High, CVSS 8.8
Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.33.0 or later · <= 8.32.0 · CVE-2026-44829 · GHSA-hwc4-gmrw-5222
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–87 of 87 matching · newest first
- High, CVSS 7.0
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
npm axios · Upgrade to 1.15.2 or 0.31.1 by release line · >= 1.0.0, < 1.15.2; >= 0.19.0, < 0.31.1 · CVE-2026-44495 · GHSA-3g43-6gmg-66jw · amended
- High, CVSS 8.7
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in
config.proxynpm axios · Upgrade to 1.16.0 or later · >= 1.0.0, < 1.16.0 · CVE-2026-44494 · GHSA-35jp-ww65-95wh · amended
- High, CVSS 8.6
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · <= 0.31.1; >= 1.15.0, < 1.16.0 · CVE-2026-44492 · GHSA-pjwm-pj3p-43mv · amended
- Medium, CVSS 4.8
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44490 · GHSA-898c-q2cr-xwhg · amended
- Low, CVSS 3.7
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
npm axios · Upgrade to 1.16.0 or later · >= 1.15.2, <= 1.15.2 · CVE-2026-44489 · GHSA-654m-c8p4-x5fp · amended
- High, CVSS 8.6
Froxlor has an incomplete fix for CVE-2026-30932
Packagist froxlor/froxlor · Upgrade to 2.3.7 or later · <= 2.3.6 · CVE-2026-41237 · GHSA-j6fm-9rfm-j5hx
- High, CVSS 8.8
Froxlor has privilege escalation in SSH key synchronization via symlinked
authorized_keyspathPackagist froxlor/froxlor · Upgrade to 2.3.7 or later · >= 2.3.6, <= 2.3.6 · CVE-2026-41236 · GHSA-mq5v-pxpm-8jw2
- High, CVSS 8.6
Froxlor has an authorization bypass in FTP shell assignment via missing server-side
available_shellsenforcementPackagist froxlor/froxlor · Upgrade to 2.3.7 or later · >= 2.3.6, <= 2.3.6 · CVE-2026-41235 · GHSA-gcv3-5v9q-fmhh
- High, CVSS 7.4
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via
gh attestation,gh release verify, andgh release verify-assetcommandsGo github.com/cli/cli/v2 · Upgrade to 2.93.0 or later · <= 2.92.0 · CVE-2026-48501 · GHSA-8xvp-7hj6-mcj9
- High, CVSS 8.7
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.1 or later · <= 26.0.0 · CVE-2026-48527 · GHSA-g2g8-95qg-v35h · amended
- Medium, CVSS 5.3
OpenStack Neutron has an Incorrect Authorization issue
PyPI neutron · Upgrade to 28.0.1, 27.0.3 or 26.0.4 by release line · >= 28.0.0, < 28.0.1; >= 27.0.0, < 27.0.3; >= 26.0.0, < 26.0.4 · CVE-2026-49299 · GHSA-xv24-hxh9-2hh9 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.