High, CVSS 8.6
wetty vulnerable to DOM XSS via file-download filename
npm wetty · Upgrade to 3.0.4 or later · < 3.0.4 · CVE-2026-49864 · GHSA-p26j-h7wj-r568 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.4
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
npm auth-fetch-mcp · Upgrade to 3.0.2 or later · <= 3.0.1 · CVE-2026-49857 · GHSA-pvrj-8cg3-j5f8 · amended
- High, CVSS 7.5
GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field
Maven org.geonetwork-opensource:geonetwork · Upgrade to 4.4.11 or 4.2.16 by release line; some affected versions have no fix yet · >= 4.0.0-alpha.1, <= 4.0.6-0; >= 4.2.0, <= 4.2.15; >= 4.4.0, <= 4.4.10-0 · CVE-2026-46487 · GHSA-582q-v28r-7cxr
- High, CVSS 7.1
GeoNetwork has reflected XSS through client-side template injection
Maven org.geonetwork-opensource:geonetwork · Upgrade to 4.4.10 or 4.2.15 by release line; some affected versions have no fix yet · >= 3.0.0, <= 3.12.12; >= 4.0.0-alpha.1, <= 4.0.6; >= 4.2.0, <= 4.2.14; >= 4.4.0, <= 4.4.9 · CVE-2026-39379 · GHSA-2v4m-fw6c-g78f
- High, CVSS 7.8
Open Babel has out-of-bounds write in MSI translationVectors[]
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46295 · GHSA-f8h2-c479-vqxf · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46294 · GHSA-mjmg-352j-f456 · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46293 · GHSA-7h6r-6p76-68c9 · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in Gaussian translationVectors[]
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46291 · GHSA-jg3h-pv7c-4f9c · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46290 · GHSA-5rff-8f7c-8jmw · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in ORCA nAtoms parser
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46289 · GHSA-rj4c-r689-cm87 · amended
- High, CVSS 7.8
Open Babel has uninitialized pointer dereference in PQS pFormat
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46280 · GHSA-8qxc-57hf-hc9j · amended
- High, CVSS 7.8
Open Babel has uninitialized pointer dereference in MSI atom parser
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-44451 · GHSA-jr2x-6qf6-q5mc · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOL2 attribute/value parser
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-43607 · GHSA-vjg6-gm8m-v5g6 · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in PQS coord_file parser
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-43467 · GHSA-f29h-2h58-48r7 · amended
- High, CVSS 7.8
Open Babel has uninitialized pointer dereference in GRO residue parser
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-42885 · GHSA-mw5r-wq2m-397c · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in CSR PadString (title field)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-41793 · GHSA-p594-7xw4-g76p · amended
- High, CVSS 7.8
Open Babel has out-of-bounds write in Gaussian coords_type orientation parser
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-37331 · GHSA-vr3p-gg26-45v9 · amended
- High, CVSS 7.8
Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2025-10997 · GHSA-8wq6-qh76-wpv9 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.