Medium, CVSS 5.3
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (isValidMqaServer)
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.112 or later · < 0.4.112 · CVE-2026-73845 · GHSA-83x6-42hr-jc76
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 78 matching · newest first
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (
- Critical, CVSS 9.8
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171108-5e8f99f40a8a (pre-release) or later · < 0.0.0-20260512171108-5e8f99f40a8a · CVE-2026-72920 · GHSA-2v6v-25fm-p4fg · amended
- High, CVSS 8.7
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Packagist getgrav/grav · Upgrade to 2.0.7 or later · < 2.0.7 · CVE-2026-64850 · GHSA-fj2p-qj2f-74v5 · amended
- Medium, CVSS 6.0
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Packagist getgrav/grav · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2026-62237 · GHSA-37f3-6p89-6qr9 · amended
- Medium, CVSS 6.3
qs array-limit bypass via bracket-key comma parsing
npm qs · Upgrade to 6.16.0 or later · >= 6.14.2, <= 6.15.3 · CVE-2026-82562 · GHSA-x5fp-wj9c-mxmx
- Medium, CVSS 6.3
qs: Denial of Service via Attacker Controlled isBuffer
npm qs · Upgrade to 6.16.0 or later · >= 2.2.5, < 6.16.0 · CVE-2026-82417 · GHSA-4mjr-xmp4-gh2g
- Medium, CVSS 6.4
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
npm @tiptap/core · Upgrade to 3.30.4 or later · >= 2.0.0-alpha.0, < 3.30.4 · GHSA-cp6q-959q-f8rh
- High, CVSS 8.1
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Packagist easycorp/easyadmin-bundle · Upgrade to 5.5.1 or 4.29.16 by release line · >= 4.0.0, < 4.29.16; >= 5.0.0, < 5.5.1 · CVE-2026-81892 · GHSA-g2fm-8hr4-j82h · amended
- Medium, CVSS 5.1
Livewire DOM-based cross-site scripting during client-side state handling
Packagist livewire/livewire · Upgrade to 4.3.4 or 3.8.3 by release line · >= 3.0.0-beta.1, <= 3.8.2; >= 4.0.0-beta.1, <= 4.3.3 · CVE-2026-81887 · GHSA-g3hc-697w-wm82 · amended
- High, CVSS 7.5
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
PyPI tornado · Upgrade to 6.5.8 or later · <= 6.5.7 · CVE-2026-82397 · GHSA-mpf4-983q-p7j4
- Medium, CVSS 6.0
Banks: Path traversal in
DirectoryPromptRegistry.set()allows arbitrary file write outside the registry rootPyPI banks · Upgrade to 2.4.5 or later · < 2.4.5 · CVE-2026-71492 · GHSA-x8wg-4xgc-vr54
- Medium, CVSS 6.9
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
PyPI pypdf · Upgrade to 6.15.0 or later · < 6.15.0 · CVE-2026-82398 · GHSA-fc8x-2rww-xw9m
- Medium, CVSS 5.4
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Packagist studio-42/elfinder · Upgrade to 2.1.70 or later · < 2.1.70 · CVE-2026-81890 · GHSA-9hjf-w35w-6vx2 · amended
- High, CVSS 7.1
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
npm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · < 10.34.5; >= 11.0.0, < 11.11.0 · CVE-2026-82392 · GHSA-c59q-g84q-2gj5
- High, CVSS 7.5
pnpm: A tarball dependency's manifest
nameescapes node_modules → arbitrary file write/overwrite on installnpm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · < 10.34.5; >= 11.0.0, < 11.11.0 · CVE-2026-82393 · GHSA-vq4v-j7r6-jq4m
- Medium, CVSS 6.9
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81722 · GHSA-ww6m-cw3f-q94g
- Medium, CVSS 6.9
NLTK: Downloader.download follows hardlinks and overwrites outside-root files
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81727 · GHSA-f794-5jv7-7672
- High, CVSS 8.3
NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-81726 · GHSA-8mgp-746c-j5xp · amended
- Medium, CVSS 6.3
NLTK: Quadratic CPU Exhaustion in
XMLCorpusView._read_xml_fragment()PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81723 · GHSA-vp2x-qp44-57v7
- Medium, CVSS 6.9
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-12876 · GHSA-ff5c-cp5c-9wjf
- Medium, CVSS 6.9
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81724 · GHSA-cw6x-m8jw-qmrh
- Low, CVSS 3.3
ImageMagick: Memory Leak when providing invalid options to the cli
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-66011 · GHSA-cvhv-g4rq-3hmw · amended
- Medium, CVSS 5.7
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
npm @humanfs/node · Upgrade to 0.16.8 or later · < 0.16.8 · GHSA-p498-v437-472g
- High, CVSS 7.8
Faker: helpers.fake exploitable into arbritary code execution
npm @faker-js/faker · Upgrade to 10.5.0 or later · <= 10.4.0 · CVE-2026-73231 · GHSA-qxc2-j82w-r537
- High, CVSS 7.7
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260704035520-68cc0f537dfa (pre-release) or later · < 0.0.0-20260704035520-68cc0f537dfa · CVE-2026-59832 · GHSA-275h-v5h9-vr82 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.