Medium, CVSS 5.9
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
npm mysql2 · Upgrade to 3.23.1 or later · <= 3.23.0 · GHSA-rgwj-5xj2-c3m3
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–9 of 9 matching · newest first
- High, CVSS 7.1
Kirby: File upload permissions are not checked during processing of chunk data
Packagist getkirby/cms · Upgrade to 5.5.2 or later · >= 5.0.0, < 5.5.2 · CVE-2026-71415 · GHSA-67mx-6wf2-92xp · amended
- High, CVSS 8.2
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · <= 4.9.4; >= 5.0.0, < 5.5.2 · CVE-2026-75594 · GHSA-9vx2-j98c-p72w · amended
- Medium, CVSS 6.6
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
npm decode-uri-component · Upgrade to 0.5.0 or later · <= 0.4.2 · CVE-2026-45822 · GHSA-vcc3-ghjq-m6fr
- High, CVSS 7.5
Socket.IO: Engine.IO WebTransport SID DoS
npm engine.io · Upgrade to 6.6.7 or later · >= 6.5.0, < 6.6.7 · CVE-2026-59724 · GHSA-gr94-w7qr-f4j3
- Medium, CVSS 5.4
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
npm @hono/oauth-providers · Upgrade to 0.8.6 or later · < 0.8.6 · CVE-2026-81888 · GHSA-fm3f-ch8h-qw8q
- High, CVSS 8.6
elFinder: SSRF protection bypass via DNS rebinding in the
fsock_get_contents()fallbackPackagist studio-42/elfinder · Upgrade to 2.1.70 or later · <= 2.1.69 · CVE-2026-81889 · GHSA-8x3q-jpjh-qh5c · amended
- Medium, CVSS 6.3
TYPO3 CMS - Unrestricted File Upload in Form Framework
Packagist typo3/cms-form · Upgrade to 14.3.5 or later · >= 14.2.0, <= 14.3.4 · CVE-2026-15305 · GHSA-mfqj-cqv3-h7xw · amended
- High, CVSS 7.3
zbus_polkit: authorization bypass via PID reusecrates.io zbus_polkit · Upgrade to 5.1.0 or later · >= 0.0.0-0, < 5.1.0 · CVE-2026-78422 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.