High, CVSS 7.0
MLFlow Creates a Temporary File With Insecure Permissions
PyPI mlflow · Upgrade to 3.11.0 or later · >= 1.26.0, < 3.11.0 · CVE-2026-4137 · GHSA-f2m9-wcf4-cwwx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Summarize contains a path traversal vulnerability
npm @steipete/summarize · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2026-45242 · GHSA-8jr4-6r33-phwm · amended
- High, CVSS 7.5
ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46522 · GHSA-7gg8-qqx7-92g5
- High, CVSS 7.5
ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-46520 · GHSA-36wm-hprc-mcf5
- High, CVSS 7.5
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +7 · Upgrade all 8 to 6.9.7 or later · <= 6.9.6 · CVE-2026-45367 · GHSA-3653-68v6-rq57
- High, CVSS 7.5
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
PyPI nicegui · Upgrade to 3.12.0 or later · <= 3.11.1 · CVE-2026-45553 · GHSA-jfrm-rx66-g536 · amended
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · >= 0.7.0, < 0.9.0 · CVE-2026-45686 · GHSA-43g7-cwr8-q3jh
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45685 · GHSA-j8p6-96vp-f3r9
- High, CVSS 7.3
Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-35433 · GHSA-8x9c-mqxv-q2pp
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-42899 · GHSA-9v76-4qcc-frgh
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +3 · Upgrade all 4 to 10.0.8, 9.0.16 or 8.0.27 by release line · >= 8.0.0, <= 8.0.26; >= 9.0.0, <= 9.0.15; >= 10.0.0, <= 10.0.7 · CVE-2026-32175 · GHSA-rg75-q538-x34v
- High, CVSS 7.5
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
Go go.opentelemetry.io/obi · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45678 · GHSA-pgvv-q3wf-mm9m
- High, CVSS 8.8
CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
PyPI cloakbrowser · Upgrade to 0.3.28 or later · <= 0.3.27 · CVE-2026-45727 · GHSA-mf33-gv72-w2h5 · amended
- High, CVSS 8.8
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
npm @budibase/worker · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45716 · GHSA-c54j-xp92-wh28 · amended
- High, CVSS 8.1
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
npm n8n-mcp · Upgrade to 2.51.2 or later · <= 2.51.1 · CVE-2026-45707 · GHSA-jxx9-px88-pj69 · amended
- High, CVSS 7.5
multiparty vulnerable to ReDoS via filename parsing
npm multiparty · Upgrade to 4.3.0 or later · <= 4.2.3 · CVE-2026-8159 · GHSA-65x3-rw7q-gx94 · amended
- High, CVSS 7.5
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
npm multiparty · Upgrade to 4.3.0 or later · <= 4.2.3 · CVE-2026-8162 · GHSA-xh3c-6gcq-g4rv · amended
- High, CVSS 7.5
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
npm multiparty · Upgrade to 4.3.0 or later · <= 4.2.3 · CVE-2026-8161 · GHSA-qxch-whhj-8956 · amended
- High, CVSS 7.4
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
RubyGems jwt · Upgrade to 3.2.0 or 2.10.3 by release line · >= 3.0.0, < 3.2.0; < 2.10.3 · CVE-2026-45363 · GHSA-c32j-vqhx-rx3x
- Critical, CVSS 9.8
Formie: Pre-authenticated server-side template injection in Hidden fields
Packagist verbb/formie · Upgrade to 3.1.24 or 2.2.20 by release line · >= 3.0.0-beta.1, < 3.1.24; < 2.2.20 · CVE-2026-45697 · GHSA-x7m9-mwc2-g6w2
- High, CVSS 8.2
TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
Go github.com/DatanoiseTV/tinyice · Upgrade to 2.5.0 or later · >= 0.8.95, <= 2.4.1 · CVE-2026-45327 · GHSA-p7c4-8x34-8j8f
- High, CVSS 8.2
@tmlmobilidade/utils has prototype pollution in its setValueAtPath
npm @tmlmobilidade/utils · Upgrade to 20260509.340.15 or later · < 20260509.340.15 · CVE-2026-45325 · GHSA-cmxg-94mg-jq94
- High, CVSS 7.5
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
npm dynoxide +1 · Upgrade all 2 to 0.9.13 or later · >= 0.9.3, < 0.9.13 · CVE-2026-42559 · GHSA-fvh2-gm75-j4j7 · amended
- High, CVSS 8.2
parse-nested-form-data has Prototype Pollution via
__proto__in FormData field namesnpm parse-nested-form-data · Upgrade to 1.0.1 or later · <= 1.0.0 · CVE-2026-45302 · GHSA-xp7r-j8r6-j9h3 · amended
- High, CVSS 7.4
async-http-client: Cookie header not stripped on cross-origin redirect
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.10 or 2.15.0 by release line · >= 3.0.0.Beta1, < 3.0.10; >= 2.0.0, < 2.15.0 · CVE-2026-45300 · GHSA-fmxf-pm6p-7xgm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.