Medium, CVSS 5.3
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
npm n8n · Upgrade to 2.38.2 or 2.37.7 by release line · >= 2.38.0, < 2.38.2; < 2.37.7 · CVE-2026-86996 · GHSA-7hgx-277f-7vmg · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 89 matching · newest first
- Medium, CVSS 6.5
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
npm nodemailer · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-92598 · GHSA-wmmp-3585-3rmp · amended
- High, CVSS 7.5
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
npm nodemailer · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-92596 · GHSA-2x7j-588g-ccc2 · amended
- Medium, CVSS 6.5
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
npm nodemailer · Upgrade to 9.1.0 or later · >= 6.9.16, < 9.1.0 · CVE-2026-92597 · GHSA-cc9r-2j5m-2m83 · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via crafted multipart field names
npm multer · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2026-77078 · GHSA-wc9g-mqfw-jrwm · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
npm multer · Upgrade to 2.3.0 or later · >= 2.2.0, <= 2.2.0 · CVE-2026-77037 · GHSA-qfvm-cv95-jqjf · amended
- Low, CVSS 3.7
multer vulnerable to file size limit bypass via async fileFilter race condition
npm multer · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2026-77063 · GHSA-qvfw-j98x-7q72 · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via oversized array index in field names
npm multer · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2026-82333 · GHSA-535w-7cp7-47q4 · amended
- Medium, CVSS 5.3
morgan vulnerable to Log Forging via unescaped Unicode line separators
npm morgan · Upgrade to 1.12.0 or later · < 1.12.0 · CVE-2026-15603 · GHSA-jxfw-x594-9x9m · amended
- High, CVSS 8.6
Windows ML CLI: CORS misconfig enables localhost RCE
PyPI winml-cli · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2026-84452 · GHSA-96p9-rh4f-92cf · amended
- High, CVSS 8.6
mongodb: Reject "." and NUL bytes in database and collection names
Packagist mongodb/mongodb · Upgrade to 2.4.1 or 1.21.4 by release line · < 1.21.4; >= 2.0.0, < 2.4.1 · CVE-2026-81525 · GHSA-65fr-j4p9-vc33 · amended
- Critical, CVSS 9.8
Astro: Remote code execution through AVIF image optimization
npm astro · Upgrade to 7.2.8 or later · < 7.2.8 · GHSA-26w7-cxv4-gfx2 · amended
- Medium, CVSS 6.3
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
npm astro · Upgrade to 7.2.4 or later · <= 7.2.3 · CVE-2026-84376 · GHSA-376h-93r7-7g6f · amended
- High, CVSS 7.7
Composer arbitrary command execution via a malicious package's Perforce source URL
Packagist composer/composer · Upgrade to 2.10.3 or 2.2.30 by release line · >= 2.3.0, < 2.10.3; >= 1.0, < 2.2.30 · CVE-2026-84361 · GHSA-rvx4-ffvw-m9q3 · amended
- High, CVSS 8.9
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
npm sharp · Upgrade to 0.35.4 or later · < 0.35.4 · CVE-2026-114112 · GHSA-rgj7-g3m4-5g8c · amended
- High, CVSS 7.5
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
npm js-yaml · Upgrade to 4.3.2 or 3.15.2 by release line · >= 4.0.0, < 4.3.2; >= 3.0.0, < 3.15.2 · CVE-2026-84375 · GHSA-2883-xcg3-v3hh · amended
- Medium, CVSS 6.3
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
Packagist phpseclib/phpseclib · Upgrade to 4.0.1 or 3.0.57 by release line · < 3.0.57; >= 4.0.0, < 4.0.1 · CVE-2026-84308 · GHSA-q97c-8qh3-fpc6 · amended
- High, CVSS 8.7
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
npm @tiptap/core · Upgrade to 3.30.5 or later · >= 3.7.0, < 3.30.5 · GHSA-j95f-988m-3j2f · amended
- Medium, CVSS 6.5
Hono: Incomplete fix for CVE-2026-39408:
toSSG()still writes files outside the output directorynpm hono · Upgrade to 4.13.5 or later · < 4.13.5 · CVE-2026-84365 · GHSA-gqvv-2mrq-wpjv · amended
- Medium, CVSS 5.3
Hono: Unbounded dot-notation nesting in
parseBody()can cause memory exhaustionnpm hono · Upgrade to 4.13.5 or later · < 4.13.5 · CVE-2026-84364 · GHSA-g6gw-c38x-mqfc · amended
- Medium, CVSS 5.9
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
npm hono · Upgrade to 4.13.5 or later · < 4.13.5 · CVE-2026-84363 · GHSA-crvj-82cr-hjcx · amended
- High, CVSS 8.7
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing
:authorityandHostheadersGo google.golang.org/grpc · Upgrade to 1.85.0-dev.0.20260825072537-93e31b48545e (pre-release), 1.84.0-dev.0.20260825144003-d5a41119e0e3 (pre-release), 1.83.2 or 1.82.2 by release line · < 1.82.2; >= 1.83.0, < 1.83.2; >= 1.84.0-dev, < 1.84.0-dev.0.20260825144003-d5a41119e0e3; >= 1.85.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e · CVE-2026-84445 · GHSA-2v4p-qf9q-27wj · amended
- Critical, CVSS 9.5
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
npm next · Upgrade to 16.3.3 or 15.5.24 by release line · >= 10.0.0, < 15.5.24; >= 16.0.0, < 16.3.3 · GHSA-2xp9-vwfh-vxw4 · amended
- High, CVSS 8.2
SVGO: removeScripts allows executable links through namespace and control-character bypasses
npm svgo · Upgrade to 4.1.0, 3.3.5 or 2.8.4 by release line · >= 1.0.0, < 2.8.4; >= 3.0.0, < 3.3.5; >= 4.0.0, < 4.1.0 · CVE-2026-84370 · GHSA-w27v-7q3p-w38r · amended
- Medium, CVSS 6.1
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
npm svgo · Upgrade to 4.1.0, 3.3.5 or 2.8.4 by release line · >= 1.0.0, < 2.8.4; >= 3.0.0, < 3.3.5; >= 4.0.0, < 4.1.0 · CVE-2026-84369 · GHSA-4vpr-x523-8j87 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.