High, CVSS 7.5
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
PyPI ultimate-sitemap-parser · Upgrade to 1.8.1 or later · <= 1.8.0 · GHSA-p5wc-9w9r-m232 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
PyPI ultimate-sitemap-parser · Upgrade to 1.8.1 or later · <= 1.8.0 · GHSA-8823-qg2x-pv9f · amended
- High, CVSS 8.5
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
npm tinacms · Upgrade to 3.9.3 or later · < 3.9.3 · +1 more package · CVE-2026-55660 · GHSA-g5qx-h5f3-mp2f · amended
- Critical, CVSS 9.2
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Packagist craftcms/cms · Upgrade to 5.10 or 4.18 by release line · >= 5.0.0-RC1, < 5.10; >= 4.0.0-RC1, < 4.18 · CVE-2026-55791 · GHSA-c55v-343g-5xff
- High, CVSS 7.8
@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
npm @tinacms/cli · Upgrade to 2.4.3 or later · < 2.4.3 · CVE-2026-54074 · GHSA-4936-9hrh-qqpw · amended
- High, CVSS 8.6
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-55691 · GHSA-7h5p-637f-jfr7
- High, CVSS 7.5
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-55690 · GHSA-c29q-5xm7-5p62
- High, CVSS 7.5
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
npm flat-to-nested · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-55091 · GHSA-hp36-v28f-w3r4 · amended
- High, CVSS 8.5
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
npm @cyclonedx/cyclonedx-npm · Upgrade to 5.0.0 or later · >= 2.1.0, < 5.0.0 · CVE-2026-55849 · GHSA-v75r-vx73-82pj · amended
- High, CVSS 8.6
Blocky DNSSEC validation bypass and validation-cache scope pollution
Go github.com/0xERR0R/blocky · Upgrade to 0.32.0 or later · >= 0.28.0, < 0.32.0 · GHSA-x845-2f78-7v36
- High, CVSS 8.2
Concurrent Ruby :
AtomicReference#updatelivelocks when the stored value isFloat::NANRubyGems concurrent-ruby · Upgrade to 1.3.7 or later · < 1.3.7 · CVE-2026-54904 · GHSA-h8w8-99g7-qmvj
- High, CVSS 8.4
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
npm kozou +3 · Upgrade all 4 to 1.8.1 or later · <= 1.8.0 · GHSA-v52w-28xh-v562 · amended
- High, CVSS 7.4
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
NuGet corewcf.primitives · Upgrade to 1.9.1 or later · >= 1.9.0, < 1.9.1 · CVE-2026-54784 · GHSA-2288-8h3r-cqgg
- High, CVSS 7.4
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54783 · GHSA-gqv6-pwcg-87r8
- Critical, CVSS 10.0
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54782 · GHSA-xjr9-gg9q-jx3v
- High, CVSS 7.4
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54781 · GHSA-48pq-2xq3-c2m4
- High, CVSS 7.4
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54774 · GHSA-rpj7-hr7h-w6p9
- High, CVSS 7.5
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
NuGet corewcf.netframingbase · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54772 · GHSA-p86g-xrr2-pf7c
- High, CVSS 8.7
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close
RubyGems oj · Upgrade to 3.17.3 or later · <= 3.17.2 · CVE-2026-54897 · GHSA-9ppp-w3g4-fh4q
- High, CVSS 7.5
Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input
RubyGems oj · Upgrade to 3.17.3 or later · < 3.17.3 · CVE-2026-54592 · GHSA-3m6q-jj5j-38c9
- High, CVSS 7.1
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
PyPI jupyterlab-git · Upgrade to 0.54.0 or later · <= 0.53.0 · CVE-2026-54528 · GHSA-436q-jwfr-rm2h · amended
- High, CVSS 8.6
jupyterlab-git extension: Stored XSS leading to RCE
PyPI jupyterlab-git +2 · Upgrade all 3 to 0.54.0 or later · >= 0.30.0b3, < 0.54.0 · CVE-2026-54527 · GHSA-f962-v9hr-pfg5 · amended
- High, CVSS 7.5
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
PyPI stanza · Upgrade to 1.12.2 or later · <= 1.12.1 · CVE-2026-54499 · GHSA-v5jw-96jm-7h2c · amended
- High, CVSS 7.6
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
PyPI homeassistant · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-54317 · GHSA-x84v-g949-293w · amended
- High, CVSS 7.5
Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
RubyGems faraday · Upgrade to 2.14.3 or 1.10.6 by release line · >= 2.0.0, <= 2.14.2; >= 1.0.0, <= 1.10.5 · CVE-2026-54297 · GHSA-98m9-hrrm-r99r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.