Critical, CVSS 9.1
yayson: Prototype pollution in Store/LegacyStore deserialization
npm yayson · Upgrade to 4.3.0 or later · <= 4.2.0 · CVE-2026-61534 · GHSA-325j-mg25-8q58 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
npm @mockoon/commons-server +1 · Upgrade all 2 to 9.7.0 or later · < 9.7.0 · CVE-2026-59148 · GHSA-rqx4-3f6q-3x2v · amended
- High, CVSS 8.5
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
npm mcp-from-openapi · Upgrade to 2.5.0 or later · >= 2.3.0, < 2.5.0 · +2 more packages · CVE-2026-59973 · GHSA-65h7-9wrw-629c · amended
- Critical, CVSS 9.6
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
PyPI prowler-cloud · Upgrade to 5.30.3 or later · < 5.30.3 · CVE-2026-59151 · GHSA-h8m9-jgf8-vwvp · amended
- High, CVSS 8.1
Shopper: Missing authorization on product removal actions in CollectionProducts component
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56825 · GHSA-2cg9-97gq-9mqp · amended
- High, CVSS 8.1
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56829 · GHSA-g3f9-g5vj-p62f · amended
- High, CVSS 8.8
Shopper: privilege escalation via improper Livewire admin component authorization
Packagist shopper/framework · Upgrade to 2.9.2 or later · >= 2.8.0, < 2.9.2 · CVE-2026-56828 · GHSA-j328-xmgp-j4q3 · amended
- High, CVSS 8.1
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56827 · GHSA-243p-f3cv-c5wh · amended
- High, CVSS 8.8
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
Maven com.linecorp.centraldogma:centraldogma-server-mirror-git · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11745 · GHSA-vjfw-cpmh-xwv3 · amended
- Critical, CVSS 9.4
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Maven com.linecorp.centraldogma:centraldogma-server · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11746 · GHSA-2j95-gqxf-v3vg · amended
- Critical, CVSS 10.0
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
PyPI mysql-mcp-server · Upgrade to 0.4.2 or later · < 0.4.2 · CVE-2026-59971 · GHSA-rqfv-2mw9-78g2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.