High, CVSS 8.7
source-map-js allows event-loop denial of service through indexed source-map section offsets
npm source-map-js · Upgrade to 1.2.2 or later · >= 1.0.0, < 1.2.2 · CVE-2026-93749 · GHSA-68fv-2mgg-jv7q · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.6
Obot: Server-Side Request Forgery via remote MCP server URL
Go github.com/obot-platform/obot · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-101064 · GHSA-jgh3-fggc-mcpm · amended
- High, CVSS 8.8
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion
Go github.com/obot-platform/obot · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-101062 · GHSA-xwmw-prc4-v3cr · amended
- High, CVSS 7.5
io.moquette:moquette-broker has a Missing Authorization issue
Maven io.moquette:moquette-broker · Upgrade to 0.18.1 or later · < 0.18.1 · CVE-2026-85058 · GHSA-9jjc-fw8x-fmwx · amended
- Critical, CVSS 9.1
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
PyPI mnemosyne-memory · Upgrade to 3.10.1 or later · <= 3.10.0 · CVE-2026-59163 · GHSA-xcw4-53cc-hv32 · amended
- High, CVSS 7.1
Perses's unvalidated project parameter enables filesystem path traversal
Go github.com/perses/perses · Upgrade to 0.54.0-rc.0 (pre-release) or later · < 0.54.0-rc.0 · CVE-2026-63445 · GHSA-vr5f-w35q-98jp · amended
- High, CVSS 8.3
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
Go github.com/perses/perses · Upgrade to 0.54.0-rc.0 (pre-release) or later · >= 0.43.0, < 0.54.0-rc.0 · CVE-2026-63199 · GHSA-4227-9989-jrhx · amended
- High, CVSS 7.1
Perses's project query parameter authorization bypass exposes cross-project resources
Go github.com/perses/perses · Upgrade to 0.54.0-beta.3 (pre-release) or later · < 0.54.0-beta.3 · CVE-2026-63458 · GHSA-cjgj-2fwf-4c2w · amended
- High, CVSS 8.2
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
npm @file-viewer/doc · Upgrade to 2.3.1 or later · <= 2.3.0 · +1 more package · CVE-2026-91127 · GHSA-3753-m2x2-q623 · amended
- High, CVSS 7.5
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
npm adm-zip · Upgrade to 0.6.1 or later · < 0.6.1 · CVE-2026-77301 · GHSA-7q85-xj36-vmfc · amended
- High, CVSS 7.1
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Go github.com/frain-dev/convoy · Upgrade to 0.9.3-0.20260724092134-1cc67cd16fb1 (pre-release) or later · < 0.9.3-0.20260724092134-1cc67cd16fb1 · CVE-2026-81505 · GHSA-p5vg-v7mj-f6q4 · amended
- High, CVSS 7.0
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
PyPI anyio · Upgrade to 4.14.2 or later · >= 4.14.0, < 4.14.2 · CVE-2026-63349 · GHSA-3w57-8xmc-8v26 · amended
- Critical, CVSS 9.3
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
PyPI anyio · Upgrade to 4.14.2 or later · < 4.14.2 · CVE-2026-63374 · GHSA-82r6-8w77-94w6 · amended
- High, CVSS 8.8
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
Go github.com/stacklok/toolhive · Upgrade to 0.30.1 or later · < 0.30.1 · CVE-2026-58197 · GHSA-qg2g-g9w3-m5h8 · amended
- Critical, CVSS 9.9
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Go github.com/kcp-dev/kcp · Upgrade to 0.32.2 or 0.31.4 by release line · < 0.31.4; >= 0.32.0, < 0.32.2 · CVE-2026-61682 · GHSA-c8w2-fgvx-vhv4 · amended
- High, CVSS 7.1
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
Go github.com/projectcapsule/capsule · Upgrade to 0.13.7 or later · <= 0.13.6 · CVE-2026-61672 · GHSA-gjw4-3v3v-rqxg · amended
- High, CVSS 7.5
LMDeploy has an SSRF bypass
PyPI lmdeploy · Upgrade to 0.15.0 or later · >= 0.12.3, < 0.15.0 · CVE-2026-123818 · GHSA-39wr-7q6h-cf68 · amended
- High, CVSS 8.8
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
PyPI lmdeploy · Upgrade to 0.12.3 or later · >= 0.12.1, < 0.12.3 · CVE-2026-33625 · GHSA-3hmm-rh5q-gwwr · amended
- Critical, CVSS 9.8
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
PyPI lmdeploy · Upgrade to 0.16.0 or later · >= 0.9.2, < 0.16.0 · CVE-2025-66455 · GHSA-2vh9-42vm-xmv2 · amended
- High, CVSS 7.3
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
Packagist mediawiki/semantic-media-wiki · Upgrade to 7.3.0 or later · >= 3.0.0, < 7.3.0 · CVE-2026-116890 · GHSA-jr78-w6w5-m8f8 · amended
- High, CVSS 8.6
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Packagist mediawiki/semantic-media-wiki · Upgrade to 7.0.0 or later · >= 3.1.0, < 7.0.0 · CVE-2025-61682 · GHSA-hg8h-557g-q8pp · amended
- Critical, CVSS 9.9
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
Maven org.xwiki.rendering:xwiki-rendering-xml · Upgrade to 14.10.2 or later · < 14.10.2 · CVE-2025-53837 · GHSA-26vp-8gxg-v4pg · amended
- High, CVSS 8.7
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
Maven org.opencastproject:opencast-engage-paella-player-7 · Upgrade to 20.2 or 19.7 by release line · < 19.7; >= 20.0, < 20.2 · +1 more package · CVE-2026-77615 · GHSA-m6c8-jcw2-5r25 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.