High, CVSS 8.5
Backstage: Improper input validation in Sentry scaffolder actions
npm @backstage/plugin-scaffolder-backend-module-sentry · Upgrade to 0.3.8 or later · >= 0.3.0, < 0.3.8 · CVE-2026-106459 · GHSA-g734-fhp4-7mfp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 2.1.0, < 3.2.0; >= 4.0.0, < 4.1.2 · CVE-2026-106115 · GHSA-jjfr-hcj7-qf5w · amended
- High, CVSS 7.5
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or later · >= 4.0.0, <= 4.1.1 · CVE-2026-106112 · GHSA-ffp7-56pq-64mr · amended
- High, CVSS 7.5
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 2.0.0, < 3.2.0; >= 4.0.0, < 4.1.2 · CVE-2026-106110 · GHSA-j9gm-c75j-xc9q · amended
- High, CVSS 7.5
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 2.0.0, < 3.2.0; >= 4.0.0, < 4.1.2 · CVE-2026-106113 · GHSA-j3p4-wp97-rph4 · amended
- High, CVSS 7.8
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
PyPI hydra-optuna-sweeper · Upgrade to 1.4.0.dev10 (pre-release) or 1.3.0 by release line · >= 1.2.0, < 1.3.0; >= 1.4.0.dev4, < 1.4.0.dev10 · CVE-2026-106440 · GHSA-5jjj-9xc3-rm56
- High, CVSS 8.5
Hydra: Mutable instantiate policy sets allow target blocklist bypass
PyPI hydra-core · Upgrade to 1.4.0.dev10 (pre-release) or 1.3.7 by release line · >= 1.3.4, < 1.3.7; >= 1.4.0.dev4, < 1.4.0.dev10 · CVE-2026-106439 · GHSA-mwj6-rfh8-7qf4
- High, CVSS 8.5
PraisonAI: Crawl4AI/Chromium backend is also affected by the
web_crawlSSRF validation bypassPyPI praisonaiagents · Upgrade to 1.6.78 or later · <= 1.6.77 · CVE-2026-61429 · GHSA-6g59-gm2v-qhvq · amended
- High, CVSS 8.8
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
PyPI weasyprint · Upgrade to 70.0 or later · <= 69.0 · CVE-2026-106443 · GHSA-r543-q48m-4c9j · amended
- High, CVSS 7.2
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
Packagist kunstmaan/bundles-cms +1 · Upgrade all 2 to 7.3.2 or later · < 7.3.2 · CVE-2026-104890 · GHSA-p279-5wcv-45vq · amended
- Critical, CVSS 10.0
vm2 contains a sandbox escape vulnerability
npm vm2 · Upgrade to 3.12.1 or later · <= 3.12.0 · CVE-2026-93605 · GHSA-pq68-rvw4-xp4r · amended
- High, CVSS 7.8
Hydra logging configuration permits unsafe callable resolution
PyPI hydra-core · Upgrade to 1.4.0.dev9 (pre-release) or 1.3.6 by release line · < 1.3.6; >= 1.4.0.dev0, < 1.4.0.dev9 · CVE-2026-106441 · GHSA-c3wx-c55w-pxjq
- High, CVSS 7.8
Hydra instantiate target blacklist bypasses permit code execution
PyPI hydra-core · Upgrade to 1.4.0.dev9 (pre-release) or 1.3.6 by release line · >= 1.3.4, < 1.3.6; >= 1.4.0.dev0, < 1.4.0.dev9 · CVE-2026-106442 · GHSA-rqx7-p7vv-w7hr
- High, CVSS 7.5
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
npm @insumermodel/mppx-condition-gate · Upgrade to 3.0.0 or later · <= 2.0.3 · +1 more package · CVE-2026-104891 · GHSA-jg6q-3qfh-r9f8 · amended
- High, CVSS 7.7
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106510 · GHSA-4488-j8vj-vqqv · amended
- High, CVSS 8.8
Backstage: Improper validation of TechDocs MkDocs configuration
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106558 · GHSA-qmw3-745m-w99g · amended
- High, CVSS 7.1
Backstage: Improper repository path validation in a Scaffolder backend module
npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown · Upgrade to 0.3.25 or later · < 0.3.25 · CVE-2026-106560 · GHSA-2cmg-v53w-8xfp · amended
- High, CVSS 8.5
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud · Upgrade to 0.3.10 or later · < 0.3.10 · +1 more package · CVE-2026-106486 · GHSA-g8rx-f7m5-7794 · amended
- High, CVSS 8.1
Backstage: Improper authentication in the OIDC provider
npm @backstage/plugin-auth-backend-module-oidc-provider · Upgrade to 0.4.20 or later · < 0.4.20 · CVE-2026-106488 · GHSA-826h-28h9-65hg · amended
- High, CVSS 7.6
Backstage: Improper preservation of access restrictions during service credential delegation
npm @backstage/backend-defaults · Upgrade to 0.17.8 or later · < 0.17.8 · CVE-2026-106492 · GHSA-cq7v-rfgc-5c7v · amended
- High, CVSS 7.7
Backstage: Improper URL validation in catalog entity placeholder resolution
npm @backstage/plugin-catalog-backend · Upgrade to 3.9.1 or later · < 3.9.1 · CVE-2026-106498 · GHSA-qgvj-qcf8-xq73 · amended
- Critical, CVSS 9.6
Backstage: Sensitive information exposure in Scaffolder
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0, 4.0.3, 3.4.1 or 3.3.1 by release line · < 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 · CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p · amended
- High, CVSS 8.1
Backstage: Scaffolder action input authorization bypass
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0, 4.0.3, 3.4.1 or 3.3.1 by release line · < 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 · CVE-2026-106503 · GHSA-hmp2-4m7g-22cv · amended
- High, CVSS 8.5
Backstage: Improper task state validation in Scaffolder backend
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0 or later · < 4.1.0 · CVE-2026-106500 · GHSA-xvgh-hmx8-9xxf · amended
- High, CVSS 7.7
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106505 · GHSA-p75x-jh7p-ppcx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.