Critical, CVSS 9.9
deepstream is vulnerable to prototype pollution
npm @deepstream/server · Upgrade to 10.0.5 or later · < 10.0.5 · CVE-2026-49252 · GHSA-9v98-6g37-x9g6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 113 matching · newest first
- Medium, CVSS 6.1
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
PyPI dosage · Upgrade to 3.3 or later · <= 3.2 · GHSA-75mw-h36v-2jv7 · amended
- Medium, CVSS 5.5
Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)
NuGet scriban +1 · Upgrade all 2 to 7.2.1 or later · >= 6.6.0, <= 7.2.0 · GHSA-6q7j-xr26-3h2c
- Medium, CVSS 5.5
Scriban: array * int (ScriptArray .TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx
NuGet scriban +1 · Upgrade all 2 to 7.2.1 or later · >= 3.0.0, <= 7.2.0 · GHSA-q6rr-fm2g-g5x8
- Low, CVSS 2.7
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction
Go github.com/juev/nebula-mesh · Upgrade to 0.3.4 or later · <= 0.3.3 · GHSA-v2jf-442r-6mjh
- Medium, CVSS 6.6
WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs
Packagist web-auth/webauthn-symfony-bundle · Upgrade to 5.3.4 or later · < 5.3.4 · GHSA-q683-8468-r6h6
- Medium, CVSS 6.3
CakePHP: View::element() is missing a path containment check
Packagist cakephp/cakephp · Upgrade to 5.3.6, 5.2.13, 5.1.7 or 2 more by release line · >= 5.3.0, < 5.3.6; >= 5.2.0, < 5.2.13; >= 5.0.0, < 5.1.7; >= 4.6.0, < 4.6.4; < 4.5.11 · CVE-2026-48820 · GHSA-wpvj-hjcr-h3p2
- Medium, CVSS 5.3
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
PyPI joserfc · Upgrade to 1.6.7 or later · >= 1.3.4, < 1.6.7 · CVE-2026-48990 · GHSA-wphv-vfrh-23q5 · amended
- High, CVSS 7.5
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server
npm better-helperjs · Upgrade to 3.0.6 or later · <= 3.0.5 · GHSA-3p34-w4f6-5xh2 · amended
- High, CVSS 7.5
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Packagist php-standard-library/php-standard-library +1 · Upgrade all 2 to 6.2.1 or 6.1.2 by release line · >= 6.1.0, < 6.1.2; >= 6.2.0, < 6.2.1 · CVE-2026-48979 · GHSA-pw9p-jvrm-f7rm
- High, CVSS 7.5
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
npm muhammara · Upgrade to 6.0.5 or later · < 6.0.5 · CVE-2026-125107 · GHSA-fhp4-pr5j-46m5 · amended
- Medium, CVSS 5.5
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Packagist pterodactyl/panel · Upgrade to 1.12.3 or later · < 1.12.3 · GHSA-j7f5-gfqm-pcx3
- Medium, CVSS 5.0
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
Go github.com/pterodactyl/wings · Upgrade to 1.12.2 or later · >= 1.11.9, < 1.12.2 · GHSA-rhq6-9rgh-v45c
- High, CVSS 8.7
Flawfinder output manipulation via untrusted filenames and source text
PyPI flawfinder · Upgrade to 2.0.20 or later · < 2.0.20 · CVE-2026-48813 · GHSA-4c3c-r6p8-c863 · amended
- High, CVSS 7.5
python-socketio: Binary attachment accumulation can cause denial of service
PyPI python-socketio · Upgrade to 5.16.2 or later · <= 5.16.1 · CVE-2026-48804 · GHSA-5w7q-77mv-v69f · amended
- High, CVSS 7.5
python-engineio has unbound thread allocation that can cause denial of service
PyPI python-engineio · Upgrade to 4.13.2 or later · <= 4.13.1 · CVE-2026-48802 · GHSA-cgwc-pv48-fhj5 · amended
- Unrated
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
PyPI semantic-router · Upgrade to 0.1.15 or later · >= 0.1.8, < 0.1.15 · GHSA-98x5-vq43-vc5p · amended
- High, CVSS 7.5
python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
PyPI python-engineio · Upgrade to 4.13.2 or later · <= 4.13.1 · CVE-2026-48809 · GHSA-m9gh-vj53-gvh9 · amended
- High, CVSS 8.7
LinkifyIt#match scan loop has quadratic algorithmic complexity
npm linkify-it · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-48801 · GHSA-22p9-wv53-3rq4 · amended
- Medium, CVSS 5.5
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Go github.com/tursodatabase/turso-cli · Upgrade to 1.0.26 or later · <= 1.0.25 · CVE-2026-48790 · GHSA-57f6-pvx8-hwj6
- Medium, CVSS 5.2
nono-py's policy JSON accepts unknown security fields
PyPI nono-py · Upgrade to 0.10.1 or later · <= 0.10.0 · GHSA-m8j6-rc5x-wv36 · amended
- Medium, CVSS 5.2
nono-py vulnerable to authorization bypass / policy confusion
PyPI nono-py · Upgrade to 0.11.0 or later · <= 0.10.1 · GHSA-9j7f-3r4p-pwh6 · amended
- Critical, CVSS 9.3
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
npm @mcptoolshop/backpropagate +1 · Upgrade all 2 to 1.2.0 or later · >= 1.1.0, < 1.2.0 · CVE-2026-48797 · GHSA-f65r-h4g3-3h9h · amended
- Medium, CVSS 6.4
nono-py has proxy-only network fallback bypass on older Linux kernels
PyPI nono-py · Upgrade to 0.10.1 or later · >= 0.9.0, < 0.10.1 · GHSA-72w7-mf9g-733p · amended
- Medium, CVSS 4.3
Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.85.0 or later · < 4.85.0 · CVE-2026-41262 · GHSA-gm7f-v959-fr2g
A vendor fix does not resolve your finding until you verify it in your own systems.