High, CVSS 7.5
ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-49218 · GHSA-8pj9-6897-74xc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Go github.com/sigstore/rekor · Upgrade to 1.5.2 or later · >= 0.3.0, < 1.5.2 · CVE-2026-48702 · GHSA-47q9-m4ww-924m
- High, CVSS 8.8
Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission
PyPI lemur · Upgrade to 1.9.1 or later · <= 1.9.0 · CVE-2026-48508 · GHSA-qcqw-jwxc-2hqg · amended
- High, CVSS 7.5
MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48506 · GHSA-vh6j-jc39-fggf
- High, CVSS 7.4
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
Packagist filament/filament · Upgrade to 5.6.5 or 4.11.5 by release line · >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5 · CVE-2026-48505 · GHSA-mc5j-f6wx-h9qh
- High, CVSS 8.2
MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
NuGet messagepack · Upgrade to 3.1.7 or later · >= 3.0, < 3.1.7 · CVE-2026-48502 · GHSA-382j-8mxh-c7x2
- High, CVSS 7.5
amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()
PyPI amazon-braket-sdk · Upgrade to 1.117.0 or later · >= 1.10.0, < 1.117.0 · CVE-2026-9291 · GHSA-g697-2xrc-gc46 · amended
- Critical, CVSS 9.1
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
npm i18next-fs-backend · Upgrade to 2.6.6 or later · < 2.6.6 · CVE-2026-48713 · GHSA-2933-q333-qg83 · amended
- Critical, CVSS 9.1
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
npm i18next-http-middleware · Upgrade to 3.9.7 or later · < 3.9.7 · CVE-2026-48714 · GHSA-f49m-vf83-692w · amended
- High, CVSS 7.5
OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing
Maven org.openidentityplatform.openam:openam-radius · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46560 · GHSA-386j-6m86-78f9 · amended
- High, CVSS 7.1
OpenAM Arbitrary OAuth Token Minting via Push Registration
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46498 · GHSA-cj8f-2fhf-826r · amended
- High, CVSS 7.7
OpenAM has Unsafe Java Deserialization via SNS
Maven org.openidentityplatform.openam:openam-push-notification · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45794 · GHSA-pp89-732f-3g8q · amended
- High, CVSS 8.2
Apache Shiro shiro-guice module vulnerable to authentication bypass
Maven org.apache.shiro:shiro-guice · Upgrade to 3.0.0 or later · >= 2.0.0, < 3.0.0 · CVE-2026-56091 · GHSA-qj64-jj84-w38j · amended
- High, CVSS 7.1
Tiptap contains an input validation vulnerability resulting in DoS
Packagist ueberdosis/tiptap-php · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-47110 · GHSA-4595-7fjw-r3jh
- Critical, CVSS 9.3
Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto
PyPI feast · Upgrade to 0.63.0 or later · < 0.63.0 · CVE-2026-56121 · GHSA-q63x-9pfm-mjx4 · amended
- Critical, CVSS 9.3
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
Maven org.openidentityplatform.openam:openam-federation-library · Upgrade to 16.1.1 or later · <= 16.0.6 · CVE-2026-45052 · GHSA-p462-xxwx-pqf4
- Critical, CVSS 9.2
OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
Maven org.openidentityplatform.openam:openam-auth-webauthn · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45051 · GHSA-6c99-87fr-6q7r · amended
- High, CVSS 7.3
Payara Server Full has a Cross-Site Request Forgery vulnerability
Maven fish.payara.distributions:payara · Upgrade to 7.2026.6 or later · >= 4.0.0, < 7.2026.6 · CVE-2026-12986 · GHSA-x939-7fq5-v9v6
- High, CVSS 8.8
Jenkins External Workspace Manager Plugin has a path traversal vulnerability
Maven org.jenkins-ci.plugins:external-workspace-manager · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-57296 · GHSA-hrmj-8fm9-cg8x
- High, CVSS 8.8
Jenkins Script Security Plugin sandbox bypass vulnerability
Maven org.jenkins-ci.plugins:script-security · Upgrade to 1402.1405.vc96e74964250 or later · < 1402.1405.vc96e74964250 · CVE-2026-57280 · GHSA-c3jm-9vj7-5v66
- High, CVSS 7.5
Jenkins Script Security Plugin has a script security bypass vulnerability
Maven org.jenkins-ci.plugins:script-security · Upgrade to 1402.1405.vc96e74964250 or later · < 1402.1405.vc96e74964250 · CVE-2026-57281 · GHSA-cfj9-2vgr-hpxp
- High, CVSS 8.5
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · <= 8.6.1 · CVE-2026-54329 · GHSA-pwpj-p52h-q484
- High, CVSS 7.1
Snipe-IT: Bulk editing users allowed
ldap_importandactivated_inbulk editing usersPackagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-48507 · GHSA-6f75-x745-xcpr
- High, CVSS 8.2
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
Go github.com/xyproto/algernon · Upgrade to 1.17.8 or later · <= 1.17.7 · CVE-2026-48126 · GHSA-jc3j-x6pg-4hmv
- High, CVSS 8.8
Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist
Maven org.springframework.statemachine:spring-statemachine-kryo · Upgrade to 4.0.2; some affected versions have no fix yet · >= 3.2.0, <= 3.2.4; >= 4.0.0, <= 4.0.1 · CVE-2026-41862 · GHSA-85qj-f5wg-rwp9
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.