Medium, CVSS 6.8
pnpm: Unsafe default behavior breaks integrity check
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50573 · GHSA-54hh-g5mx-jqcp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 113 matching · newest first
- Medium, CVSS 5.3
js-toml has silent type confusion via falsy-primitive duplicate-key bypass
npm js-toml · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-50029 · GHSA-m34p-749j-x6m6 · amended
- Medium, CVSS 6.8
regclient may leak authentication credentials to external blob stores
Go github.com/regclient/regclient · Upgrade to 0.11.5 or later · <= 0.11.4 · CVE-2026-49349 · GHSA-qvqc-4c52-x6qp
- Low, CVSS 2.3
Authelia has an Edge Case Access Control Rule Mismatch
Go github.com/authelia/authelia/v4 · Upgrade to 4.39.20 or later · >= 4.36.0, <= 4.39.19 · CVE-2026-48794 · GHSA-j748-h363-wqj8
- Critical, CVSS 9.9
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
Go github.com/nezhahq/nezha · Upgrade to 2.0.10; some affected versions have no fix yet · >= 1.14.13, <= 1.14.14; >= 2.0.0, <= 2.0.9 · GHSA-q6xx-5vr8-p898
- Unrated
Blnk has an API key authorization bypass in owner and scope enforcement
Go github.com/blnkfinance/blnk · Upgrade to 0.14.3 or later · <= 0.14.2 · GHSA-wcr3-9x4c-f5gj
- Medium, CVSS 5.3
YARD static cache reads raw traversal paths before router sanitization
RubyGems yard · Upgrade to 0.9.44 or later · < 0.9.44 · CVE-2026-49342 · GHSA-pxcc-8665-phx8
- Medium, CVSS 5.5
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
npm @microsoft/kiota-http-fetchlibrary · Upgrade to 1.0.0-preview.102 (pre-release) or later · >= 1.0.0-preview.97, <= 1.0.0-preview.101 · CVE-2026-49336 · GHSA-396q-4vc8-28x9 · amended
- High, CVSS 7.5
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
npm js-toml · Upgrade to 1.1.2 or later · < 1.1.2 · CVE-2026-49293 · GHSA-wp3c-266w-4qfq · amended
- High, CVSS 8.9
SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings
Packagist solidinvoice/solidinvoice · Upgrade to 2.3.16 or later · <= 2.3.15 · GHSA-7vfx-4246-jcfh
- High, CVSS 7.4
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
Packagist statamic/cms · Upgrade to 6.20.0 or 5.73.23 by release line · < 5.73.23; >= 6.0.0, < 6.20.0 · CVE-2026-49287 · GHSA-m92m-r54r-x8r2
- Medium, CVSS 4.3
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
Packagist statamic/cms · Upgrade to 6.20.0 or 5.73.23 by release line · < 5.73.23; >= 6.0.0, < 6.20.0 · CVE-2026-49288 · GHSA-2497-6pwj-pwg7
- Medium, CVSS 6.5
PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
Packagist pontedilana/php-weasyprint · Upgrade to 2.6.0 or later · <= 2.5.1 · CVE-2026-49359 · GHSA-x8g9-h984-pc36
- Low, CVSS 3.0
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
Packagist pontedilana/php-weasyprint · Upgrade to 2.6.0 or later · <= 2.5.1 · CVE-2026-49358 · GHSA-5g9f-cwwg-4p8g
- High, CVSS 8.1
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Packagist pontedilana/php-weasyprint · Upgrade to 2.6.0 or later · <= 2.5.1 · CVE-2026-49286 · GHSA-2fmj-p74r-3wjm
- High, CVSS 8.8
Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication
npm line-desktop-mcp · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-49357 · GHSA-4hf8-5mjm-rfgq · amended
- Low, CVSS 3.0
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
Packagist aimeos/pagible · Upgrade to 0.10.4 or later · < 0.10.4 · CVE-2026-49262 · GHSA-mmj8-wcvw-6789
- Medium, CVSS 4.8
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
npm pnpm · Upgrade to 11.0.7 or 10.33.4 by release line · < 10.33.4; >= 11.0.0, < 11.0.7 · CVE-2026-48995 · GHSA-hg3w-7f8c-63hp · amended
- Medium, CVSS 6.5
Cargo crates in third party registries can override the cached source of other crates
crates.io cargo · Upgrade to 0.97.0 or later · < 0.97.0 · CVE-2026-5223 · GHSA-jq42-7mfv-hm57
- Low, CVSS 2.3
Cargo can be coerced to share credentials between registries
crates.io cargo · Upgrade to 0.97.0 or later · < 0.97.0 · CVE-2026-5222 · GHSA-p688-r7jv-fm6f
- High, CVSS 8.2
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
Packagist pontedilana/php-weasyprint · Upgrade to 2.5.1 or later · <= 2.5.0 · CVE-2026-49260 · GHSA-f5gc-qxf8-mh9g
- High, CVSS 8.1
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.4 or later · <= 4.1.3 · GHSA-985r-q3qp-299h
- Unrated
@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url
npm @cardano402/mcp-server · Upgrade to 0.1.2 or later · <= 0.1.1 · GHSA-rp72-5v5q-2446 · amended
- Critical, CVSS 10.0
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
PyPI mcp-pinot-server · Upgrade to 3.1.0 or later · <= 3.0.1 · CVE-2026-49257 · GHSA-73cv-556c-w3g6 · amended
- High, CVSS 8.1
mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
PyPI mcp-memory-service · Upgrade to 10.65.3 or later · <= 10.65.1 · CVE-2026-49291 · GHSA-2r68-g678-7qr3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.