High, CVSS 8.6
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
PyPI crawl4ai · Upgrade to 0.8.9 or later · <= 0.8.8 · CVE-2026-53755 · GHSA-6qhc-x826-342c · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 84 matching · newest first
- Critical, CVSS 9.2
Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
PyPI crawl4ai · Upgrade to 0.8.8 or later · <= 0.8.7 · CVE-2026-56258 · GHSA-7cx2-g3h9-382p · amended
- High, CVSS 8.8
Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution
PyPI crawl4ai · Upgrade to 0.8.8 or later · <= 0.8.7 · CVE-2026-56259 · GHSA-f989-c77f-r2cq · amended
- High, CVSS 7.5
Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)
PyPI crawl4ai · Upgrade to 0.8.8 or later · <= 0.8.7 · CVE-2026-53754 · GHSA-4qqr-vv2q-cmr5 · amended
- High, CVSS 8.3
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
PyPI yt-dlp · Upgrade to 2026.6.9 or later · < 2026.6.9 · CVE-2026-50023 · GHSA-c6mh-fpjc-4pr3 · amended
- Medium, CVSS 6.1
yt-dlp: File Downloader cookie leak with curl
PyPI yt-dlp · Upgrade to 2026.6.9 or later · >= 2023.9.24, < 2026.6.9 · CVE-2026-50019 · GHSA-f7j3-774f-rfhj · amended
- Critical, CVSS 9.0
LobeHub: Unauthenticated SSRF in
/webapi/proxynpm @lobehub/lobehub · Upgrade to 2.1.57 or later · <= 2.1.56 · CVE-2026-54157 · GHSA-xmwj-c75x-6346 · amended
- Critical, CVSS 9.2
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
PyPI crawl4ai · Upgrade to 0.8.7 or later · <= 0.8.6 · CVE-2026-56266 · GHSA-365w-hqf6-vxfg · amended
- Critical, CVSS 9.8
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
PyPI crawl4ai · Upgrade to 0.8.7 or later · <= 0.8.6 · CVE-2026-53753 · GHSA-qxjp-w3pj-48m7 · amended
- Medium, CVSS 6.9
Hugo: Symlink confinement bypass in resources.Get
Go github.com/gohugoio/hugo · Upgrade to 0.162.0 or later · >= 0.123.0, < 0.162.0 · CVE-2026-50135 · GHSA-fw87-fv5r-9fpw
- Unrated
Hugo: security.http.urls allow-list bypass via HTTP redirects
Go github.com/gohugoio/hugo · Upgrade to 0.162.0 or later · >= 0.91.0, < 0.162.0 · CVE-2026-50134 · GHSA-vxgm-5rmg-5w8g
- Medium, CVSS 5.1
Hugo: XSS via text/html content files
Go github.com/gohugoio/hugo · Upgrade to 0.162.0 or later · < 0.162.0 · CVE-2026-50133 · GHSA-c54g-xjwj-8g82
- High, CVSS 7.3
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
crates.io deno · Upgrade to 2.7.14 or later · <= 2.7.13 · CVE-2026-49401 · GHSA-8xpq-cjcf-3wh9
- Medium, CVSS 5.5
Deno: BYONM module resolution allows
package.jsonmain path traversal to bypass--allow-readrestrictionscrates.io deno · Upgrade to 2.7.12 or later · <= 2.7.11 · CVE-2026-49406 · GHSA-968w-xfqw-vp9q
- Medium, CVSS 6.5
Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
crates.io deno · Upgrade to 2.8.0 or later · <= 2.7.14 · CVE-2026-49411 · GHSA-v8fw-85r8-5m23
- High, CVSS 7.4
Deno: Miller-Rabin Primality Test Allows Zero Rounds
crates.io deno · Upgrade to 2.8.1 or later · <= 2.8.0 · CVE-2026-49440 · GHSA-9xg4-qhm4-g43w
- High, CVSS 8.1
Deno: Command Injection via spawnSync & spawn on Windows
crates.io deno · Upgrade to 2.7.10 or later · < 2.7.10 · CVE-2026-49402 · GHSA-7xh3-mhg9-jcw8
- Medium, CVSS 5.2
Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
crates.io deno · Upgrade to 2.8.1 or later · <= 2.8.0 · CVE-2026-49983 · GHSA-4c8g-jvcx-v4hv
- Medium, CVSS 5.2
Deno: WebSocket API sandbox bypass via missing post-DNS check
crates.io deno · Upgrade to 2.8.1 or later · <= 2.8.0 · CVE-2026-49860 · GHSA-83pc-3rw9-qpwj
- Medium, CVSS 5.2
Deno:
fetch()API sandbox bypass via missing DNS resolution checkcrates.io deno · Upgrade to 2.8.1 or later · <= 2.8.0 · CVE-2026-49859 · GHSA-cpgj-f7g3-2pp2
- Medium, CVSS 6.0
n8n: Merge Node SQL Mode Prototype Pollution
npm n8n · Upgrade to 2.26.2 or 2.25.7 by release line · >= 2.26.0, < 2.26.2; < 2.25.7 · CVE-2026-54311 · GHSA-9c38-2mcm-q7f7 · amended
- Medium, CVSS 6.3
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
npm n8n · Upgrade to 2.26.2 or 2.25.7 by release line · >= 2.26.0, < 2.26.2; < 2.25.7 · CVE-2026-54306 · GHSA-2vff-hj5x-8gq7 · amended
- High, CVSS 7.0
n8n: Same-Origin XSS in Respond to Webhook Node
npm n8n · Upgrade to 2.26.2, 2.25.7 or 1.123.55 by release line · < 1.123.55; >= 2.26.0, < 2.26.2; >= 2.0.0-rc.0, < 2.25.7 · CVE-2026-54301 · GHSA-v733-mwr6-fgcm · amended
- Medium, CVSS 6.3
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
npm n8n · Upgrade to 2.26.2 or 2.25.7 by release line · >= 2.26.0, < 2.26.2; < 2.25.7 · CVE-2026-54308 · GHSA-jvc7-762p-3743 · amended
- Medium, CVSS 5.3
n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint
npm n8n · Upgrade to 2.26.2, 2.25.7 or 1.123.55 by release line · < 1.123.55; >= 2.26.0, < 2.26.2; >= 2.0.0-rc.0, < 2.25.7 · CVE-2026-56776 · GHSA-hv7x-3x78-gx53 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.