High, CVSS 7.5
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
npm elysia · Upgrade to 1.4.29 or later · < 1.4.29 · CVE-2026-56669 · GHSA-9643-4qgh-g8mx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 37 matching · newest first
- High, CVSS 7.5
ReactPress has SQL injection via dynamic column names in TypeORM query builders
npm @fecommunity/reactpress · Upgrade to 3.7.0 or later · <= 3.6.0 · CVE-2026-61685 · GHSA-wmw4-mw6x-6vfm · amended
- Medium, CVSS 6.5
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
PyPI plone-app-contenttypes · Upgrade to 5.0.1, 4.0.10 or 3.0.12 by release line · >= 5.0.0, <= 5.0.0; >= 4.0.0, <= 4.0.9; <= 3.0.11 · GHSA-8pcw-h6w9-h46g · amended
- Medium, CVSS 6.5
plone.app.dexterity has a Denial of Service due to excessive title or description length
PyPI plone-app-dexterity · Upgrade to 5.0.1, 4.1.3 or 3.2.3 by release line · >= 5.0.0, <= 5.0.0; >= 4.0.0, <= 4.1.2; <= 3.2.2 · CVE-2026-57576 · GHSA-5426-92w4-wvhv · amended
- High, CVSS 7.6
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
npm @openc3/vue-common · Upgrade to 7.3.0 or later · >= 5.0.6, <= 7.2.1 · CVE-2026-77394 · GHSA-gvf2-2rh5-mpgf · amended
- High, CVSS 7.0
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82407 · GHSA-9wh6-9hq7-9688 · amended
- High, CVSS 8.4
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82409 · GHSA-7c7c-373r-gfjj · amended
- High, CVSS 7.1
Klever-Go: Zombie-order theft:
BuymissingIsClaimedguard in native marketplaceGo github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82406 · GHSA-26r5-4mm2-px5c · amended
- High, CVSS 7.7
Formie: Missing authorization on sent notification resend modal exposes submission PII
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76089 · GHSA-9rg8-2wvr-fgjh · amended
- High, CVSS 7.5
Jawn: Quadratic parsing effort in AsyncParser
Maven org.typelevel:jawn-parser_2.13 +2 · Upgrade all 3 to 1.7.0 or later · <= 1.6.0 · CVE-2026-61814 · GHSA-w4cm-gvhj-cgw6 · amended
- High, CVSS 7.5
Jawn: Uncontrolled nesting depth in JSON parser
Maven org.typelevel:jawn-parser_2.13 +2 · Upgrade all 3 to 1.7.0 or later · <= 1.6.0 · CVE-2026-59990 · GHSA-cc4v-rvgp-2pf3 · amended
- High, CVSS 8.7
Klever-Go Account takeover:
kleverUpdateAccountPermissionauthorizes on attacker-controlledRecipientAddrinstead of the authenticated callerGo github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82405 · GHSA-97cv-x867-6xhm · amended
- High, CVSS 7.5
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · < 1.7.20 · CVE-2026-86065 · GHSA-4fwh-wrm6-97xm · amended
- High, CVSS 8.6
Klever-Go: /log controls global node logging
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-86064 · GHSA-9v8p-frvj-2pcm · amended
- Medium, CVSS 5.3
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
PyPI mesop · Upgrade to 1.3.4 or later · <= 1.3.3 · CVE-2026-93421 · GHSA-g7f6-rxc4-qhph · amended
- Critical, CVSS 9.9
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
RubyGems openc3 · Upgrade to 7.3.0 or later · >= 5.1.0, <= 7.2.1 · CVE-2026-77602 · GHSA-jjq7-m736-w977 · amended
- High, CVSS 8.8
OpenC3 COSMOS: Authenticated OS command injection via the
pypi_urlsettingRubyGems openc3 · Upgrade to 7.3.0 or later · >= 5.12.0, <= 7.2.1 · CVE-2026-77601 · GHSA-vp3w-52v9-q57f · amended
- High, CVSS 8.2
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76087 · GHSA-584p-f93j-wpgc · amended
- High, CVSS 8.5
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76086 · GHSA-v3f3-cmj4-cvj9 · amended
- Medium, CVSS 6.9
Sulu: JCR-SQL2 injection via
categoriesquery parameter (unauthenticated)Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · < 2.6.25; >= 3.0.0, < 3.0.8 · CVE-2026-92692 · GHSA-jg26-q8hg-3pq4 · amended
- Medium, CVSS 6.5
JLine: ReDoS in Nano Editor Regex Search Mode
Maven org.jline:jline-builtins · Upgrade to 4.3.1 or 3.30.15 by release line · >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.30.15 · CVE-2026-77421 · GHSA-ph9c-7hw9-vhhw · amended
- High, CVSS 7.5
JLine: ReDoS in Built-in grep Command Amplified by Automatic
.*WrappingMaven org.jline:jline-builtins · Upgrade to 4.3.1 or 3.30.15 by release line · >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.30.15 · CVE-2026-77422 · GHSA-r2xf-8xr9-62gw · amended
- High, CVSS 8.7
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
npm 9router · Upgrade to 0.5.4 or later · <= 0.5.2 · CVE-2026-56679 · GHSA-vmjq-hvgq-2wv4 · amended
- Medium, CVSS 6.4
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
npm 9router · Upgrade to 0.5.6 or later · <= 0.5.2 · CVE-2026-56678 · GHSA-6mwv-4mrm-5p3m · amended
- High, CVSS 7.4
9router: Image prefetch DNS rebinding allows SSRF to internal services
npm 9router · Upgrade to 0.5.2 or later · <= 0.4.80 · CVE-2026-56676 · GHSA-cmhj-wh2f-9cgx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.