High, CVSS 8.1
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Maven org.keycloak:keycloak-server-spi-private +1 · Upgrade all 2 to 26.5.5 or later · < 26.5.5 · CVE-2026-2603 · GHSA-x4p7-7chp-64hq
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9051–9075 of 31,057 matching · newest first
- High, CVSS 8.7
Ray Dashboard is vulnerable to path traversal through its static file handling mechanism
PyPI ray · Upgrade to 2.8.1 or later · < 2.8.1 · CVE-2026-32981 · GHSA-j3mh-qmjj-xp83 · amended
- Medium, CVSS 5.8
Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
PyPI bedrock-agentcore-starter-toolkit · Upgrade to 0.1.13 or later · < 0.1.13 · CVE-2026-4269 · GHSA-xfhr-q72q-jcrj · amended
- Medium, CVSS 6.8
AWS API MCP File Access Restriction Bypass
PyPI awslabs-aws-api-mcp-server · Upgrade to 1.3.9 or later · >= 0.2.14, < 1.3.9; >= 0.2.14, < 1.3.9 · CVE-2026-4270 · GHSA-2cpp-j2fc-qhp7 · amended
- Critical, CVSS 9.3Exploited · CISA KEV
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
PyPI langflow · Upgrade to 1.9.0 or later · <= 1.8.2 · CVE-2026-33017 · GHSA-vwmf-pq79-vjvx · amended
- High, CVSS 7.5
music-metadata has an infinite loop vulnerability in ASF parser
npm music-metadata · Upgrade to 11.12.3 or later · <= 11.12.1 · CVE-2026-32256 · GHSA-v6c2-xwv6-8xf7 · amended
- Medium, CVSS 6.9
Parse Server affected by empty authData bypassing credential requirement on signup
npm parse-server · Upgrade to 9.6.0-alpha.29 (pre-release) or 8.6.49 by release line · >= 9.0.0, < 9.6.0-alpha.29; < 8.6.49 · CVE-2026-33042 · GHSA-wjqw-r9x4-j59v · amended
- Medium, CVSS 6.3
astral-tokio-tar insufficiently validates PAX extensions during extraction
crates.io astral-tokio-tar · Upgrade to 0.6.0 or later · <= 0.5.6 · CVE-2026-32766 · GHSA-6gx3-4362-rf54
- Medium, CVSS 6.5
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
Go github.com/tektoncd/pipeline · Upgrade to 1.10.2, 1.9.2, 1.6.1 or 2 more by release line · >= 0.60.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2 · CVE-2026-33022 · GHSA-cv4x-93xx-wgfj
- High, CVSS 7.5
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
npm fast-xml-parser · Upgrade to 5.5.6 or 4.5.5 by release line · >= 5.0.0, < 5.5.6; >= 4.0.0-beta.3, < 4.5.5 · CVE-2026-33036 · GHSA-8gc5-j5rx-235r · amended
- Medium, CVSS 4.7
Tillitis TKey Client has an Error in Protocol Implementation
Go github.com/tillitis/tkeyclient · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-32953 · GHSA-4w7r-3222-8h6v
- High, CVSS 7.5
Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Maven io.micronaut:micronaut-http-server · Upgrade to 4.10.17 or later · >= 4.7.0, < 4.10.17 · CVE-2026-33012 · GHSA-2hcp-gjrf-7fhc
- High, CVSS 8.7
Nest Fastify HEAD Request Middleware Bypass
npm @nestjs/platform-fastify · Upgrade to 11.1.16 or later · <= 11.1.15 · CVE-2026-33011 · GHSA-wf42-42fg-fg84 · amended
- Medium, CVSS 4.6
Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)
GitHub Actions step-security/harden-runner · Upgrade to 2.16.0 or later · <= 2.15.1 · CVE-2026-32947 · GHSA-46g3-37rh-v698
- Medium, CVSS 4.6
Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)
GitHub Actions step-security/harden-runner · Upgrade to 2.16.0 or later · <= 2.15.1 · CVE-2026-32946 · GHSA-g699-3x6g-wm3g
- Medium, CVSS 5.9
Parse Server LiveQuery subscription with invalid regular expression crashes server
npm parse-server · Upgrade to 9.6.0-alpha.19 (pre-release) or 8.6.43 by release line · >= 9.0.0, < 9.6.0-alpha.19; < 8.6.43 · CVE-2026-32770 · GHSA-827p-g5x5-h86c · amended
- Medium, CVSS 4.3
Parse Server session creation endpoint allows overwriting server-generated session fields
npm parse-server · Upgrade to 9.6.0-alpha.17 (pre-release) or 8.6.42 by release line · >= 9.0.0, < 9.6.0-alpha.17; < 8.6.42 · CVE-2026-32742 · GHSA-5v7g-9h8f-8pgg · amended
- Medium, CVSS 5.3
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
npm parse-server · Upgrade to 9.6.0-alpha.20 (pre-release) or 8.6.44 by release line · >= 9.0.0, < 9.6.0-alpha.20; < 8.6.44 · CVE-2026-32878 · GHSA-9ccr-fpp6-78qf · amended
- High, CVSS 8.2
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
npm parse-server · Upgrade to 9.6.0-alpha.24 (pre-release) or 8.6.47 by release line · >= 9.0.0, < 9.6.0-alpha.24; < 8.6.47 · CVE-2026-32886 · GHSA-4263-jgmp-7pf4 · amended
- Low, CVSS 2.3
Parse Server has a password reset token single-use bypass via concurrent requests
npm parse-server · Upgrade to 9.6.0-alpha.28 (pre-release) or 8.6.48 by release line · >= 9.0.0, < 9.6.0-alpha.28; < 8.6.48 · CVE-2026-32943 · GHSA-r3xq-68wh-gwvh · amended
- High, CVSS 8.7
Parse Server crash via deeply nested query condition operators
npm parse-server · Upgrade to 9.6.0-alpha.21 (pre-release) or 8.6.45 by release line · >= 9.0.0, < 9.6.0-alpha.21; < 8.6.45 · CVE-2026-32944 · GHSA-9xp9-j92r-p88v · amended
- Medium, CVSS 6.0
Devise has a confirmable "change email" race condition permits user to confirm email they have no access to
RubyGems devise · Upgrade to 5.0.3 or later · <= 5.0.2 · CVE-2026-32700 · GHSA-57hq-95w6-v4fc
- Medium, CVSS 5.3
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.11.0 or later · < 14.11.0 · CVE-2026-32636 · GHSA-gc62-2v5p-qpmp
- High, CVSS 7.1
Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS
Go github.com/cloudnativelabs/kube-router/v2 · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-32254 · GHSA-phqm-jgc3-qf8g
- Critical, CVSS 9.6
jsPDF has HTML Injection in New Window paths
npm jspdf · Upgrade to 4.2.1 or later · <= 4.2.0 · CVE-2026-31938 · GHSA-wfv2-pwc8-crg5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.