High, CVSS 7.1
OpenAM OAuth Client Impersonation via JWKS Resolver Cache
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-47426 · GHSA-f2cx-463q-7m2c · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
OpenAM Authenticated RCE via Groovy Sandbox Escape
Maven org.openidentityplatform.openam:openam-scripting · Upgrade to 16.1.1 or later · <= 16.0.6 · CVE-2026-47424 · GHSA-69j4-qvqr-hpw3
- Critical, CVSS 9.8
ExecuTorch integer overflow vulnerability
PyPI executorch +1 · Upgrade all 2 to 0.7.0 or later · < 0.7.0 · CVE-2025-30404 · GHSA-hj95-mhgf-jxc4 · amended
- Critical, CVSS 9.8
ExecuTorch vulnerable to Heap-based Buffer Overflow
PyPI executorch +1 · Upgrade all 2 to 0.7.0 or later · < 0.7.0 · CVE-2025-54951 · GHSA-xc7w-r669-48pf · amended
- Critical, CVSS 9.8
ExecuTorch heap buffer overflow vulnerability
PyPI executorch +1 · Upgrade all 2 to 0.7.0 or later · < 0.7.0 · CVE-2025-54949 · GHSA-9m39-3mf3-xwch · amended
- Critical, CVSS 9.8
ExecuTorch out-of-bounds access vulnerability
PyPI executorch +1 · Upgrade all 2 to 0.7.0 or later · < 0.7.0 · CVE-2025-54950 · GHSA-f9hx-c6jf-3qxm · amended
- Critical, CVSS 9.8
ExecuTorch integer overflow vulnerability
PyPI executorch +1 · Upgrade all 2 to 0.7.0 or later · < 0.7.0 · CVE-2025-30405 · GHSA-84m3-f99p-cqx5 · amended
- High, CVSS 8.2
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
npm pnpm · Upgrade to 11.8.0 or 10.34.4 by release line · < 10.34.4; >= 11.0.0, < 11.8.0 · CVE-2026-59195 · GHSA-qrv3-253h-g69c · amended
- High, CVSS 7.1
pnpm:
patch-removecould delete project-selected files outside the patches directorynpm pnpm · Upgrade to 11.7.0 or 10.34.4 by release line · < 10.34.4; >= 11.0.0, < 11.7.0 · CVE-2026-59194 · GHSA-72r4-9c5j-mj57 · amended
- High, CVSS 7.1
pnpm: Hoisted install imports lockfile alias outside node_modules
npm pnpm · Upgrade to 11.7.0 or 10.34.4 by release line · < 10.34.4; >= 11.0.0, < 11.7.0 · CVE-2026-59196 · GHSA-fr4h-3cph-29xv · amended
- High, CVSS 7.1
pnpm:
stage downloadwrites outside its destination directory via manifest name/version traversalnpm pnpm · Upgrade to 11.5.3 or later · >= 11.3.0, < 11.5.3 · CVE-2026-55700 · GHSA-v23m-ccfg-pq9h · amended
- High, CVSS 8.8
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55698 · GHSA-w466-c33r-3gjp · amended
- High, CVSS 7.1
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49338 · GHSA-hmgp-w9jm-vp95
- High, CVSS 7.1
gonic: Path Traversal in playlist
idbypasses ownership check, enabling any user to read/delete other users' playlistsGo go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49339 · GHSA-2fp4-5v5c-4448
- High, CVSS 8.1
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49340 · GHSA-4gxv-p5g5-j7w7
- High, CVSS 7.5
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55697 · GHSA-gj8w-mvpf-x27x · amended
- High, CVSS 7.5
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55487 · GHSA-5wx6-mg75-v57r · amended
- Critical, CVSS 9.1
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
Go github.com/nezhahq/nezha · Upgrade to 2.0.13 or later · < 2.0.13 · CVE-2026-53519 · GHSA-5c25-7vpj-9mqh
- High, CVSS 7.3
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50015 · GHSA-rxhj-4m44-96r4 · amended
- High, CVSS 8.8
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50016 · GHSA-hwx4-2j3j-g496 · amended
- Critical, CVSS 9.9
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
Go github.com/nezhahq/nezha · Upgrade to 2.0.10; some affected versions have no fix yet · >= 1.14.13, <= 1.14.14; >= 2.0.0, <= 2.0.9 · GHSA-q6xx-5vr8-p898
- High, CVSS 7.5
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
npm js-toml · Upgrade to 1.1.2 or later · < 1.1.2 · CVE-2026-49293 · GHSA-wp3c-266w-4qfq · amended
- High, CVSS 8.9
SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings
Packagist solidinvoice/solidinvoice · Upgrade to 2.3.16 or later · <= 2.3.15 · GHSA-7vfx-4246-jcfh
- High, CVSS 7.4
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
Packagist statamic/cms · Upgrade to 6.20.0 or 5.73.23 by release line · < 5.73.23; >= 6.0.0, < 6.20.0 · CVE-2026-49287 · GHSA-m92m-r54r-x8r2
- High, CVSS 8.1
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Packagist pontedilana/php-weasyprint · Upgrade to 2.6.0 or later · <= 2.5.1 · CVE-2026-49286 · GHSA-2fmj-p74r-3wjm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.