Medium, CVSS 5.3
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
npm unleash-server · Upgrade to 8.0.3 or later · < 8.0.3 · CVE-2026-76910 · GHSA-8xcj-9hfr-fh9j · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 76 matching · newest first
- Low, CVSS 2.1
Unleash: CR-approval email renders user-controlled raw HTML
npm unleash-server · Upgrade to 8.0.3 or later · < 8.0.3 · CVE-2026-76909 · GHSA-7hvx-28gp-mf6j · amended
- Medium, CVSS 5.1
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
npm @novu/js · Upgrade to 3.18.0 or later · <= 3.17.0 · CVE-2026-75510 · GHSA-8gr3-5j6f-25gp · amended
- Medium, CVSS 6.3
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Maven org.graylog2:graylog2-server · Upgrade to 7.1.4, 7.0.9 or 6.3.14 by release line · >= 6.3.0, < 6.3.14; >= 7.0.0, < 7.0.9; >= 7.1.0, < 7.1.4 · CVE-2026-69190 · GHSA-m9c2-85gv-8xr5 · amended
- High, CVSS 7.5
SIPGO: DoS via unvalidated WebSocket frame length
Go github.com/emiago/sipgo · Upgrade to 1.4.3 or later · <= 1.4.2 · CVE-2026-77322 · GHSA-8h6x-h86x-75wh · amended
- Medium, CVSS 5.3
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
RubyGems mpxj +6 · Upgrade all 7 to 16.5.0 or later · >= 7.3.0, < 16.5.0 · CVE-2026-65829 · GHSA-7952-gx68-cjqr · amended
- High, CVSS 7.5
MPXJ: XXE Vulnerability in MerlinReader
RubyGems mpxj +6 · Upgrade all 7 to 16.4.1 or later · >= 5.5.5, < 16.4.1 · CVE-2026-61570 · GHSA-5vvx-3h34-f3gj · amended
- Medium, CVSS 5.8
Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header
Go github.com/fabiolb/fabio · Upgrade to 1.7.2 or later · >= 1.6.6, <= 1.7.1 · CVE-2026-62987 · GHSA-fq95-v8xc-jm3v · amended
- Unrated
mppx: Gas Draining with access list
npm mppx · Upgrade to 0.8.2 or later · < 0.8.2 · CVE-2026-63628 · GHSA-vc9j-9wph-qghj · amended
- Medium, CVSS 6.3
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.1 or later · < 0.91.1 · CVE-2026-63342 · GHSA-g26x-m427-f48f · amended
- Low, CVSS 2.3
wlc may disclose API tokens to project-configured URLs
PyPI wlc · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2026-62364 · GHSA-3mqq-hv9c-85hc · amended
- High, CVSS 7.5
SIPGO: DoS via unvalidated Content-Length in the stream parser
Go github.com/emiago/sipgo · Upgrade to 1.4.1 or later · <= 1.4.0 · CVE-2026-58268 · GHSA-pg59-5vwg-4jxq · amended
- High, CVSS 8.8
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
npm @deepstream/server · Upgrade to 10.1.1 or later · >= 10.1.0, <= 10.1.0 · CVE-2026-63116 · GHSA-89vx-jh4q-vg3w · amended
- High, CVSS 7.5
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
npm request-filtering-agent · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2026-62985 · GHSA-r3r9-wp5j-pq5g · amended
- Medium, CVSS 6.5
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
PyPI opencve · Upgrade to 3.0.0 or later · <= 1.5.0 · CVE-2026-62282 · GHSA-ch3g-4xvr-674q · amended
- High, CVSS 7.5
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry
PyPI psd-tools · Upgrade to 1.17.4 or later · < 1.17.4 · CVE-2026-59991 · GHSA-8q6g-vjhf-jp8m · amended
- Medium, CVSS 6.5
microsandbox: Secret values exposed in world-readable process arguments
crates.io microsandbox · Upgrade to 0.5.10 or later · < 0.5.10 · CVE-2026-61670 · GHSA-m8f5-rh7h-vgg3 · amended
- Medium, CVSS 5.3
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
npm 9router · Upgrade to 0.5.8 or later · <= 0.5.4 · CVE-2026-56682 · GHSA-32gc-64m7-hj7v · amended
- High, CVSS 7.3
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
npm 9router · Upgrade to 0.5.8 or later · <= 0.5.4 · CVE-2026-56681 · GHSA-5mj8-gf6m-fhw8 · amended
- Medium, CVSS 5.7
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.108 or later · <= 0.4.107 · CVE-2026-61612 · GHSA-798p-78g2-v556 · amended
- Medium, CVSS 5.3
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
npm @sync-in/server · Upgrade to 2.4.1 or later · <= 2.4.0 · CVE-2026-58272 · GHSA-29hq-23m2-2j47 · amended
- Medium, CVSS 6.5
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff
pathFiltersnpm @sync-in/server · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-58270 · GHSA-jx63-h26r-8cph · amended
- High, CVSS 8.1
Sync-in Server has a complete 2FA Bypass via
POST /api/auth/tokennpm @sync-in/server · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-58269 · GHSA-92cr-jxw4-5wjg · amended
- Medium, CVSS 6.8
@sync-in/server vulnerable to TOTP Brute-Force via
POST /api/app/sync/registernpm @sync-in/server · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-58271 · GHSA-274f-6w77-8qm9 · amended
- High, CVSS 7.1
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
npm @roomi-fields/notebooklm-mcp · Upgrade to 2.0.3 or later · >= 1.6.0, < 2.0.3 · CVE-2026-61647 · GHSA-jjhp-8crj-mppq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.