Medium, CVSS 5.7
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation
Go github.com/junegunn/fzf · Upgrade to 0.73.1 or later · < 0.73.1 · CVE-2026-53433 · GHSA-mvmf-94v6-879g · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 60 matching · newest first
- Medium, CVSS 5.3
Portainer CE allows username enumeration through authentication response timing
Go github.com/portainer/portainer · Upgrade to 0.6.1-0.20240417040827-48bc7d0d92f0 (pre-release) or later · < 0.6.1-0.20240417040827-48bc7d0d92f0 · CVE-2024-29296 · GHSA-87x6-8m9v-g8c2 · amended
- Medium, CVSS 6.8
OpenShift Cluster Logging Operator missing authorization flaw
Go github.com/openshift/cluster-logging-operator · Upgrade to 0.0.0-20260804174055-1864c2a9851d (pre-release) or later · < 0.0.0-20260804174055-1864c2a9851d · CVE-2026-10609 · GHSA-9xm2-gw56-wj7m · amended
- Medium, CVSS 4.1
Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.1 or later · < 0.91.1 · CVE-2026-61681 · GHSA-fjwv-jf2v-j499 · amended
- Medium, CVSS 5.5
Gardener: Authorization Bypass via Group Subject Injection
Go github.com/gardener/gardener · Upgrade to 1.144.2, 1.143.3 or 1.142.6 by release line · < 1.142.6; >= 1.143.0, < 1.143.3; >= 1.144.0, < 1.144.2 · CVE-2026-79767 · GHSA-gfjv-gqf2-c888 · amended
- High, CVSS 8.2
Zod can exhaust memory while validating oversized constrained collections
npm zod · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2023-54404 · GHSA-mrhx-c7xc-m3w5 · amended
- Medium, CVSS 5.8
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73606 · GHSA-vg99-7gj7-2fr5 · amended
- High, CVSS 8.6
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · >= 0.0.0-20260726161145-9b8e8956f997, < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73608 · GHSA-9cqf-hhrq-7v45 · amended
- Medium, CVSS 5.8
SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73609 · GHSA-j4ph-9xwf-wcj4 · amended
- Medium, CVSS 5.8
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73605 · GHSA-hf8h-97gm-4x2p · amended
- Medium, CVSS 5.8
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73607 · GHSA-53fp-9jmv-227g · amended
- Medium, CVSS 6.8
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.4, <= 3.11.6 · CVE-2026-92952 · GHSA-jf8q-945g-9q4c · amended
- Critical, CVSS 9.9
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
npm vm2 · Upgrade to 3.11.7 or later · >= 3.9.6, <= 3.11.6 · CVE-2026-92948 · GHSA-qhwx-74w5-xhxq · amended
- High, CVSS 8.6
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92950 · GHSA-jxxv-8r27-vm4p · amended
- Critical, CVSS 10.0
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92940 · GHSA-h85j-hv3c-qfgq · amended
- Critical, CVSS 9.9
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92951 · GHSA-c48m-32m9-vx93 · amended
- High, CVSS 8.5
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92958 · GHSA-6rh5-qq4q-97xh · amended
- Critical, CVSS 9.9
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92957 · GHSA-8686-vhfx-7r3j · amended
- Medium, CVSS 4.0
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
npm vm2 · Upgrade to 3.11.7 or later · >= 3.9.6, <= 3.11.6 · CVE-2026-92949 · GHSA-633r-hq9m-c4ff · amended
- Critical, CVSS 9.0
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.4, <= 3.11.6 · CVE-2026-92935 · GHSA-8hr7-r645-pc6w · amended
- Critical, CVSS 10.0
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.6, <= 3.11.6 · CVE-2026-92937 · GHSA-647f-g98j-qq25 · amended
- Critical, CVSS 9.9
vm2 allows a sandboxed plugin to execute native code through
node:sqlitenpm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92938 · GHSA-6w8r-xxw2-g3hx · amended
- Critical, CVSS 9.9
vm2 crypto builtin loads attacker native code through setEngine
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92939 · GHSA-46pr-c5wc-xffx · amended
- Critical, CVSS 9.8
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
npm vm2 · Upgrade to 3.11.7 or later · >= 3.10.2, <= 3.11.6 · CVE-2026-92944 · GHSA-27g9-p43v-cw3v · amended
- Critical, CVSS 10.0
vm2 NodeVM can replace the host process TLS trust store
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92941 · GHSA-98xx-8mx4-x7cm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.