Low, CVSS 2.9
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Go d7y.io/dragonfly/v2 · Upgrade to 2.4.4 or later · <= 2.4.3 · CVE-2026-49254 · GHSA-4q9j-6299-gxmr
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 117 matching · newest first
- High, CVSS 7.1
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling
npm electerm · Upgrade to 3.11.11 or later · <= 3.11.0 · CVE-2026-49253 · GHSA-38j7-23hf-9mhc · amended
- High, CVSS 8.7
@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
npm @conform-to/dom · Upgrade to 1.19.4 or later · >= 1.8.0, < 1.19.4 · CVE-2026-49250 · GHSA-525m-7f82-2mf7 · amended
- High, CVSS 8.7
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
PyPI joserfc · Upgrade to 1.6.8 or later · <= 1.6.7 · CVE-2026-49852 · GHSA-gg9x-qcx2-xmrh · amended
- Low, CVSS 3.7
SFTPGo has stored XSS via inline parameter on public shares and user file download
Go github.com/drakkan/sftpgo/v2 · Upgrade to 2.7.3 or later · >= 2.2.0, <= 2.7.1 · CVE-2026-49245 · GHSA-3vcg-pv95-pq54
- Medium, CVSS 5.9
SFTPGo has path confinement bypass in public browsable share partial ZIP download
Go github.com/drakkan/sftpgo/v2 · Upgrade to 2.7.3 or later · >= 2.2.0, <= 2.7.1 · CVE-2026-49244 · GHSA-h64p-8h4r-6gfh
- Medium, CVSS 5.3
@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString
npm @asymmetric-effort/specifyjs · Upgrade to 0.2.136 or later · < 0.2.136 · CVE-2026-50290 · GHSA-93q6-wwjh-jc6h · amended
- Medium, CVSS 6.9
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch
npm @asymmetric-effort/specifyjs · Upgrade to 0.2.136 or later · < 0.2.136 · GHSA-j5qp-p44g-2m49 · amended
- Medium, CVSS 6.9
@asymmetric-effort/specifyjs:
data:URI allowed without size restrictionnpm @asymmetric-effort/specifyjs · Upgrade to 0.2.136 or later · < 0.2.136 · GHSA-2944-57xv-2682 · amended
- Medium, CVSS 6.9
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
npm @asymmetric-effort/specifyjs · Upgrade to 0.2.136 or later · < 0.2.136 · GHSA-xw57-23p8-9wc5 · amended
- Medium, CVSS 6.9
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
npm @asymmetric-effort/specifyjs · Upgrade to 0.2.140 or later · <= 0.2.137 · GHSA-qcr8-x557-7cp3 · amended
- Medium, CVSS 6.9
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
npm @asymmetric-effort/specifyjs · Upgrade to 0.2.136 or later · < 0.2.136 · GHSA-5c7w-4wm3-85vw · amended
- High, CVSS 8.7
@asymmetric-effort/specifyjs: URL parse failure silently allows request
npm @asymmetric-effort/specifyjs · Upgrade to 0.2.136 or later · < 0.2.136 · CVE-2026-50288 · GHSA-8882-frvv-92w4 · amended
- High, CVSS 7.1
Craft CMS: Missing peer-permission check in
AssetsController::actionDeleteFolderallows deletion of other users' assetsPackagist craftcms/cms · Upgrade to 5.9.22 or 4.17.15 by release line · >= 5.0.0-RC1, < 5.9.22; >= 4.0.0-RC1, < 4.17.15 · CVE-2026-50284 · GHSA-7h62-6v23-v8fm
- Medium, CVSS 5.3
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Packagist craftcms/cms · Upgrade to 5.9.21 or 4.17.14 by release line · >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, < 4.17.14 · CVE-2026-50283 · GHSA-qh45-9g5p-m2v4
- Medium, CVSS 6.0
Craft CMS: Authorization bypass in
entries/move-to-sectionvia missing target-section save checkPackagist craftcms/cms · Upgrade to 5.9.21 or later · >= 5.0.0-RC1, < 5.9.21 · CVE-2026-50280 · GHSA-43cq-c2gq-pfpw
- High, CVSS 7.6
Craft CMS: Authorship spoofing in
entries/save-entryvia pre-check/post-mutation authorization gapPackagist craftcms/cms · Upgrade to 5.9.21 or later · >= 5.0.0-RC1, < 5.9.21 · CVE-2026-50279 · GHSA-qq2c-2q8j-jh27
- High, CVSS 8.6
mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function
Packagist mediawiki/maps · Upgrade to 12.1.3 or later · < 12.1.3 · CVE-2026-52854 · GHSA-4h7g-5542-v3fc
- High, CVSS 7.5
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.23.2, < 1.2.5 · CVE-2026-52726 · GHSA-gfhv-vqv2-4544 · amended
- High, CVSS 8.7
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
PyPI langroid · Upgrade to 0.64.0 or later · <= 0.63.0 · CVE-2026-50180 · GHSA-pmch-g965-grmr · amended
- High, CVSS 7.1
Langroid: Path traversal in the file tools allows read/write outside configured current directory
PyPI langroid · Upgrade to 0.64.0 or later · <= 0.63.0 · CVE-2026-50181 · GHSA-fg23-3346-88f5 · amended
- Medium, CVSS 6.9
Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
Go github.com/kerberos-io/agent/machinery · Upgrade to 0.0.0-20260528173546-51f1a52e170f (pre-release) or later · < 0.0.0-20260528173546-51f1a52e170f · CVE-2026-50192 · GHSA-h5gx-45rj-2h5j
- High, CVSS 7.2
OpenClaw: Native command authorization could skip owner-command enforcement
npm openclaw · Upgrade to 2026.5.6 or later · <= 2026.5.5 · CVE-2026-53828 · GHSA-p73f-w79w-jqr5 · amended
- High, CVSS 8.7
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
npm openclaw · Upgrade to 2026.5.12 or later · <= 2026.5.7 · CVE-2026-53836 · GHSA-j472-gf56-x589 · amended
- High, CVSS 7.1
OpenClaw: Trusted retry endpoint checks could match hostname prefixes
npm openclaw · Upgrade to 2026.5.7 or later · < 2026.5.7 · CVE-2026-53839 · GHSA-77q5-rr5v-x43q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.