High, CVSS 8.4
flyto-core has Unauthenticated Command Execution via HTTP MCP execute_module
PyPI flyto-core · Upgrade to 2.26.4 or later · >= 2.26.2, < 2.26.4 · CVE-2026-55786 · GHSA-h9f9-h6gm-wc85 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
flyto-core has Unauthenticated Command Execution via HTTP MCP
- High, CVSS 7.1
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
PyPI flyto-core · Upgrade to 2.26.3 or later · <= 2.26.2 · CVE-2026-55787 · GHSA-794r-5rp2-fpg8 · amended
- High, CVSS 7.7
Scriban: Template Writes to Arbitrary CLR Properties via
TypedObjectAccessor(Mass Assignment +private/init/internalSetter Bypass)NuGet scriban · Upgrade to 7.2.2 or later · <= 7.2.1 · GHSA-7jvp-hj45-2f2m
- Critical, CVSS 9.2
Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access
Go github.com/cilium/cilium · Upgrade to 1.19.2, 1.18.8 or 1.17.14 by release line · >= 1.19.0, < 1.19.2; >= 1.18.0, < 1.18.8; < 1.17.14 · CVE-2026-49445 · GHSA-3fcv-jvfp-m4q9
- Critical, CVSS 9.8
Formie Hidden field defaults vulnerable to Server-Side Template Injection
Packagist verbb/formie · Upgrade to 3.1.27 or later · < 3.1.27 · CVE-2026-52889 · GHSA-565m-g33j-jq96
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46292 · GHSA-55f6-pf8r-c2f4 · amended
- High, CVSS 7.3
Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
Maven org.apache.camel:camel-couchbase · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46587 · GHSA-46jf-c9vx-hh79
- High, CVSS 8.1
Apache Airflow Google provider allows path traversal through GCS object names
PyPI apache-airflow-providers-google · Upgrade to 22.2.1 or later · < 22.2.1 · CVE-2026-49297 · GHSA-v3mh-27qj-w836 · amended
- High, CVSS 7.3
Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
Maven org.apache.camel:camel-couchdb · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46588 · GHSA-5g68-f6xg-vf2r
- High, CVSS 7.3
Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters
Maven org.apache.camel:camel-langchain4j-tools +2 · Upgrade all 3 to 4.21.0 or 4.18.3 by release line · >= 4.8.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49042 · GHSA-hh8r-75r6-qrg9
- Critical, CVSS 9.1
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
Maven org.apache.camel:camel-dns · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48205 · GHSA-hcm8-x79p-wx2w
- Critical, CVSS 9.8
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
Maven org.apache.camel:camel-keycloak · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-53913 · GHSA-qvc3-6q9x-95pj
- High, CVSS 7.5
Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy
Maven org.apache.camel:camel-atmosphere-websocket · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-55993 · GHSA-rcvm-6r79-cf4r
- Critical, CVSS 9.8
Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy
Maven org.apache.camel:camel-aws2-sns · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-56140 · GHSA-w2v8-8q6c-3rhr
- High, CVSS 7.5
Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy
Maven org.apache.camel:camel-iggy · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.17.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-55994 · GHSA-pw9q-pq7c-rfqw
- Critical, CVSS 9.1
Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters…
Maven org.apache.camel:camel-solr · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48203 · GHSA-4h4f-v54q-7pq8
- High, CVSS 8.2
Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation…
Maven org.apache.camel:camel-neo4j · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.10.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46591 · GHSA-q86m-qjpm-vqcw
- Critical, CVSS 9.8
Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers
Maven org.apache.camel:camel-mongodb-gridfs · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48204 · GHSA-f7g3-2cg6-f5hj
- High, CVSS 7.5
Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the…
Maven org.apache.camel:camel-cxf-rest +1 · Upgrade all 2 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46592 · GHSA-mrrp-9gjm-749v
- Critical, CVSS 9.8
Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
Maven org.apache.camel:camel-aws2-sqs · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46456 · GHSA-cmc3-hr79-8mmv
- High, CVSS 7.5
Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy
Maven org.apache.camel:camel-vertx-websocket · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46726 · GHSA-hgg5-gp4c-gpcg
- High, CVSS 7.5
Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search…
Maven org.apache.camel:camel-lucene · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46585 · GHSA-566h-v38h-3xp3
- High, CVSS 8.8
Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete…
Maven org.apache.camel:camel-pqc · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46590 · GHSA-857v-xvh8-7hjc
- Critical, CVSS 9.8
Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter
Maven org.apache.camel:camel-pqc · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43867 · GHSA-7cmx-qjh8-7v3v
- High, CVSS 7.3
Apache Camel JMS deserialization filter bypass
Maven org.apache.camel:camel-activemq +5 · Upgrade all 6 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 3.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43866 · GHSA-f755-xp6r-8q84
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.