Critical, CVSS 9.1
lettre has TLS hostname verification disabled when using Boring TLS backend
crates.io lettre · Upgrade to 0.11.22 or later · >= 0.10.1, < 0.11.22 · CVE-2026-46428 · GHSA-4pj9-g833-qx53 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
Packagist wp-coding-standards/wpcs · Upgrade to 3.4.1 or later · >= 0.14.1, < 3.4.1 · CVE-2026-45293 · GHSA-3pwp-g2mj-5p3v · amended
- High, CVSS 8.2
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Maven io.appium:java-client · Upgrade to 10.1.1 or later · >= 8.2.1, <= 10.1.0 · CVE-2026-43910 · GHSA-28f5-38xr-jh2w · amended
- High, CVSS 8.5
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260419162744-978ac87deffe (pre-release) or later · < 0.0.0-20260419162744-978ac87deffe · CVE-2026-43983 · GHSA-w6p7-2fxx-4f44 · amended
- High, CVSS 7.5
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-24451 · GHSA-wrf9-r3h7-7x5v · amended
- High, CVSS 8.1
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale
officialApproval FlagGo code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58439 · GHSA-w5pg-649r-p6gg · amended
- Critical, CVSS 9.6
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · >= 1.22.0, < 1.26.2 · CVE-2026-58426 · GHSA-hg5r-vq93-9fv6 · amended
- High, CVSS 7.5
Gitea: Unauthorized Access to Labels of Private Organizations
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-25038 · GHSA-v73x-hx65-6pf4 · amended
- High, CVSS 7.5
Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
Go code.gitea.io/gitea · Upgrade to 1.26.4 or later · <= 1.26.2 · CVE-2026-58421 · GHSA-v96j-25gv-g2w9 · amended
- High, CVSS 8.8
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
Go github.com/ollama/ollama · Upgrade to 0.17.1 or later · < 0.17.1 · CVE-2026-7482 · GHSA-x8qc-fggm-mpqg · amended
- High, CVSS 8.7
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Go github.com/aquasecurity/trivy · Upgrade to 0.71.0 or later · < 0.71.0 · CVE-2026-54448 · GHSA-q3fv-x8vg-qqm4 · amended
- High, CVSS 7.5
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.0 or later · < 2.11.0 · CVE-2026-54063 · GHSA-h69g-9hx6-f3v4 · amended
- High, CVSS 8.8
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
Go google.golang.org/grpc · Upgrade to 1.82.1 or later · < 1.82.1 · GHSA-hrxh-6v49-42gf · amended
- High, CVSS 7.5
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability
PyPI thrift · Upgrade to 0.24.0 or later · < 0.24.0 · CVE-2026-41608 · GHSA-6pjx-3pjc-mrj8
- High, CVSS 8.7
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
PyPI thrift +3 · Upgrade all 4 to 0.24.0 or later · < 0.24.0 · CVE-2026-43871 · GHSA-8wv5-x4w7-5gww · amended
- High, CVSS 7.5
Remote Denial of Service via malformed NIP-04 IV
crates.io nostr · Upgrade to 0.45.0-alpha.6 (pre-release) or 0.44.6 by release line · >= 0.0.0-0, < 0.44.6; >= 0.45.0-alpha.1, < 0.45.0-alpha.6 · GHSA-xg7c-246g-6qpv
- High, CVSS 8.5
NLTK vulnerable to Eval Injection via collocations CLI arguments
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2025-71408 · GHSA-848c-c2cx-j7qx · amended
- High, CVSS 8.4
AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
PyPI bedrock-agentcore · Upgrade to 1.18.1 or later · < 1.18.1 · CVE-2026-16796 · GHSA-j6g5-3hh3-pgw8 · amended
- High, CVSS 8.7
Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
crates.io aws-smithy-http-server · Upgrade to 0.66.5 or later · <= 0.66.4 · CVE-2026-16756 · GHSA-jvxp-qmx7-gjpx
- High, CVSS 7.5
OmniFaces: Forged combined-resource IDs and related output/push boundaries
Maven org.omnifaces:omnifaces · Upgrade to 5.4.2, 4.7.12, 3.14.23 or 2 more by release line · < 1.14.3; >= 2.0.0, < 2.7.33; >= 3.0.0, < 3.14.23; >= 4.0.0, < 4.7.12; >= 5.0.0, < 5.4.2 · CVE-2026-102695 · GHSA-fp43-vj7g-pg92
- High, CVSS 8.7
Shescape: Quadratic-time denial of service in the flag-protection
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · >= 2.1.11, < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73413 · GHSA-gm3r-q2wp-hw87 · amended
- Critical, CVSS 9.2
Shescape: Shell injection via unescaped parentheses on Windows with CMD
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73414 · GHSA-w4hw-qcx7-56pr · amended
- High, CVSS 7.3
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
PyPI awslabs-aws-api-mcp-server · Upgrade to 1.3.47 or later · >= 0.2.13, < 1.3.47 · CVE-2026-16584 · GHSA-29w2-fq35-v728 · amended
- High, CVSS 7.5
blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
Maven org.http4s:http4s-blaze-server_2.12 · Upgrade to 0.23.18 or later · < 0.23.18 · +2 more packages · CVE-2026-73493 · GHSA-7ppr-r889-mcf2
- High, CVSS 7.4
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
Maven org.http4s:blaze-http_3 · Upgrade to 1.0.0-M42 (pre-release) or 0.23.18 by release line · <= 0.23.17; >= 1.0.0-M1, < 1.0.0-M42 · +2 more packages · CVE-2026-73495 · GHSA-46q4-43ph-c6fr
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.