Critical, CVSS 10.0
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
npm 9router · Upgrade to 0.4.37 or later · >= 0.4.30, < 0.4.37 · CVE-2026-46339 · GHSA-fhh6-4qxv-rpqj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 85 matching · newest first
- Critical, CVSS 9.8
Kopia: RCE via SSH ProxyCommand Injection
Go github.com/kopia/kopia · Upgrade to 0.23.0 or later · <= 0.22.3 · CVE-2026-45695 · GHSA-2q4c-3mrw-63c3
- High, CVSS 8.7
Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)
Maven net.sf.jasperreports:jasperreports · Upgrade to 7.0.7 or later · < 7.0.7 · CVE-2026-6009 · GHSA-9wxq-mwqw-8hhg
- Medium, CVSS 6.1
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
npm @apify/actors-mcp-server · Upgrade to 0.9.21 or later · < 0.9.21 · CVE-2026-46341 · GHSA-jwp7-wg77-3w9v · amended
- High, CVSS 7.6
Budibase: Unrestricted Upload of File with Dangerous Type
npm budibase · Upgrade to 3.38.2 or later · < 3.38.2 · CVE-2026-46426 · GHSA-82rc-gxrg-v4gf · amended
- Medium, CVSS 4.2
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
npm @budibase/backend-core · Upgrade to 3.38.2 or later · < 3.38.2 · CVE-2026-46424 · GHSA-6vp2-6r7m-2jvx · amended
- Medium, CVSS 5.3
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
npm protobufjs · Upgrade to 8.2.0 or 7.5.8 by release line · <= 7.5.7; >= 8.0.0, < 8.2.0 · CVE-2026-45740 · GHSA-jggg-4jg4-v7c6 · amended
- High, CVSS 8.2
libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case
crates.io libcrux-ml-dsa · Upgrade to 0.0.9 or later · < 0.0.9 · GHSA-fhvh-vw7h-9xf3
- High, CVSS 8.2
libcrux: Potential Panic on Overlong Ciphertext Buffer
crates.io libcrux-chacha20poly1305 · Upgrade to 0.0.8 or later · < 0.0.8 · GHSA-hc3c-63hc-2r9f
- Medium, CVSS 6.3
Envoy AI Proxy - MCP Message Smuggling Vulnerability
Go github.com/envoyproxy/ai-gateway · Upgrade to 0.6.0 or later · < 0.6.0 · GHSA-4gph-2hhr-5mwg
- High, CVSS 7.5
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Packagist composer/composer · Upgrade to 2.9.8, 2.2.28 or 1.10.28 by release line · >= 2.3.0, < 2.9.8; >= 2.0.0, < 2.2.28; >= 1.0, < 1.10.28 · CVE-2026-45793 · GHSA-f9f8-rm49-7jv2
- Medium, CVSS 5.3
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
npm n8n · Upgrade to 2.20.0 or later · < 2.20.0 · CVE-2026-56348 · GHSA-3875-8gcx-7v46 · amended
- Medium, CVSS 5.3
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
npm n8n · Upgrade to 2.19.3 or later · < 2.19.3 · CVE-2026-56352 · GHSA-2vx9-7wpg-88jq · amended
- Low, CVSS 3.1
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
PyPI strawberry-graphql · Upgrade to 0.315.4 or later · >= 0.288.4, <= 0.315.3 · CVE-2026-45739 · GHSA-x97m-qp5c-w9xj · amended
- Medium, CVSS 6.3
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Go github.com/argoproj/argo-cd/v3 · Upgrade to 3.4.2, 3.3.10 or 3.2.12 by release line · >= 3.2.0, <= 3.2.11; >= 3.3.0-rc1, <= 3.3.9; >= 3.4.0-rc1, <= 3.4.1 · CVE-2026-45737 · GHSA-rg3g-4rw9-gqrp
- High, CVSS 7.5
Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
Go github.com/axllent/mailpit · Upgrade to 1.30.0 or later · < 1.30.0 · CVE-2026-45713 · GHSA-fpxj-m5q8-fphw
- Medium, CVSS 5.9
Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)
Go github.com/axllent/mailpit · Upgrade to 1.30.0 or later · < 1.30.0 · CVE-2026-45712 · GHSA-w4vj-r5pg-3722
- Medium, CVSS 5.9
Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
Go github.com/axllent/mailpit · Upgrade to 1.30.0 or later · < 1.30.0 · CVE-2026-45711 · GHSA-qx5x-85p8-vg4j
- Medium, CVSS 5.8
Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
Go github.com/axllent/mailpit · Upgrade to 1.30.0 or later · >= 1.28.3, < 1.30.0 · CVE-2026-45709 · GHSA-j3fj-qppj-fmmc
- Medium, CVSS 5.4
Caddy: Remote Admin Authorization Bypass in
/configAPI via Array Index NormalizationGo github.com/caddyserver/caddy/v2 · Upgrade to 2.11.3 or later · >= 2.4.0, < 2.11.3 · CVE-2026-45692 · GHSA-x5w9-xh9r-mvfc
- Medium, CVSS 5.9
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
npm @nuxt/rspack-builder +1 · Upgrade all 2 to 4.4.6 or 3.21.6 by release line · >= 3.15.4, <= 3.21.5; >= 4.0.0-alpha.1, <= 4.4.5 · CVE-2026-45670 · GHSA-6m52-m754-pw2g · amended
- Medium, CVSS 5.3
Nuxt: Reflected XSS in
navigateTo()external redirectnpm nuxt · Upgrade to 4.4.6 or 3.21.6 by release line · >= 3.4.3, <= 3.21.5; >= 4.0.0-alpha.1, <= 4.4.5 · CVE-2026-45669 · GHSA-fx6j-w5w5-h468 · amended
- High, CVSS 8.1
ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation
Maven land.oras:oras-java-sdk · Upgrade to 0.6.2 or later · <= 0.6.1 · GHSA-xm96-gfjx-jcrc
- High, CVSS 8.2
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
npm auth-fetch-mcp · Upgrade to 3.0.1 or later · <= 3.0.0 · GHSA-hv85-774v-26fg · amended
- Medium, CVSS 5.5
fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode
Maven org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim · Upgrade to 2.5.10 or later · >= 2.3.1, <= 2.5.9 · CVE-2026-45581 · GHSA-wg5x-3g47-v38r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.