High, CVSS 7.4
Elo backends have code injection via unvalidated emission of programmatic AST fields
npm @enspirit/elo · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-44265 · GHSA-x9rp-7wh3-2rj5 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
176–200 of 30,910 matching · newest first
- High, CVSS 8.2
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
Go github.com/mtzanidakis/praktor · Upgrade to 0.9.1 or later · < 0.9.1 · CVE-2026-62331 · GHSA-48v2-6jcm-fc99 · amended
- High, CVSS 8.1
Keycloak has authentication bypass via jwt algorithm confusion
Bitnami keycloak +1 · Upgrade all 2 to 26.6.4 or later · >= 26.6.0, < 26.6.4 · CVE-2026-11800 · GHSA-j97h-3f8r-mrjr · amended
- Unrated
Netfoil doesn't decrement TTL
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.6.1 or later · >= 0.3.0, < 0.6.1 · GHSA-9ppr-wfw9-xvr2 · amended
- High, CVSS 7.3
Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution
NuGet metalama.framework · Upgrade to 2026.1.19, 2026.0.25 or 2025.1.18 by release line · >= 2026.1.0-preview, < 2026.1.19; < 2025.1.18; >= 2026.0.1-preview, < 2026.0.25 · CVE-2026-62848 · GHSA-h26j-4vp7-x9w2 · amended
- Unrated
Arc has unauthenticated application log disclosure via
/api/v1/logsGo github.com/basekick-labs/arc · Upgrade to 0.0.0-20260615165136-bb7d9761ad98 (pre-release) or later · < 0.0.0-20260615165136-bb7d9761ad98 · GHSA-m3qr-fvp4-78xj · amended
- High, CVSS 7.9
Out-of-bounds read when decoding internal keys shorter than 16 bytes
crates.io surrealkv · Upgrade to 1.2.0 or later · >= 0.0.0-0, < 1.2.0 · GHSA-9fm9-c4h4-8g93
- High, CVSS 7.8
Data race and double free via unsound
Send/Syncinreblessivecrates.io surrealdb-core · Upgrade to 4.0.0 or later · >= 0.0.0-0, < 4.0.0 · GHSA-m9qr-4rcq-3jhc
- Medium, CVSS 6.1
DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
npm @bytebase/dbhub · Upgrade to 0.22.6 or later · < 0.22.6 · CVE-2026-61789 · GHSA-j656-3hf2-fvjc · amended
- Unrated
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
crates.io arrow-data · Upgrade to 60.1.0, 59.3.2, 58.4.1 or 57.3.2 by release line · >= 33.0.0, < 57.3.2; >= 58.0.0, < 58.4.1; >= 59.0.0, < 59.3.2; >= 60.0.0, < 60.1.0 · CVE-2026-111959 · GHSA-gqmm-qrjq-4c7h
- Medium, CVSS 4.7
Path traversal in
rio-vtKitty graphics protocol handler allows out-of-bounds file delete (and read)crates.io rio-vt · Upgrade to 0.5.29 or later · >= 0.0.0-0, < 0.5.29
- Medium, CVSS 5.5
Unbounded memory allocation in
evtxparsing a.wevtcachefilecrates.io evtx · Upgrade to 0.15.1 or later · >= 0.11.0, < 0.15.1
- Medium, CVSS 5.3
codeq: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)crates.io codeq · Upgrade to 0.6.3 or later · >= 0.0.0-0, < 0.6.3
- High, CVSS 7.5
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260831164314-ba9ae72cc860 (pre-release); some affected versions have no fix yet · < 0.0.0-20260831164314-ba9ae72cc860; >= 1.7.0-alpha.3, <= 1.7.0-alpha.3 · CVE-2026-118761 · GHSA-8fmv-6rg5-5924 · amended
- High, CVSS 7.5
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260904182349-be4723e33727 (pre-release); some affected versions have no fix yet · < 0.0.0-20260904182349-be4723e33727; >= 1.7.0-alpha.3, <= 1.7.0-alpha.3 · CVE-2026-118759 · GHSA-wg5q-x4j9-qm54 · amended
- High, CVSS 7.1
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
PyPI pypdf · Upgrade to 6.21.4 or later · < 6.21.4 · CVE-2026-119203 · GHSA-5849-834g-hvw5 · amended
- High, CVSS 7.1
pypdf has possible large memory usage when parsing page tree
PyPI pypdf · Upgrade to 6.21.4 or later · < 6.21.4 · CVE-2026-119204 · GHSA-cggf-277g-3q54 · amended
- High, CVSS 7.1
pypdf has possible infinite loop when cloning dictionaries
PyPI pypdf · Upgrade to 6.21.4 or later · < 6.21.4 · CVE-2026-119205 · GHSA-mfr5-77xh-9j7h · amended
- Medium, CVSS 6.9
minimatch has potential denial of service via globparts amplification
npm minimatch · Upgrade to 11.0.1 or later · >= 7.0.0, < 11.0.1 · CVE-2026-118764 · GHSA-g3hv-75wg-m249 · amended
- Medium, CVSS 6.3
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
npm glob · Upgrade to 14.0.2 or later · >= 9.0.0, < 14.0.2 · CVE-2026-118773 · GHSA-3g3m-2fjr-6pw4 · amended
- High, CVSS 8.8
Authlib RFC 7592 examples omit registration-access-token client binding
PyPI authlib · Upgrade to 1.9.1 or later · >= 0.15, < 1.9.1 · CVE-2026-116672 · GHSA-c73q-w75p-j82v · amended
- High, CVSS 7.1
pypdf has possible long runtimes when retrieving page labels
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119206 · GHSA-42gh-23hr-vphw · amended
- High, CVSS 7.1
pypdf has possible large memory usage for exceptions in strict mode
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119207 · GHSA-4vqv-7265-gm2w · amended
- High, CVSS 7.1
pypdf has possible long runtimes/large memory usage for encrypted PDF files
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119208 · GHSA-62m5-6wh8-28x7 · amended
- High, CVSS 7.1
pypdf has possible large memory usage when parsing cross-reference streams
PyPI pypdf · Upgrade to 6.21.3 or later · < 6.21.3 · CVE-2026-119209 · GHSA-x3rh-gjgm-fmqc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.