High, CVSS 7.5
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
npm @typespec/spector · Upgrade to 0.1.0-alpha.27 (pre-release) or later · <= 0.1.0-alpha.26 · GHSA-7q9c-hpx7-9cwm · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to…
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725132049-2d8b98395a91 (pre-release) or later · < 0.0.0-20260725132049-2d8b98395a91 · CVE-2026-72793 · GHSA-h4v5-crx2-3cv4 · amended
- High, CVSS 8.6
SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725125659-1ca1c3c9d94b (pre-release) or later · < 0.0.0-20260725125659-1ca1c3c9d94b · CVE-2026-72795 · GHSA-h6w7-xxcf-w2mq · amended
- High, CVSS 8.6
SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260725123945-77421530be4a (pre-release) or later · < 0.0.0-20260725123945-77421530be4a · CVE-2026-72794 · GHSA-34fj-mwm6-fjfg · amended
- High, CVSS 8.6
SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260724121519-426991d155c0 (pre-release) or later · < 0.0.0-20260724121519-426991d155c0 · CVE-2026-72798 · GHSA-mfrj-v65r-979c · amended
- High, CVSS 8.1
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
crates.io surrealdb · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-63735 · GHSA-848m-r628-vrxw · amended
A vendor fix does not resolve your finding until you verify it in your own systems.