High, CVSS 7.5
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
npm elysia · Upgrade to 1.4.29 or later · < 1.4.29 · CVE-2026-56669 · GHSA-9643-4qgh-g8mx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
ReactPress has SQL injection via dynamic column names in TypeORM query builders
npm @fecommunity/reactpress · Upgrade to 3.7.0 or later · <= 3.6.0 · CVE-2026-61685 · GHSA-wmw4-mw6x-6vfm · amended
- High, CVSS 7.6
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
npm @openc3/vue-common · Upgrade to 7.3.0 or later · >= 5.0.6, <= 7.2.1 · CVE-2026-77394 · GHSA-gvf2-2rh5-mpgf · amended
- High, CVSS 7.0
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82407 · GHSA-9wh6-9hq7-9688 · amended
- High, CVSS 8.4
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82409 · GHSA-7c7c-373r-gfjj · amended
- High, CVSS 7.1
Klever-Go: Zombie-order theft:
BuymissingIsClaimedguard in native marketplaceGo github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82406 · GHSA-26r5-4mm2-px5c · amended
- High, CVSS 7.7
Formie: Missing authorization on sent notification resend modal exposes submission PII
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76089 · GHSA-9rg8-2wvr-fgjh · amended
- High, CVSS 7.5
Jawn: Quadratic parsing effort in AsyncParser
Maven org.typelevel:jawn-parser_2.13 +2 · Upgrade all 3 to 1.7.0 or later · <= 1.6.0 · CVE-2026-61814 · GHSA-w4cm-gvhj-cgw6 · amended
- High, CVSS 7.5
Jawn: Uncontrolled nesting depth in JSON parser
Maven org.typelevel:jawn-parser_2.13 +2 · Upgrade all 3 to 1.7.0 or later · <= 1.6.0 · CVE-2026-59990 · GHSA-cc4v-rvgp-2pf3 · amended
- High, CVSS 8.7
Klever-Go Account takeover:
kleverUpdateAccountPermissionauthorizes on attacker-controlledRecipientAddrinstead of the authenticated callerGo github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82405 · GHSA-97cv-x867-6xhm · amended
- High, CVSS 7.5
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · < 1.7.20 · CVE-2026-86065 · GHSA-4fwh-wrm6-97xm · amended
- High, CVSS 8.6
Klever-Go: /log controls global node logging
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-86064 · GHSA-9v8p-frvj-2pcm · amended
- Critical, CVSS 9.9
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
RubyGems openc3 · Upgrade to 7.3.0 or later · >= 5.1.0, <= 7.2.1 · CVE-2026-77602 · GHSA-jjq7-m736-w977 · amended
- High, CVSS 8.8
OpenC3 COSMOS: Authenticated OS command injection via the
pypi_urlsettingRubyGems openc3 · Upgrade to 7.3.0 or later · >= 5.12.0, <= 7.2.1 · CVE-2026-77601 · GHSA-vp3w-52v9-q57f · amended
- High, CVSS 8.2
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76087 · GHSA-584p-f93j-wpgc · amended
- High, CVSS 8.5
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76086 · GHSA-v3f3-cmj4-cvj9 · amended
- High, CVSS 7.5
JLine: ReDoS in Built-in grep Command Amplified by Automatic
.*WrappingMaven org.jline:jline-builtins · Upgrade to 4.3.1 or 3.30.15 by release line · >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.30.15 · CVE-2026-77422 · GHSA-r2xf-8xr9-62gw · amended
- High, CVSS 8.7
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
npm 9router · Upgrade to 0.5.4 or later · <= 0.5.2 · CVE-2026-56679 · GHSA-vmjq-hvgq-2wv4 · amended
- High, CVSS 7.4
9router: Image prefetch DNS rebinding allows SSRF to internal services
npm 9router · Upgrade to 0.5.2 or later · <= 0.4.80 · CVE-2026-56676 · GHSA-cmhj-wh2f-9cgx · amended
- High, CVSS 8.3
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
npm 9router · Upgrade to 0.5.2 or later · <= 0.4.80 · CVE-2026-56675 · GHSA-x5c9-v98j-722r · amended
- Critical, CVSS 9.6
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
Maven io.moquette:moquette-broker · Upgrade to 0.18.1 or later · <= 0.18.0 · CVE-2026-85724 · GHSA-5f42-97gr-vfhq · amended
- High, CVSS 8.7
Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)
PyPI zapros · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2026-61652 · GHSA-6cp7-3m3c-5x5c · amended
- Critical, CVSS 9.9
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
PyPI plone-app-portlets · Upgrade to 7.0.2, 6.0.4 or 5.0.8 by release line · >= 7.0.0, <= 7.0.1; >= 6.0.0, <= 6.0.3; >= 5.0.0, <= 5.0.7 · CVE-2026-57149 · GHSA-rr49-f9g6-c9r5 · amended
- High, CVSS 7.1
uncbv: archive extraction is vulnerable to path traversal (zip-slip)crates.io uncbv · Upgrade to 0.3.1 or later · >= 0.0.0-0, < 0.3.1
A vendor fix does not resolve your finding until you verify it in your own systems.