High, CVSS 7.6
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
npm network-ai · Upgrade to 5.4.5 or later · <= 5.4.4 · CVE-2026-46701 · GHSA-j3vx-cx2r-pvg8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.6
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
crates.io boxlite +4 · Upgrade all 5 to 0.9.0 or later · < 0.9.0 · CVE-2026-46703 · GHSA-f396-4rp4-7v2j · amended
- Critical, CVSS 10.0
BoxLite: Permission Bypass Allows Modification of Read-Only Files
crates.io boxlite +4 · Upgrade all 5 to 0.9.0 or later · < 0.9.0 · CVE-2026-46695 · GHSA-g6ww-w5j2-r7x3 · amended
- High, CVSS 7.2
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
npm @nevware21/ts-utils · Upgrade to 0.14.0 or later · <= 0.13.0 · CVE-2026-46681 · GHSA-x7j8-49r8-mr43 · amended
- High, CVSS 7.3
containerd user ID handling bypass allows runAsNonRoot evasion
Go github.com/containerd/containerd · Upgrade to 1.7.32 or later · >= 1.7.27, < 1.7.32 · +1 more package · CVE-2026-46680 · GHSA-fqw6-gf59-qr4w
- High, CVSS 7.5
js-libp2p: Memory DoS via subscription flood of unique topics
npm @libp2p/gossipsub · Upgrade to 15.0.23 or later · <= 15.0.22 · CVE-2026-46679 · GHSA-4f8r-922h-2vgv · amended
- High, CVSS 8.7
Twig: Arbitrary PHP code execution via
_self.( )macro-reference compilationPackagist twig/twig · Upgrade to 3.26.0 or later · >= 3.15.0, < 3.26.0 · CVE-2026-46640 · GHSA-45vw-wh46-2vx8
- High, CVSS 8.7
Twig: Sandbox property and method bypass via object-destructuring assignment
Packagist twig/twig · Upgrade to 3.26.0 or later · >= 3.24.0, < 3.26.0 · CVE-2026-46639 · GHSA-mm6w-gr99-p3jj
- High, CVSS 7.5
Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8350 · GHSA-g7xp-jf3x-wcx4
- High, CVSS 7.3
Concrete CMS has Stored XSS through its height parameter
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8203 · GHSA-9v2g-37mp-qpxf
- High, CVSS 7.5
Concrete does not validate a CSRF token before processing requests to
/dashboard/extend/update/do_update/Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8417 · GHSA-jr5g-qv3g-rxxx
- High, CVSS 7.5
Concrete CMS contains a CSRF vulnerability
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8421 · GHSA-4c8m-6fwx-m7xq
- High, CVSS 7.5
Concrete CMS does not validate a CSRF token before processing requests to
/dashboard/extend/update/prepare_remote_upgrade/Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8426 · GHSA-5rj5-gfmr-hrc3
- High, CVSS 7.5
Concrete CMS is Vulnerable to Cross-Site Request Forgery
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8428 · GHSA-prxr-vjgc-2cq9
- High, CVSS 7.3
Concrete CMS is vulnerable to Stored XSS via OAuth integration name
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8197 · GHSA-h72c-xx3w-w8h7
- Critical, CVSS 9.4
Concrete CMS Vulnerable to Relative Path Traversal
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8134 · GHSA-645j-cm4x-3xvw
- High, CVSS 7.5
Concrete CMS is Vulnerable to Cross-Site Request Forgery
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8140 · GHSA-r42c-3rr2-jrfp
- High, CVSS 8.7
LiteLLM allows a user to modify their own user_role via the /user/update endpoint
PyPI litellm · Upgrade to 1.83.10 or later · < 1.83.10 · CVE-2026-47102 · GHSA-wpfp-gwwc-vwq6 · amended
- High, CVSS 8.9
Concrete CMS Vulnerable to Deserialization of Untrusted Data
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8135 · GHSA-pv2v-6w2v-97x6
- High, CVSS 8.7
LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
PyPI litellm · Upgrade to 1.83.14 or later · < 1.83.14 · CVE-2026-47101 · GHSA-qrc4-49gv-mv9m · amended
- Critical, CVSS 9.3
Twig: PHP code injection via
{% use %}template namePackagist twig/twig · Upgrade to 3.26.0 or later · >= 1.15.1, < 3.26.0 · CVE-2026-46633 · GHSA-7p85-w9px-jpjp · amended
- High, CVSS 7.5
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
npm js-cookie · Upgrade to 3.0.7 or later · <= 3.0.5 · CVE-2026-46625 · GHSA-qjx8-664m-686j · amended
- High, CVSS 7.5
Russh: Unchecked CryptoVec allocation and growth handling is reachable
crates.io russh +1 · Upgrade all 2 to 0.60.3 or later · <= 0.60.2 · CVE-2026-46673 · GHSA-g9f8-wqj9-fjw5
- High, CVSS 8.7
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82855 · GHSA-59f3-7227-wmh4 · amended
- Critical, CVSS 9.3
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82856 · GHSA-q2f7-m237-v562 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.