High, CVSS 7.6
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
npm network-ai · Upgrade to 5.4.5 or later · <= 5.4.4 · CVE-2026-46701 · GHSA-j3vx-cx2r-pvg8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 77 matching · newest first
- Critical, CVSS 9.6
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
crates.io boxlite +4 · Upgrade all 5 to 0.9.0 or later · < 0.9.0 · CVE-2026-46703 · GHSA-f396-4rp4-7v2j · amended
- Critical, CVSS 10.0
BoxLite: Permission Bypass Allows Modification of Read-Only Files
crates.io boxlite +4 · Upgrade all 5 to 0.9.0 or later · < 0.9.0 · CVE-2026-46695 · GHSA-g6ww-w5j2-r7x3 · amended
- Low, CVSS 3.7
ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · GHSA-qv2q-c278-pch5
- Low, CVSS 3.3
ImageMagick: Division by Zero in binomial kernel
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · GHSA-vf33-6r7x-66xx
- Medium, CVSS 6.2
ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · GHSA-jqq5-8px3-9m6m
- High, CVSS 7.2
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
npm @nevware21/ts-utils · Upgrade to 0.14.0 or later · <= 0.13.0 · CVE-2026-46681 · GHSA-x7j8-49r8-mr43 · amended
- High, CVSS 7.3
containerd user ID handling bypass allows runAsNonRoot evasion
Go github.com/containerd/containerd · Upgrade to 1.7.32 or later · >= 1.7.27, < 1.7.32 · +1 more package · CVE-2026-46680 · GHSA-fqw6-gf59-qr4w
- High, CVSS 7.5
js-libp2p: Memory DoS via subscription flood of unique topics
npm @libp2p/gossipsub · Upgrade to 15.0.23 or later · <= 15.0.22 · CVE-2026-46679 · GHSA-4f8r-922h-2vgv · amended
- Medium, CVSS 6.8
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
PyPI pydantic-ai +1 · Upgrade all 2 to 1.99.0 or later · >= 1.56.0, < 1.99.0 · CVE-2026-46678 · GHSA-cqp8-fcvh-x7r3 · amended
- Medium, CVSS 4.4
Rust OneNote File Parser: Path traversal in
Parser::parse_notebookallows reading files outside the notebook directorycrates.io onenote_parser · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2026-46671 · GHSA-4j5m-wc25-pvh7
- Medium, CVSS 4.3
SQLAdmin: Authorization Bypass on
ajax_lookupPyPI sqladmin · Upgrade to 0.25.1 or later · <= 0.25.0 · CVE-2026-46645 · GHSA-54mc-gghv-4cfj · amended
- High, CVSS 8.7
Twig: Arbitrary PHP code execution via
_self.( )macro-reference compilationPackagist twig/twig · Upgrade to 3.26.0 or later · >= 3.15.0, < 3.26.0 · CVE-2026-46640 · GHSA-45vw-wh46-2vx8
- High, CVSS 8.7
Twig: Sandbox property and method bypass via object-destructuring assignment
Packagist twig/twig · Upgrade to 3.26.0 or later · >= 3.24.0, < 3.26.0 · CVE-2026-46639 · GHSA-mm6w-gr99-p3jj
- Medium, CVSS 6.3
Concrete CMS is vulnerable to authorization bypass in the Calendar Block
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8205 · GHSA-46xh-7854-f568
- High, CVSS 7.5
Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8350 · GHSA-g7xp-jf3x-wcx4
- High, CVSS 7.3
Concrete CMS has Stored XSS through its height parameter
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8203 · GHSA-9v2g-37mp-qpxf
- High, CVSS 7.5
Concrete does not validate a CSRF token before processing requests to
/dashboard/extend/update/do_update/Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8417 · GHSA-jr5g-qv3g-rxxx
- High, CVSS 7.5
Concrete CMS contains a CSRF vulnerability
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8421 · GHSA-4c8m-6fwx-m7xq
- High, CVSS 7.5
Concrete CMS does not validate a CSRF token before processing requests to
/dashboard/extend/update/prepare_remote_upgrade/Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8426 · GHSA-5rj5-gfmr-hrc3
- Medium, CVSS 6.3
Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8204 · GHSA-x2fp-hj8c-mmxh
- High, CVSS 7.5
Concrete CMS is Vulnerable to Cross-Site Request Forgery
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8428 · GHSA-prxr-vjgc-2cq9
- High, CVSS 7.3
Concrete CMS is vulnerable to Stored XSS via OAuth integration name
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8197 · GHSA-h72c-xx3w-w8h7
- Critical, CVSS 9.4
Concrete CMS Vulnerable to Relative Path Traversal
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8134 · GHSA-645j-cm4x-3xvw
- High, CVSS 7.5
Concrete CMS is Vulnerable to Cross-Site Request Forgery
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8140 · GHSA-r42c-3rr2-jrfp
A vendor fix does not resolve your finding until you verify it in your own systems.