High, CVSS 8.7
Mistune: Potential DoS via quadratic-time parsing in parse_link_text
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-49851 · GHSA-qcq2-496w-v96p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52778 · GHSA-px5m-h76g-p7p8
- Critical, CVSS 9.4
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52777 · GHSA-9369-69wj-7m2f
- High, CVSS 8.8
YesWiki has Authenticated SQL Injection via ReactionManager
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52775 · GHSA-4pf7-cc4r-g63h
- High, CVSS 8.3
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (
ApiController::deletePage)Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · >= 4.2.0, < 4.6.6 · CVE-2026-52771 · GHSA-8f2v-2qhj-gfwg
- High, CVSS 7.5
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric
query/queriesfiltersPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52770 · GHSA-qg78-vmvc-fhjw
- High, CVSS 8.3
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub
Signature.keyIdPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · >= 4.6.2, < 4.6.6 · CVE-2026-52769 · GHSA-vw42-752g-5mrp
- High, CVSS 8.2
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via
!openssl_verify(...)acceptingint(-1)Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · >= 4.6.2, < 4.6.6 · CVE-2026-52767 · GHSA-mv28-wj57-f57g
- Critical, CVSS 9.1
YesWiki vulnerable to unauthenticated arbitrary page deletion via
{{erasespamedcomments}}actionPackagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52766 · GHSA-6x7x-gcmf-7r8x
- High, CVSS 7.1
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Packagist yeswiki/yeswiki · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2026-52762 · GHSA-65p8-9433-jpcp
- High, CVSS 8.0
laravel-backup-restore has an OS Command Injection during database restore
Packagist wnx/laravel-backup-restore · Upgrade to 1.9.4 or later · <= 1.9.3 · CVE-2026-53932 · GHSA-w9mx-xmg4-gc4r
- High, CVSS 8.6
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
Packagist craftcms/cms · Upgrade to 5.9.14 or later · >= 5.5.0, <= 5.9.13 · CVE-2026-56382 · GHSA-86vw-x4ww-x467
- High, CVSS 8.9
Ruby CSS Parser: SSRF and Local File Disclosure in
CssParser::Parser#read_remote_fileRubyGems css_parser · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2026-53727 · GHSA-9pmc-p236-855h
- High, CVSS 7.5
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +7 · Upgrade all 8 to 6.9.9 or 6.9.4.2 by release line · >= 6.9.5, < 6.9.9; < 6.9.4.2 · CVE-2026-49485 · GHSA-7cmj-v6x8-frvv
- High, CVSS 8.6
Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260601210719-67b7de04308a (pre-release) or later · < 0.0.0-20260601210719-67b7de04308a · CVE-2026-50553 · GHSA-rqrh-8wpv-x7hh
- High, CVSS 7.5
Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
PyPI soupsieve · Upgrade to 2.8.4 or later · <= 2.8.3 · CVE-2026-49477 · GHSA-836r-79rf-4m37 · amended
- High, CVSS 7.5
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
PyPI soupsieve · Upgrade to 2.8.4 or later · <= 2.8.3 · CVE-2026-49476 · GHSA-2wc2-fm75-p42x · amended
- High, CVSS 7.7
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
PyPI phantom-audio · Upgrade to 1.3.1 or later · <= 1.3.0 · GHSA-52vm-mxx8-f227 · amended
- High, CVSS 7.5
Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
Maven io.micronaut:micronaut-http-client · Upgrade to 5.0.1, 4.10.24 or 3.10.7 by release line · < 3.10.7; >= 4.0.0-M1, < 4.10.24; >= 5.0.0-M1, < 5.0.1 · GHSA-387m-935m-c4vw
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.