High, CVSS 7.7
Backstage: Improper validation of MkDocs theme configuration in TechDocs
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106509 · GHSA-8w7q-29mw-gf5c · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.7
Backstage has improper input validation in TechDocs Markdown extension configuration
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106557 · GHSA-f7v3-xhm6-w245 · amended
- High, CVSS 7.1
Payload: Field-level write access bypass in Payload on MongoDB
npm @payloadcms/db-mongodb · Upgrade to 4.0.0-canary.20 (pre-release) or 3.87.0 by release line · < 3.87.0; >= 4.0.0-canary.0, < 4.0.0-canary.20 · CVE-2026-106100 · GHSA-4ww4-68q3-h7g5 · amended
- High, CVSS 7.5
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
NuGet imagesharp +1 · Upgrade all 2 to 4.1.1 or 3.2.0 by release line · >= 3.0.0, < 3.2.0; >= 4.0.0, < 4.1.1 · CVE-2026-106118 · GHSA-v76p-62qx-wwq2 · amended
- High, CVSS 7.5
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
NuGet imagesharp · Upgrade to 4.1.1 or 3.2.0 by release line · >= 3.0.0, < 3.2.0; >= 4.0.0, < 4.1.1 · CVE-2026-106117 · GHSA-jj3q-cwqj-842r · amended
- High, CVSS 7.1
Langflow: IP Spoofing Bypass via
X-Forwarded-ForAllowing Remote Configuration WritePyPI langflow · Upgrade to 1.10.3 or later · >= 1.5.0, < 1.10.3 · CVE-2026-105741 · GHSA-4f6c-2vvp-gw82 · amended
- High, CVSS 7.1
Ghost: Authorization Bypass in Comments Feature
npm ghost · Upgrade to 6.44.1 or later · >= 5.9.0, < 6.44.1 · CVE-2026-105681 · GHSA-6q6j-f24j-p477 · amended
- Critical, CVSS 9.0
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-73487 · GHSA-w7x8-q2gp-5cgg · amended
- Critical, CVSS 9.4
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · < 3.1.3 · CVE-2026-73483 · GHSA-9gvv-qjj3-2p6g · amended
- High, CVSS 8.4
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
npm @quasar/cli · Upgrade to 5.0.4 or later · <= 5.0.3 · +2 more packages · CVE-2026-106105 · GHSA-fh39-c73x-5pjv · amended
- High, CVSS 7.1
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable
npm @quasar/render-ssr-error · Upgrade to 2.2.4 or later · <= 2.2.3 · +1 more package · CVE-2026-106106 · GHSA-r5mf-4r5x-q78f · amended
- High, CVSS 8.3
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
npm @quasar/app-vite · Upgrade to 3.3.0 or later · <= 3.2.0 · CVE-2026-106107 · GHSA-5m6h-8g35-p3m7 · amended
- High, CVSS 8.7
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
npm quasar · Upgrade to 2.23.3 or later · <= 2.23.2 · CVE-2026-106104 · GHSA-68jq-fhch-4xq4 · amended
- Critical, CVSS 10.0
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
npm quasar · Upgrade to 2.22.0 or later · < 2.22.0 · CVE-2026-106102 · GHSA-pq96-jpmf-w254 · amended
- High, CVSS 7.1
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
npm @quasar/icongenie · Upgrade to 6.1.1 or later · < 6.1.1 · CVE-2026-106103 · GHSA-wmpw-j6qv-mw88 · amended
- High, CVSS 8.1
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Go github.com/sipcapture/homer-app · Upgrade to 0.0.0-20260625085520-a7d027dc684b (pre-release) or later · < 0.0.0-20260625085520-a7d027dc684b · CVE-2026-62251 · GHSA-f46q-3v67-fmm4 · amended
- Critical, CVSS 9.8
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Go github.com/sipcapture/homer-app · Upgrade to 0.0.0-20260625091610-b2e942031ff8 (pre-release) or later · < 0.0.0-20260625091610-b2e942031ff8 · CVE-2026-62252 · GHSA-6xp5-7rcx-xfgx · amended
- Critical, CVSS 9.8
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
Go github.com/sipcapture/homer-app · Upgrade to 0.0.0-20260625093330-5e90809657c9 (pre-release) or later · < 0.0.0-20260625093330-5e90809657c9 · CVE-2026-62253 · GHSA-rqcc-94gv-wjm9 · amended
- Critical, CVSS 9.1
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-62176 · GHSA-g6j7-pffp-8whg · amended
- Critical, CVSS 9.2
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs
Go github.com/mudler/LocalAI · Upgrade to 1.40.1-0.20260703213242-2cbb3c96b34d (pre-release) or later · < 1.40.1-0.20260703213242-2cbb3c96b34d · CVE-2026-59707 · GHSA-8c5q-hx4g-qq23 · amended
- High, CVSS 8.6
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61436 · GHSA-7c92-x8vg-4258 · amended
- High, CVSS 7.3
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61428 · GHSA-qj9c-59p6-8cgx · amended
- High, CVSS 7.1
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
npm @actual-app/sync-server · Upgrade to 26.7.0 or later · <= 26.6.0 · CVE-2026-57449 · GHSA-m62c-5q34-f3cf · amended
A vendor fix does not resolve your finding until you verify it in your own systems.