High, CVSS 7.3
Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-67260 · GHSA-q4c3-7575-55j2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-67587 · GHSA-2qjv-p2gc-mjg2
- High, CVSS 8.8
Apache Airflow exception-node deserialization permits arbitrary callable execution
PyPI apache-airflow · Upgrade to 3.3.1 or later · >= 3.3.0, < 3.3.1 · CVE-2026-58076 · GHSA-8prw-8m6x-8w6f
- High, CVSS 8.6
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
PyPI compliance-trestle · Upgrade to 4.1.0 or later · < 4.1.0 · CVE-2026-52776 · GHSA-h47f-gmjp-m7rr
- High, CVSS 7.1
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
NuGet ssh.net · Upgrade to 2026.0.0 or later · <= 2025.1.0 · CVE-2026-48798 · GHSA-q939-rpr3-3284 · amended
- High, CVSS 7.5
nimiq-blockchain: Validity store off by one error
crates.io nimiq-blockchain · Upgrade to 1.5.1 or later · <= 1.5.0 · CVE-2026-46369 · GHSA-3763-qp59-59vf · amended
- High, CVSS 7.1
Winter: Authenticated backend users can bypass Users controller permission checks
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-35445 · GHSA-j5jq-cr68-v2xx · amended
- High, CVSS 8.1
Winter: Stored XSS through Editor Settings custom styles
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · >= 1.2.10, < 1.2.13 · CVE-2026-32258 · GHSA-vgp4-2fc4-qff2 · amended
- High, CVSS 8.1
Winter: Stored XSS through Brand Settings custom styles
Packagist winter/wn-backend-module · Upgrade to 1.2.13 or later · <= 1.2.12 · CVE-2026-32257 · GHSA-v7cf-8gh9-gxmj · amended
- High, CVSS 7.0
Heimdall: IP Spoofing via Unvalidated Forwarding Headers in github.com/dadrus/heimdall
Go github.com/dadrus/heimdall · Upgrade to 0.17.17 or later · < 0.17.17 · CVE-2026-57210 · GHSA-38x9-25wx-7fg2 · amended
- High, CVSS 7.8
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
Go github.com/traefik/traefik/v3 · Upgrade to 3.7.3 or later · >= 3.7.0, < 3.7.3 · +1 more package · CVE-2026-48491 · GHSA-5r4w-85f3-pw66 · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62871 · GHSA-vg44-h755-9hw7 · amended
- High, CVSS 7.0
Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62897 · GHSA-fx4q-gjrx-2jw6 · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-70354 · GHSA-gg8c-3338-xw2f · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62886 · GHSA-jqhp-238x-qhgf · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +10 · Upgrade all 11 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62901 · GHSA-m93f-wj8c-rp8p · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62898 · GHSA-c494-m2fq-59mx · amended
- Critical, CVSS 9.3
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171120-69da20bdaec9 (pre-release) or later · < 0.0.0-20260512171120-69da20bdaec9 · CVE-2026-73080 · GHSA-87fv-vqqr-m4jr · amended
- High, CVSS 7.0
SAP Approuter has an Information Disclosure vulnerability
npm @sap/approuter · Upgrade to 23.0.0 or later · < 23.0.0 · CVE-2026-58230 · GHSA-vhh6-v828-x62f
- Critical, CVSS 9.9
Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs
PyPI feast · Upgrade to 0.67.0 or later · < 0.67.0 · CVE-2026-18948 · GHSA-gg2p-37pv-v7fq · amended
- High, CVSS 8.7
Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3 or later · >= 2.1.0, < 2.1.3 · CVE-2026-8798 · GHSA-v6w3-qrh8-qccc · amended
- High, CVSS 8.7
Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · CVE-2026-13505 · GHSA-98j2-6v39-78w8 · amended
- Critical, CVSS 9.0
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
npm crypto-js · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-71851 · GHSA-rg76-677x-56q9 · amended
- High, CVSS 7.5
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
PyPI pymdown-extensions · Upgrade to 11.0.1 or later · <= 11.0.0 · CVE-2026-67422 · GHSA-gm37-52c6-37mw
- Critical, CVSS 9.8
CodeIgniter: Uploaded file extension validation bypass in
is_imageandmime_inrulesPackagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63223 · GHSA-mmj4-63m4-r6h5
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.