Medium, CVSS 5.9
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
npm @frontmcp/adapters · Upgrade to 1.5.6 or later · <= 1.5.5 · GHSA-8q49-2h5h-434x · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 129 matching · newest first
- High, CVSS 8.4
AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
PyPI bedrock-agentcore · Upgrade to 1.18.1 or later · < 1.18.1 · CVE-2026-16796 · GHSA-j6g5-3hh3-pgw8 · amended
- High, CVSS 8.7
Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
crates.io aws-smithy-http-server · Upgrade to 0.66.5 or later · <= 0.66.4 · CVE-2026-16756 · GHSA-jvxp-qmx7-gjpx
- Medium, CVSS 5.6
Quasar: Prototype pollution in the extend() utility
npm quasar · Upgrade to 2.22.0 or later · <= 2.21.4 · CVE-2026-73647 · GHSA-3r53-75j5-3g7j · amended
- High, CVSS 7.5
OmniFaces: Forged combined-resource IDs and related output/push boundaries
Maven org.omnifaces:omnifaces · Upgrade to 5.4.2, 4.7.12, 3.14.23 or 2 more by release line · < 1.14.3; >= 2.0.0, < 2.7.33; >= 3.0.0, < 3.14.23; >= 4.0.0, < 4.7.12; >= 5.0.0, < 5.4.2 · CVE-2026-102695 · GHSA-fp43-vj7g-pg92
- High, CVSS 8.7
Shescape: Quadratic-time denial of service in the flag-protection
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · >= 2.1.11, < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73413 · GHSA-gm3r-q2wp-hw87 · amended
- Medium, CVSS 6.3
Shescape: Home-directory disclosure in assignment context on Unix with Dash
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73411 · GHSA-q53c-4prm-w95q · amended
- Critical, CVSS 9.2
Shescape: Shell injection via unescaped parentheses on Windows with CMD
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73414 · GHSA-w4hw-qcx7-56pr · amended
- Medium, CVSS 6.3
Shescape: Path disclosure on Unix with Zsh
npm shescape · Upgrade to 3.0.1 or 2.1.14 by release line · < 2.1.14; >= 3.0.0, < 3.0.1 · CVE-2026-73412 · GHSA-6v4m-fw66-8r4x · amended
- High, CVSS 7.3
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
PyPI awslabs-aws-api-mcp-server · Upgrade to 1.3.47 or later · >= 0.2.13, < 1.3.47 · CVE-2026-16584 · GHSA-29w2-fq35-v728 · amended
- High, CVSS 7.5
blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
Maven org.http4s:http4s-blaze-server_2.12 · Upgrade to 0.23.18 or later · < 0.23.18 · +2 more packages · CVE-2026-73493 · GHSA-7ppr-r889-mcf2
- High, CVSS 7.4
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
Maven org.http4s:blaze-http_3 · Upgrade to 1.0.0-M42 (pre-release) or 0.23.18 by release line · <= 0.23.17; >= 1.0.0-M1, < 1.0.0-M42 · +2 more packages · CVE-2026-73495 · GHSA-46q4-43ph-c6fr
- High, CVSS 7.4
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Maven org.http4s:blaze-http_3 · Upgrade to 1.0.0-M42 (pre-release) or 0.23.18 by release line · <= 0.23.17; >= 1.0.0-M1, <= 1.0.0-M41 · +2 more packages · CVE-2026-73494 · GHSA-mhvj-jhpq-885v
- High, CVSS 8.1
Poweradmin: OIDC
subcollation bypass in Poweradmin leading to account takeoverPackagist poweradmin/poweradmin · Upgrade to 4.3.4 or 4.2.5 by release line · >= 4.1.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-cmwh-g2h8-c222
- High, CVSS 8.1
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own
Packagist poweradmin/poweradmin · Upgrade to 4.3.4, 4.2.5 or 3.9.11 by release line · >= 3.0.0, < 3.9.11; >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-rm67-g9ch-vxff
- High, CVSS 8.8
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
Packagist poweradmin/poweradmin · Upgrade to 4.3.4 or 4.2.5 by release line · >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-h4hf-v6w5-897x
- Critical, CVSS 10.0
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
Packagist pheditor/pheditor · Upgrade to 2.0.8 or later · < 2.0.8 · GHSA-f25v-x6vr-962g
- High, CVSS 7.5
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
npm brace-expansion · Upgrade to 5.0.8, 3.0.3, 2.1.3 or 1.1.17 by release line · >= 4.0.0, < 5.0.8; >= 3.0.0, < 3.0.3; >= 2.0.0, < 2.1.3; < 1.1.17 · CVE-2026-14257 · GHSA-mh99-v99m-4gvg · amended
- Critical, CVSS 9.1
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
npm sm-crypto · Upgrade to 0.5.0 or later · < 0.5.0 · CVE-2026-73567 · GHSA-vh45-f885-3848 · amended
- Low, CVSS 2.3
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics
crates.io hubuum_client · Upgrade to 0.6.1 or later · <= 0.6.0 · GHSA-2625-rw7m-5q5x
- Medium, CVSS 6.3
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
crates.io hubuum_client · Upgrade to 0.6.1 or later · >= 0.3.0, <= 0.6.0 · GHSA-qqc3-94qv-7fw3
- Medium, CVSS 6.3
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
crates.io hubuum_client · Upgrade to 0.6.1 or later · >= 0.0.1, < 0.6.1 · GHSA-f45q-w629-wr25
- High, CVSS 7.5
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
npm @anephenix/hub · Upgrade to 0.2.16 or later · < 0.2.16 · CVE-2026-73561 · GHSA-g5vv-q72c-7j78 · amended
- Critical, CVSS 9.6
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 5.1.2 or later · <= 5.1.1 · CVE-2026-73644 · GHSA-p279-2cqp-84jg
- Critical, CVSS 9.4
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
Maven org.openidentityplatform.opendj:opendj-dsml-servlet · Upgrade to 5.1.2 or later · <= 5.1.1 · GHSA-68r5-9hpg-7qw9
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.