High, CVSS 7.7
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
npm @hapi/content · Upgrade to 6.0.2 or later · < 6.0.2 · CVE-2026-44974 · GHSA-36hh-x5p5-jgc8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
Packagist pimcore/admin-ui-classic-bundle · Upgrade to 2.3.6 or 1.7.18 by release line · >= 2.0.0-RC1, <= 2.3.5; < 1.7.18 · CVE-2026-44741 · GHSA-h4ph-crvj-9h92
- High, CVSS 8.7
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
Packagist pimcore/pimcore · Upgrade to 2026.1.2, 12.3.6 or 11.5.17 by release line · >= 2026.1.0, < 2026.1.2; <= 11.5.16; >= 12.0.0-RC1, <= 12.3.5 · CVE-2026-44739 · GHSA-3234-gxc3-pq6f
- High, CVSS 7.7
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
npm tmp · Upgrade to 0.2.6 or later · < 0.2.6 · CVE-2026-44705 · GHSA-ph9p-34f9-6g65 · amended
- Critical, CVSS 9.1
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in
JavaExprAlgorithmExecutionFactoryMaven org.yamcs:yamcs-core · Upgrade to 5.12.7 or later · < 5.12.7 · CVE-2026-44632 · GHSA-524g-x36v-9wm6
A vendor fix does not resolve your finding until you verify it in your own systems.