High, CVSS 8.8
Style Dictionary - Prototype Pollution in convertTokenData utility function
npm style-dictionary · Upgrade to 5.4.4 or later · >= 4.3.0, < 5.4.4 · CVE-2026-54639 · GHSA-vj5c-m527-mpff
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
openhole-server vulnerable to path traversal via URL-decoded request path
Go github.com/bablilayoub/openhole · Upgrade to 0.1.2 or later · <= 0.1.1 · CVE-2026-54650 · GHSA-fh2f-xfxc-q9cc · amended
- High, CVSS 7.5
td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode
Go github.com/gotd/td · Upgrade to 0.145.1 or later · < 0.145.1 · CVE-2026-54638 · GHSA-whmm-qj9r-wvr2 · amended
- High, CVSS 7.8
datamodel-code-generatorvulnerable to code injection via unescaped carriage return in--extra-template-datacommentfieldPyPI datamodel-code-generator · Upgrade to 0.60.2 or later · >= 0.14.1, <= 0.60.1 · CVE-2026-54654 · GHSA-wjv6-jcfj-mf9r
- High, CVSS 7.5
datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema
$ref(file://and../traversal), bypassing--no-allow-remote-refsPyPI datamodel-code-generator · Upgrade to 0.62.0 or later · <= 0.61.0 · CVE-2026-55389 · GHSA-8359-h9fx-j6v9
- High, CVSS 8.8
datamodel-code-generatorvulnerable to code injection in via attacker-controlleddefault_factoryschema fieldPyPI datamodel-code-generator · Upgrade to 0.60.2 or later · >= 0.17.0, <= 0.60.1 · CVE-2026-54653 · GHSA-386q-5hp3-95m9
- High, CVSS 7.5
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
PyPI datamodel-code-generator · Upgrade to 0.63.0 or later · <= 0.62.0 · CVE-2026-55391 · GHSA-vx7x-vcc2-c44g
- High, CVSS 7.8
datamodel-code-generatorvulnerable to code execution on import via unescapedvalidatorsentries in --extra-template-dataPyPI datamodel-code-generator · Upgrade to 0.60.2 or later · >= 0.52.1, <= 0.60.1 · CVE-2026-54656 · GHSA-8m8r-38jm-f355
- High, CVSS 8.2
datamodel-code-generator vulnerable to SSRF via JSON-Schema
$refto HTTP URL (silent by default)PyPI datamodel-code-generator · Upgrade to 0.61.0 or later · >= 0.9.1, <= 0.60.2 · CVE-2026-54690 · GHSA-954p-556p-r752
- High, CVSS 7.5
datamodel-code-generator vulnerable to code injection via
x-python-import/customTypePathin generated import statementsPyPI datamodel-code-generator · Upgrade to 0.64.0 or later · >= 0.11.6, <= 0.63.0 · CVE-2026-55415 · GHSA-5578-w22f-pfx9
- High, CVSS 7.8
datamodel-code-generatorvulnerable to code injection via unescaped carriage return in GraphQL Union descriptionPyPI datamodel-code-generator · Upgrade to 0.60.1 or later · >= 0.25.0, < 0.60.1 · CVE-2026-54621 · GHSA-j884-q54q-mmx3
- High, CVSS 7.8
datamodel-code-generatorvulnerable to code execution on import viax-python-typeJSON-Schema extension in datamodel-code-generatorPyPI datamodel-code-generator · Upgrade to 0.60.2 or later · >= 0.51.0, <= 0.60.1 · CVE-2026-54655 · GHSA-m34r-v34r-rf9q
- High, CVSS 8.2
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
PyPI datamodel-code-generator · Upgrade to 0.61.0 or later · >= 0.9.1, <= 0.60.2 · CVE-2026-54691 · GHSA-rfr2-mq9m-x2qx
- High, CVSS 7.5
datamodel-code-generator vulnerable to arbitrary local file read via XSD
schemaLocation(xs:include/xs:import) path traversal, with no remote-ref gatePyPI datamodel-code-generator · Upgrade to 0.62.0 or later · >= 0.59.0, <= 0.61.0 · CVE-2026-55390 · GHSA-442q-2j6p-642g
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.6, 9.0.15 or 8.0.3 by release line · >= 10.0.0, <= 10.0.5; >= 9.0.0, <= 9.0.14; >= 8.0.0, <= 8.0.2 · CVE-2026-32203 · GHSA-6588-8gv4-xfgh · amended
- High, CVSS 7.7
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
Go github.com/fission/fission · Upgrade to 1.25.0 or later · <= 1.24.0 · CVE-2026-50567 · GHSA-q6vm-xqc9-v3ff · amended
- High, CVSS 8.5
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
Go github.com/fission/fission · Upgrade to 1.25.0 or later · <= 1.24.0 · CVE-2026-50570 · GHSA-qf5v-m7p4-95rp · amended
- High, CVSS 7.5
pytonapi has a Webhook Custom Path Authentication Bypass
PyPI pytonapi · Upgrade to 2.2.1 or later · >= 2.0.0, < 2.2.1 · CVE-2026-54635 · GHSA-3fcr-jvgp-7f58
- High, CVSS 7.5
SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)
NuGet sipsorcery · Upgrade to 10.0.9 or later · <= 10.0.8 · CVE-2026-54632 · GHSA-28gm-jrmw-xx93 · amended
- Critical, CVSS 9.6
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Packagist poweradmin/poweradmin · Upgrade to 4.3.3 or 4.2.4 by release line · < 4.2.4; >= 4.3.0, < 4.3.3 · CVE-2026-54588 · GHSA-3735-5339-xfwx · amended
- High, CVSS 8.6
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
RubyGems oauth2 · Upgrade to 2.0.22 or later · >= 0.4.0, <= 2.0.21 · CVE-2026-54603 · GHSA-pp92-crg2-gfv9 · amended
- High, CVSS 7.2
OAuth: Cross-origin token-request redirects can expose signed request metadata
RubyGems oauth · Upgrade to 1.1.6 or later · >= 0.5.5, <= 1.1.5 · CVE-2026-54605 · GHSA-prq8-7wvh-44qh · amended
- High, CVSS 7.5
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
Packagist pterodactyl/panel · Upgrade to 1.13.0 or later · >= 1.7.0, <= 1.12.4 · CVE-2026-61609 · GHSA-xvc3-826v-xf47 · amended
- High, CVSS 8.8
Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities
Maven com.cedarpolicy:cedar-java · Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line · < 2.3.6; >= 3.1.2, < 3.4.1; >= 4.0.0, < 4.9.0 · CVE-2026-55771 · GHSA-4r9r-4425-74p7 · amended
- High, CVSS 7.1
@wakaru/cli arbitrary file write during bundle unpack
npm @wakaru/cli · Upgrade to 1.4.0 or later · >= 1.0.0, < 1.4.0 · CVE-2026-54545 · GHSA-7wpj-vvmv-pgm8
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.