High, CVSS 7.5
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
PyPI banks · Upgrade to 2.4.3 or later · < 2.4.3 · CVE-2026-61536 · GHSA-64vx-6h2c-rjh7 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Go github.com/chainguard-dev/kaniko · Upgrade to 1.25.20 or later · < 1.25.20 · CVE-2026-105769 · GHSA-5q7h-w9jf-cx97 · amended
- High, CVSS 8.4
lxd allows Cross-guest volume hijack via DevLXD device patch
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260626085133-7cb96ac80a6d (pre-release) or later · >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d · CVE-2026-12411 · GHSA-hhf9-qw4v-72xp · amended
- High, CVSS 7.8
Stanza: RCE via pickle deserialization in the lemmatizer
PyPI stanza · Upgrade to 1.15.0 or later · >= 1.14.0, < 1.15.0 · CVE-2026-115878 · GHSA-gh9r-c94j-cmp5 · amended
- Critical, CVSS 9.8
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered
.constructormember accessnpm @enspirit/elo · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-44267 · GHSA-33r5-xmm8-v6x5 · amended
- Critical, CVSS 9.8
Elo Ruby backend has Remote Code Execution via unescaped
#{...}interpolation in emitted string literals and subtype-constraint labelsnpm @enspirit/elo · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-44266 · GHSA-7w38-ggh5-v542 · amended
- High, CVSS 7.4
Elo backends have code injection via unvalidated emission of programmatic AST fields
npm @enspirit/elo · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-44265 · GHSA-x9rp-7wh3-2rj5 · amended
- High, CVSS 8.2
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
Go github.com/mtzanidakis/praktor · Upgrade to 0.9.1 or later · < 0.9.1 · CVE-2026-62331 · GHSA-48v2-6jcm-fc99 · amended
- High, CVSS 8.1
Keycloak has authentication bypass via jwt algorithm confusion
Bitnami keycloak +1 · Upgrade all 2 to 26.6.4 or later · >= 26.6.0, < 26.6.4 · CVE-2026-11800 · GHSA-j97h-3f8r-mrjr · amended
- High, CVSS 7.3
Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution
NuGet metalama.framework · Upgrade to 2026.1.19, 2026.0.25 or 2025.1.18 by release line · >= 2026.1.0-preview, < 2026.1.19; < 2025.1.18; >= 2026.0.1-preview, < 2026.0.25 · CVE-2026-62848 · GHSA-h26j-4vp7-x9w2 · amended
- High, CVSS 7.9
Out-of-bounds read when decoding internal keys shorter than 16 bytes
crates.io surrealkv · Upgrade to 1.2.0 or later · >= 0.0.0-0, < 1.2.0 · GHSA-9fm9-c4h4-8g93
- High, CVSS 7.8
Data race and double free via unsound
Send/Syncinreblessivecrates.io surrealdb-core · Upgrade to 4.0.0 or later · >= 0.0.0-0, < 4.0.0 · GHSA-m9qr-4rcq-3jhc
- High, CVSS 7.5
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260831164314-ba9ae72cc860 (pre-release); some affected versions have no fix yet · < 0.0.0-20260831164314-ba9ae72cc860; >= 1.7.0-alpha.3, <= 1.7.0-alpha.3 · CVE-2026-118761 · GHSA-8fmv-6rg5-5924 · amended
- High, CVSS 7.5
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260904182349-be4723e33727 (pre-release); some affected versions have no fix yet · < 0.0.0-20260904182349-be4723e33727; >= 1.7.0-alpha.3, <= 1.7.0-alpha.3 · CVE-2026-118759 · GHSA-wg5q-x4j9-qm54 · amended
- High, CVSS 7.1
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
PyPI pypdf · Upgrade to 6.21.4 or later · < 6.21.4 · CVE-2026-119203 · GHSA-5849-834g-hvw5 · amended
- High, CVSS 7.1
pypdf has possible large memory usage when parsing page tree
PyPI pypdf · Upgrade to 6.21.4 or later · < 6.21.4 · CVE-2026-119204 · GHSA-cggf-277g-3q54 · amended
- High, CVSS 7.1
pypdf has possible infinite loop when cloning dictionaries
PyPI pypdf · Upgrade to 6.21.4 or later · < 6.21.4 · CVE-2026-119205 · GHSA-mfr5-77xh-9j7h · amended
- High, CVSS 8.8
Authlib RFC 7592 examples omit registration-access-token client binding
PyPI authlib · Upgrade to 1.9.1 or later · >= 0.15, < 1.9.1 · CVE-2026-116672 · GHSA-c73q-w75p-j82v · amended
- High, CVSS 7.1
pypdf has possible long runtimes when retrieving page labels
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119206 · GHSA-42gh-23hr-vphw · amended
- High, CVSS 7.1
pypdf has possible large memory usage for exceptions in strict mode
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119207 · GHSA-4vqv-7265-gm2w · amended
- High, CVSS 7.1
pypdf has possible long runtimes/large memory usage for encrypted PDF files
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119208 · GHSA-62m5-6wh8-28x7 · amended
- High, CVSS 7.1
pypdf has possible large memory usage when parsing cross-reference streams
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119209 · GHSA-x3rh-gjgm-fmqc · amended
- High, CVSS 7.5
pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · < 0.6.5 · CVE-2026-119196 · GHSA-2qm8-x737-gmw5 · amended
- High, CVSS 7.5
pyasn1 has quadratic-complexity denial of service in binary REAL decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · < 0.6.5 · CVE-2026-119197 · GHSA-mm57-4v3p-rchx · amended
- High, CVSS 7.5
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · < 0.6.5 · CVE-2026-119195 · GHSA-9m75-vc3g-4x39 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.