Medium, CVSS 5.5
Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API
Go github.com/nezhahq/nezha · Upgrade to 2.2.5 or later · < 2.2.5 · GHSA-ww5p-j6cj-6mqq
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 113 matching · newest first
- High, CVSS 7.1
pnpm:
stage downloadwrites outside its destination directory via manifest name/version traversalnpm pnpm · Upgrade to 11.5.3 or later · >= 11.3.0, < 11.5.3 · CVE-2026-55700 · GHSA-v23m-ccfg-pq9h · amended
- Medium, CVSS 6.5
pnpm: Reserved bin name deletes PNPM_HOME during global remove
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55699 · GHSA-4gxm-v5v7-fqc4 · amended
- High, CVSS 8.8
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55698 · GHSA-w466-c33r-3gjp · amended
- High, CVSS 7.1
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49338 · GHSA-hmgp-w9jm-vp95
- High, CVSS 7.1
gonic: Path Traversal in playlist
idbypasses ownership check, enabling any user to read/delete other users' playlistsGo go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49339 · GHSA-2fp4-5v5c-4448
- High, CVSS 8.1
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49340 · GHSA-4gxv-p5g5-j7w7
- High, CVSS 7.5
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55697 · GHSA-gj8w-mvpf-x27x · amended
- High, CVSS 7.5
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55487 · GHSA-5wx6-mg75-v57r · amended
- Medium, CVSS 6.5
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55180 · GHSA-3qhv-2rgh-x77r · amended
- Medium, CVSS 6.2
ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53465 · GHSA-44cp-c3ww-9rv5
- Medium, CVSS 4.0
ImageMagick: Memory Leak in wand option parser when providing invalid arguments
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53464 · GHSA-j989-f892-2335
- Low, CVSS 3.5
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Packagist statamic/cms · Upgrade to 6.20.3 or 5.74.0 by release line · < 5.74.0; >= 6.0.0, < 6.20.3 · CVE-2026-54244 · GHSA-7mqq-4v55-88gh
- Medium, CVSS 6.8
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Go github.com/nezhahq/nezha · Upgrade to 2.2.0 or later · >= 1.0.0, < 2.2.0 · CVE-2026-53523 · GHSA-9rc6-8cjv-rcvx
- Medium, CVSS 6.5
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
Go github.com/nezhahq/nezha · Upgrade to 2.2.0 or later · >= 1.0.0, < 2.2.0 · CVE-2026-53522 · GHSA-jg62-j5h6-8mpq
- Medium, CVSS 6.1
Statamic Vulnerable to CSV formula injection in form submission exports
Packagist statamic/cms · Upgrade to 6.20.1 or 5.73.24 by release line · >= 6.0.0, < 6.20.1; < 5.73.24 · CVE-2026-54243 · GHSA-h77m-qrj7-jxcw
- Medium, CVSS 4.9
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
Packagist statamic/cms · Upgrade to 6.20.1 or 5.73.24 by release line · < 5.73.24; >= 6.0.0, < 6.20.1 · CVE-2026-54242 · GHSA-v5c4-wcpj-x73m
- Critical, CVSS 9.1
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
Go github.com/nezhahq/nezha · Upgrade to 2.0.13 or later · < 2.0.13 · CVE-2026-53519 · GHSA-5c25-7vpj-9mqh
- Medium, CVSS 6.4
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Go github.com/nezhahq/nezha · Upgrade to 2.1.0 or later · >= 2.0.14, < 2.1.0 · CVE-2026-53521 · GHSA-39g2-8x68-pmx8
- Medium, CVSS 6.5
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Go github.com/nezhahq/nezha · Upgrade to 2.1.0 or later · >= 2.0.14, < 2.1.0 · CVE-2026-53520 · GHSA-x6fg-52vr-hj4w
- High, CVSS 7.3
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50015 · GHSA-rxhj-4m44-96r4 · amended
- Medium, CVSS 6.9
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50017 · GHSA-cjhr-43r9-cfmw · amended
- High, CVSS 8.8
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50016 · GHSA-hwx4-2j3j-g496 · amended
- Medium, CVSS 6.4
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50014 · GHSA-p4xf-rf54-rj3x · amended
- Medium, CVSS 6.8
pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field
npm pnpm · Upgrade to 11.4.0 or 10.34.1 by release line · >= 11.0.0, < 11.4.0; < 10.34.1 · CVE-2026-50021 · GHSA-q6j5-fjx5-2mc3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.