass via missing leading slash in :path
Go google.golang.org/grpc · Upgrade to 1.79.3 or later · < 1.79.3 · CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
- High, CVSS 8.7
DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT
PyPI deepdiff · Upgrade to 8.6.2 or later · >= 5.0.0, <= 8.6.1 · CVE-2026-33155 · GHSA-54jj-px8x-5w5q · amended
- High, CVSS 7.5
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
PyPI dynaconf · Upgrade to 3.2.13 or later · <= 3.2.12 · CVE-2026-33154 · GHSA-pxrr-hq57-q35p · amended
- Critical, CVSS 9.8
HAPI FHIR HTTP authentication leak in redirects
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +11 · Upgrade all 12 to 6.9.0 or later · < 6.9.0 · CVE-2026-33180 · GHSA-p7m9-v2cm-2h7m
- High, CVSS 7.3
Filament Unvalidated Range and Values summarizer values can be used for XSS
Packagist filament/tables · Upgrade to 5.3.5 or 4.8.5 by release line · >= 4.0.0, < 4.8.5; >= 5.0.0, < 5.3.5 · CVE-2026-33080 · GHSA-vv3x-j2x5-36jc
- Medium, CVSS 6.9
free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
Go github.com/free5gc/udm · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33065 · GHSA-958m-gxmc-mccm
- High, CVSS 8.7
free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
Go github.com/free5gc/udm · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33064 · GHSA-7g27-v5wj-jr75
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.