Critical, CVSS 9.3
Hazelcast allows arbitrary member memory access by low-privileged client
Maven com.hazelcast:hazelcast · Upgrade to 5.7.0 or later · >= 5.6.0, < 5.7.0; >= 5.5.0, < 5.7.0; < 5.7.0 · CVE-2026-107726 · GHSA-6v25-8wq6-xq4j · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
Hazelcast has an authorization bypass in IMap Predicates API
Maven com.hazelcast:hazelcast · Upgrade to 5.7.0 or later · >= 5.6.0, < 5.7.0; >= 5.5.0, < 5.7.0; < 5.7.0 · CVE-2026-107725 · GHSA-w294-6q5q-53p8 · amended
- High, CVSS 7.4
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
npm fast-jwt · Upgrade to 6.3.1 or later · <= 6.3.0 · CVE-2026-107720 · GHSA-8wpc-h4q6-8fxv · amended
- Critical, CVSS 9.8
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
npm fast-jwt · Upgrade to 6.3.0 or later · >= 6.2.0, <= 6.2.4 · CVE-2026-107722 · GHSA-ww5h-9m49-7xx4 · amended
- High, CVSS 8.1
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
npm fast-jwt · Upgrade to 6.3.0 or later · <= 6.2.4 · CVE-2026-107723 · GHSA-5hjw-83fp-phq9 · amended
- High, CVSS 7.4
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
npm fast-jwt · Upgrade to 6.3.0 or later · >= 6.2.4, <= 6.2.4 · CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx · amended
- High, CVSS 8.6
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
npm praisonai · Upgrade to 1.7.3 or later · < 1.7.3 · CVE-2026-61426 · GHSA-6wjp-v33h-5cvq · amended
- High, CVSS 7.1
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
PyPI praisonai-platform · Upgrade to 0.1.9 or later · <= 0.1.8 · CVE-2026-61442 · GHSA-c78w-2q4r-68r7 · amended
- High, CVSS 8.8
PraisonAI: Shell command allowlist bypass via find -exec built-in action
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61434 · GHSA-cv3g-hj65-pcfh · amended
- Critical, CVSS 9.9
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61445 · GHSA-9mp3-24cc-77mg · amended
- High, CVSS 7.3
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61427 · GHSA-hc5v-gxvj-58wh · amended
- High, CVSS 8.7
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60085 · GHSA-5r6c-gj4g-r697 · amended
- High, CVSS 7.2
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60091 · GHSA-4w49-gwv8-fpjg · amended
- High, CVSS 7.5
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
PyPI pydantic-ai +1 · Upgrade all 2 to 2.53.0 or later · >= 2.10.0, < 2.53.0 · CVE-2026-107286 · GHSA-6fqq-452j-qhrp · amended
- High, CVSS 7.4
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107385 · GHSA-r3rv-jm3r-62q2 · amended
- High, CVSS 8.1
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · >= 3.2.0, < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107384 · GHSA-v6pj-gxxw-phfw · amended
- High, CVSS 7.5
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107383 · GHSA-48qf-xh34-q73r · amended
- High, CVSS 8.7
CairoSVG: Quadratic-time DoS parsing a crafted SVG
PyPI cairosvg · Upgrade to 2.9.1 or later · <= 2.9.0 · CVE-2026-107378 · GHSA-c3jg-qh8m-j3h2 · amended
- High, CVSS 7.8
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61433 · GHSA-79fv-7hq9-w7xg · amended
- High, CVSS 8.2
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61435 · GHSA-2gpf-2492-q9jh · amended
- High, CVSS 7.5
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
PyPI datamodel-code-generator · Upgrade to 0.81.0 or later · >= 0.59.0, <= 0.80.0 · CVE-2026-107377 · GHSA-77xj-x4rm-935c · amended
- Critical, CVSS 9.8
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
npm handlebars · Upgrade to 4.7.10 or later · >= 4.0.0, <= 4.7.9 · CVE-2026-106446 · GHSA-8r5x-fm3f-whwj · amended
- Critical, CVSS 9.2
Handlebars: JavaScript Injection via Own Property Check Bypass
npm handlebars · Upgrade to 4.7.10 or later · >= 3.0.0, <= 4.7.9 · CVE-2026-106445 · GHSA-p8wg-vrv2-v86f · amended
- High, CVSS 8.7
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 (pre-release) or later · >= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2 · CVE-2026-107211 · GHSA-mx22-3794-2vpv · amended
- High, CVSS 8.8
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
npm generator-jhipster · Upgrade to 9.4.0 or later · >= 7.0.0, < 9.4.0 · CVE-2026-107375 · GHSA-r223-96jv-q533 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.