Critical, CVSS 9.9
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50566 · GHSA-m63v-2g9w-2w6v
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.9
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50564 · GHSA-gx55-f84r-v3r7
- Critical, CVSS 9.9
Fission Container Executor Function PodSpec Injection Leading to Node Escape
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50563 · GHSA-v455-mv2v-5g92
- Critical, CVSS 9.9
Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-50545 · GHSA-wmgg-3p4h-48x7
- High, CVSS 8.5
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49824 · GHSA-cvw6-gfvv-953q
- High, CVSS 7.7
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49823 · GHSA-3r8v-2xmj-5c39
- High, CVSS 7.7
Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49822 · GHSA-gc3j-79f2-7vvw
- High, CVSS 7.7
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · CVE-2026-49821 · GHSA-vjhc-cf4p-72q4
- High, CVSS 8.1
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec
Go github.com/fission/fission · Upgrade to 1.24.0 or later · <= 1.23.0 · GHSA-7m8x-qg2j-4m3v
- High, CVSS 8.8
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
npm @cedar-policy/authorization-for-expressjs · Upgrade to 0.3.0 or later · <= 0.2.0 · CVE-2026-49473 · GHSA-g4w6-vmgf-xqvx · amended
- High, CVSS 8.5
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Packagist paymenter/paymenter · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-47198 · GHSA-5q4q-834j-g8g4
- High, CVSS 7.5
Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
NuGet microsoft.openapi · Upgrade to 3.5.4 or 2.7.5 by release line · >= 3.0.0, <= 3.5.3; >= 2.0.0-preview.11, <= 2.7.4 · CVE-2026-49451 · GHSA-v5pm-xwqc-g5wc
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-54475 · GHSA-mhp6-f224-j2c3 · amended
- High, CVSS 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
Bitnami activemq +4 · Upgrade all 5 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-53917 · GHSA-f77w-px59-cqf5 · amended
- High, CVSS 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49432 · GHSA-xjwq-9jw5-jf7w · amended
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49434 · GHSA-h5gm-rvw6-2xpx · amended
- High, CVSS 8.1
Apache ActiveMQ Improper Authorization vulnerability
Bitnami activemq +1 · Upgrade all 2 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-49877 · GHSA-f892-4h9f-j7g9 · amended
- High, CVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · >= 5.19.7, < 5.19.8; >= 6.2.6, < 6.2.7 · CVE-2026-50750 · GHSA-9qj4-v6r6-3wmx · amended
- High, CVSS 7.5
Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
Bitnami activemq +3 · Upgrade all 4 to 6.2.7 or 5.19.8 by release line · < 5.19.8; >= 6.0.0, < 6.2.7 · CVE-2026-50734 · GHSA-7259-vf48-52q3 · amended
- High, CVSS 7.5
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
PyPI nltk · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-12243 · GHSA-m42h-3232-vpv3 · amended
- High, CVSS 7.5
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
Go github.com/dgraph-io/dgraph/v25 · Upgrade to 25.3.4 or later · <= 25.3.3 · CVE-2026-44840 · GHSA-q2m9-6jp9-c6mc
- High, CVSS 7.3
Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability
Bitnami tomcat · Upgrade to 11.0.5, 10.1.37 or 9.0.101 by release line · < 9.0.101; >= 10.0.0, < 10.1.37; >= 11.0.0, < 11.0.5 · +3 more packages · CVE-2026-53404 · GHSA-h792-v28v-ppgr · amended
- Critical, CVSS 9.1
Apache Tomcat util accepted misconfigured CRLs
Maven org.apache.tomcat:tomcat-util · Upgrade to 11.0.23, 10.1.56 or 9.0.119 by release line · >= 11.0.0-M1, <= 11.0.22; >= 10.1.0-M7, <= 10.1.55; >= 9.0.83, <= 9.0.118 · CVE-2026-53434 · GHSA-4x29-79gh-6v8q · amended
- High, CVSS 7.3
Apache Tomcat has a Missing Critical Step in Authentication vulnerability
Bitnami tomcat · Upgrade to 11.0.5, 10.1.37 or 9.0.101 by release line · < 9.0.101; >= 10.0.0, < 10.1.37; >= 11.0.0, < 11.0.5 · +3 more packages · CVE-2026-55957 · GHSA-7895-gffq-w6jq · amended
- Critical, CVSS 9.1
Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability
Bitnami tomcat · Upgrade to 11.0.23, 10.1.56 or 9.0.119 by release line · < 9.0.119; >= 10.0.0, < 10.1.56; >= 11.0.0, < 11.0.23 · +3 more packages · CVE-2026-55276 · GHSA-mqg3-r7h5-24x4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.