High, CVSS 8.1
Froxlor's API Authentication bypasses 2FA Authentication
Packagist froxlor/froxlor · Upgrade to 2.3.7 or later · < 2.3.7 · CVE-2026-52793 · GHSA-f9rx-7wf7-jr36
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 10.0
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
PyPI jupyter-enterprise-gateway · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-44182 · GHSA-cfw7-6c5v-2wjq · amended
- Critical, CVSS 10.0
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
PyPI jupyter-enterprise-gateway · Upgrade to 3.3.0 or later · >= 2.0.0rc2, < 3.3.0 · CVE-2026-44181 · GHSA-f49j-v924-fx9w · amended
- High, CVSS 8.4
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
Packagist concrete5/concrete5 · Upgrade to 9.5.2 or later · < 9.5.2 · CVE-2026-7888 · GHSA-52pr-7vmf-2w7x
- Critical, CVSS 9.8
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
PyPI jupyter-enterprise-gateway · Upgrade to 3.3.0 or later · >= 2.0.0rc1, < 3.3.0 · CVE-2026-44180 · GHSA-chq7-94j8-cj28 · amended
- High, CVSS 8.6
Docling Core: Unsafe remote filename resolution
PyPI docling-core · Upgrade to 2.74.1 or later · >= 1.5.0, < 2.74.1 · CVE-2026-44023 · GHSA-jmmv-h3mp-59v8 · amended
- High, CVSS 8.1
Docling Core: Insufficient validation of image reference URIs
PyPI docling-core · Upgrade to 2.74.1 or later · >= 2.5.0, < 2.74.1 · CVE-2026-44019 · GHSA-j5xp-7m2f-49jv · amended
- High, CVSS 7.1
Docling: Unsafe URI and Path Handling in HTML Backend
PyPI docling · Upgrade to 2.94.0 or later · < 2.94.0 · CVE-2026-47214 · GHSA-q29v-xc37-wh5m · amended
- High, CVSS 7.5
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
PyPI docling · Upgrade to 2.74.0 or later · >= 2.13.0, < 2.74.0 · CVE-2026-44020 · GHSA-m88r-rg27-5xfg · amended
- High, CVSS 8.2
Docling: Unsafe Playwright-based HTML Rendering
PyPI docling · Upgrade to 2.91.0 or later · >= 2.82.0, < 2.91.0 · CVE-2026-44016 · GHSA-pj2v-ggqh-cmq2 · amended
- High, CVSS 7.5
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
npm react-router · Upgrade to 7.15.0 or later · >= 7.0.0, < 7.15.0 · +1 more package · CVE-2026-42342 · GHSA-8x6r-g9mw-2r78 · amended
- High, CVSS 8.1
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
npm react-router · Upgrade to 7.14.2 or later · >= 7.0.0, <= 7.14.1 · CVE-2026-42211 · GHSA-49rj-9fvp-4h2h · amended
- High, CVSS 7.6
Froxlor: BIND Zone File Injection via TXT Record Content
Packagist froxlor/froxlor · Upgrade to 2.3.7 or later · <= 2.3.6 · CVE-2026-41234 · GHSA-37m5-m4q3-fc6x
- High, CVSS 8.0
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
npm react-router · Upgrade to 7.13.2 or later · >= 7.7.0, < 7.13.2 · CVE-2026-33245 · GHSA-8646-j5j9-6r62 · amended
- High, CVSS 7.5
Docling: Unsafe Zip Extraction in EasyOCR Model Download
PyPI docling · Upgrade to 2.91.0 or later · < 2.91.0 · CVE-2026-44017 · GHSA-cjqg-rq2h-2fvj · amended
- High, CVSS 7.3
GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function
Go github.com/osrg/gobgp/v4 · Upgrade to 4.4.0 or later · < 4.4.0 · CVE-2026-37462 · GHSA-pw7p-7fqv-hpj8
- High, CVSS 7.5
launch-editor vulnerable to command injection via the crafted request on Windows
npm launch-editor · Upgrade to 2.9.0 or later · <= 2.8.2 · +1 more package · CVE-2024-52011 · GHSA-c27g-q93r-2cwf · amended
- High, CVSS 8.0
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
PyPI transformers · Upgrade to 5.5.0 or later · < 5.5.0 · CVE-2026-5241 · GHSA-fgcw-684q-jj6r · amended
- Critical, CVSS 9.8
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass
Maven org.apache.mina:mina-core · Upgrade to 2.2.8, 2.1.13 or 2.0.29 by release line · >= 2.2.0, < 2.2.8; >= 2.1.0, < 2.1.13; < 2.0.29 · CVE-2026-47065 · GHSA-v3pr-hxpr-mfm8
- Critical, CVSS 9.1
MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
PyPI mlflow · Upgrade to 3.11.0 or later · < 3.11.0 · CVE-2026-4035 · GHSA-g35p-px32-whv6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.