Medium, CVSS 4.8
ZITADEL: Auto-linking by email: IdP-side email verification is not checked
Go github.com/zitadel/zitadel · Upgrade to 4.15.3 or later · < 4.15.3 · CVE-2026-56666 · GHSA-992q-9gwp-7r79 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–18 of 18 matching · newest first
- Critical, CVSS 9.1
yayson: Prototype pollution in Store/LegacyStore deserialization
npm yayson · Upgrade to 4.3.0 or later · <= 4.2.0 · CVE-2026-61534 · GHSA-325j-mg25-8q58 · amended
- High, CVSS 8.8
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
npm @mockoon/commons-server +1 · Upgrade all 2 to 9.7.0 or later · < 9.7.0 · CVE-2026-59148 · GHSA-rqx4-3f6q-3x2v · amended
- Medium, CVSS 6.5
@Mockoon/commons-server: Path traversal in templated
filePathlets a request escape the served directory (prefix-only base check)npm @mockoon/commons-server +1 · Upgrade all 2 to 9.7.0 or later · <= 9.6.1 · CVE-2026-59149 · GHSA-8wqc-v2q8-vff2 · amended
- High, CVSS 8.5
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
npm mcp-from-openapi · Upgrade to 2.5.0 or later · >= 2.3.0, < 2.5.0 · +2 more packages · CVE-2026-59973 · GHSA-65h7-9wrw-629c · amended
- Critical, CVSS 9.6
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
PyPI prowler-cloud · Upgrade to 5.30.3 or later · < 5.30.3 · CVE-2026-59151 · GHSA-h8m9-jgf8-vwvp · amended
- Medium, CVSS 4.2
ZITADEL: Missing Token Expiration (
exp) Validation in JWT IdP ProviderGo github.com/zitadel/zitadel · Upgrade to 4.15.2 or 3.4.12 by release line · >= 4.0.0-rc.1, < 4.15.2; < 3.4.12 · CVE-2026-56665 · GHSA-v77h-2w3m-94hx · amended
- High, CVSS 8.1
Shopper: Missing authorization on product removal actions in CollectionProducts component
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56825 · GHSA-2cg9-97gq-9mqp · amended
- Medium, CVSS 6.5
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56830 · GHSA-99h5-jhh7-v3r3 · amended
- High, CVSS 8.1
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56829 · GHSA-g3f9-g5vj-p62f · amended
- High, CVSS 8.8
Shopper: privilege escalation via improper Livewire admin component authorization
Packagist shopper/framework · Upgrade to 2.9.2 or later · >= 2.8.0, < 2.9.2 · CVE-2026-56828 · GHSA-j328-xmgp-j4q3 · amended
- Medium, CVSS 5.4
Shopping privilege escalation through missing authorization in Settings components
Packagist shopper/framework · Upgrade to 2.9.2 or later · >= 2.0.0, < 2.9.2 · CVE-2026-56826 · GHSA-f7h9-qv4x-9x57 · amended
- Medium, CVSS 6.5
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Packagist shopper/framework · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2026-56831 · GHSA-5vf4-452p-jjhf · amended
- High, CVSS 8.1
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56827 · GHSA-243p-f3cv-c5wh · amended
- High, CVSS 8.8
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
Maven com.linecorp.centraldogma:centraldogma-server-mirror-git · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11745 · GHSA-vjfw-cpmh-xwv3 · amended
- Critical, CVSS 9.4
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Maven com.linecorp.centraldogma:centraldogma-server · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11746 · GHSA-2j95-gqxf-v3vg · amended
- Medium, CVSS 6.9
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
Maven com.linecorp.centraldogma:centraldogma-server-auth-shiro · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11748 · GHSA-98q5-5qh2-7w75 · amended
- Critical, CVSS 10.0
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
PyPI mysql-mcp-server · Upgrade to 0.4.2 or later · < 0.4.2 · CVE-2026-59971 · GHSA-rqfv-2mw9-78g2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.