Medium, CVSS 4.8
OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function
PyPI richie · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-26717 · GHSA-xjhr-fm27-4hmx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9951–9975 of 31,071 matching · newest first
- Unrated
OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field
Go github.com/openkruise/kruise · Upgrade to 1.8.3 or 1.7.5 by release line · >= 1.8.0, < 1.8.3; < 1.7.5 · CVE-2026-24005 · GHSA-9fj4-3849-rv9g
- High, CVSS 8.9
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
Maven com.mchange:mchange-commons-java · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2026-27727 · GHSA-m2cm-222f-qw44
- Medium, CVSS 6.5
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
npm @astrojs/node · Upgrade to 9.5.4 or later · >= 9.0.0, < 9.5.4 · CVE-2026-27829 · GHSA-cj9f-h6r6-4cx2 · amended
- Critical, CVSS 9.9
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
npm @oneuptime/common · Upgrade to 10.0.7 or later · < 10.0.7 · CVE-2026-27728 · GHSA-jmhp-5558-qxh5 · amended
- High, CVSS 8.2
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
npm hono · Upgrade to 4.12.2 or later · >= 4.12.0, < 4.12.2 · CVE-2026-27700 · GHSA-xh87-mx6m-69f3 · amended
- High, CVSS 7.7
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder
Go github.com/BishopFox/sliver · Upgrade to 1.7.2 or later · < 1.7.2 · GHSA-2phg-qgmm-r638
- Critical, CVSS 10.0
@enclave-vm/core is vulnerable to Sandbox Escape
npm @enclave-vm/core · Upgrade to 2.11.1 or later · <= 2.10.1 · CVE-2026-27597 · GHSA-f229-3862-4942 · amended
- Critical, CVSS 9.9
OliveTin: OS Command Injection via
passwordargument type and webhook JSON extraction bypasses shell safety checksGo github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260222101908-4bbd2eab1532 (pre-release) or later · < 0.0.0-20260222101908-4bbd2eab1532 · CVE-2026-27626 · GHSA-49gm-hh7w-wfvf
- Low, CVSS 1.2
pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams
PyPI pypdf · Upgrade to 6.7.2 or later · < 6.7.2 · CVE-2026-27628 · GHSA-2rw7-x74f-jg35 · amended
- Medium, CVSS 6.8
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
Packagist typicms/core · Upgrade to 16.1.7, 15.0.29, 14.0.27 or 2 more by release line · >= 16.0.0, < 16.1.7; >= 15.0.0, < 15.0.29; >= 14.0.0, < 14.0.27; >= 13.0.0, < 13.0.9; < 12.0.5 · CVE-2026-27621 · GHSA-xfvg-8v67-j7wp
- Critical, CVSS 9.3
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
PyPI bugsink · Upgrade to 2.0.13 or later · < 2.0.13 · CVE-2026-27614 · GHSA-vp6q-7m36-pq3w · amended
- Medium, CVSS 6.1
repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard
npm repostat · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-27612 · GHSA-fm8c-6m29-rp6j · amended
- High, CVSS 7.1
FileBrowser Quantum: Password Protection Not Enforced on Shared File Links
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260221163904-dbcfba993b85 (pre-release) or later · < 0.0.0-20260221163904-dbcfba993b85 · CVE-2026-27611 · GHSA-8vrh-3pm2-v4v6
- Medium, CVSS 5.3
Fickling has safety check bypass via REDUCE+BUILD opcode sequence
PyPI fickling · Upgrade to 0.1.8 or later · <= 0.1.7 · GHSA-mhc9-48gj-9gp3 · amended
- Low, CVSS 3.7
ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.3 or later · < 14.10.3 · CVE-2026-25984 · GHSA-273h-m46v-96q4 · amended
- High, CVSS 8.7
esm.sh is vulnerable to full-response SSRF
Go github.com/esm-dev/esm.sh · Upgrade to 0.0.0-20250616164159-0593516c4cfa (pre-release) or later · < 0.0.0-20250616164159-0593516c4cfa · CVE-2025-50180 · GHSA-3c9r-837r-qqm4
- High, CVSS 8.6
Fickling: OBJ opcode call invisibility bypasses all safety checks
PyPI fickling · Upgrade to 0.1.8 or later · < 0.1.8 · GHSA-mxhj-88fx-4pcv · amended
- Critical, CVSS 9.3
Statamic is vulnerable to account takeover via password reset link injection
Packagist statamic/cms · Upgrade to 6.7.1 or 5.73.10 by release line · < 5.73.10; >= 6.0.0-alpha.1, < 6.7.1 · CVE-2026-27593 · GHSA-jxq9-79vj-rgvw
- Medium, CVSS 6.9
Wasmtime can panic when adding excessive fields to a
wasi:http/types.fieldsinstancecrates.io wasmtime · Upgrade to 40.0.4, 36.0.6 or 24.0.6 by release line · < 24.0.6; >= 25.0.0, < 36.0.6; >= 37.0.0, < 40.0.4 · CVE-2026-27572 · GHSA-243v-98vx-264h
- Medium, CVSS 6.9
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Go github.com/gofiber/fiber/v3 · Upgrade to 3.1.0 or later · <= 3.0.0 · +1 more package · CVE-2026-25882 · GHSA-mrq8-rjmw-wpq3
- High, CVSS 7.5
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Go github.com/gofiber/fiber/v3 · Upgrade to 3.1.0 or later · <= 3.0.0 · CVE-2026-25899 · GHSA-2mr3-m5q5-wgp6
- High, CVSS 8.7
Fiber has an Arbitrary File Read in Static Middleware on Windows
Go github.com/gofiber/fiber/v3 · Upgrade to 3.1.0 or later · <= 3.0.0 · CVE-2026-25891 · GHSA-m3c2-496v-cw3v
- Medium, CVSS 5.9
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
crates.io wasmtime · Upgrade to 40.0.4, 36.0.6 or 24.0.6 by release line · < 24.0.6; >= 25.0.0, < 36.0.6; >= 37.0.0, < 40.0.4 · CVE-2026-27204 · GHSA-852m-cvvp-9p4w
- Medium, CVSS 6.9
Wasmtime is vulnerable to panic when dropping a
[Typed]Func::call_asyncfuturecrates.io wasmtime · Upgrade to 41.0.4 or 40.0.4 by release line · >= 39.0.0, < 40.0.4; >= 41.0.0, < 41.0.4 · CVE-2026-27195 · GHSA-xjhv-v822-pf94
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.