Medium, CVSS 6.8
Mechanize sends credential headers to another origin after a meta refresh
RubyGems mechanize · Upgrade to 2.14.1 or later · < 2.14.1 · CVE-2026-107399 · GHSA-c6rp-p8xm-4q9f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 104 matching · newest first
- Medium, CVSS 6.8
Mechanize sends credential headers to another host after an HTTP redirect
RubyGems mechanize · Upgrade to 2.14.1 or later · < 2.14.1 · CVE-2026-107715 · GHSA-2mwr-xjcg-37j7 · amended
- High, CVSS 7.4
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
npm fast-jwt · Upgrade to 6.3.1 or later · <= 6.3.0 · CVE-2026-107720 · GHSA-8wpc-h4q6-8fxv · amended
- Critical, CVSS 9.8
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
npm fast-jwt · Upgrade to 6.3.0 or later · >= 6.2.0, <= 6.2.4 · CVE-2026-107722 · GHSA-ww5h-9m49-7xx4 · amended
- Medium, CVSS 5.9
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
npm fast-jwt · Upgrade to 6.3.0 or later · <= 6.2.4 · CVE-2026-107721 · GHSA-687g-22h4-j4w4 · amended
- High, CVSS 8.1
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
npm fast-jwt · Upgrade to 6.3.0 or later · <= 6.2.4 · CVE-2026-107723 · GHSA-5hjw-83fp-phq9 · amended
- High, CVSS 7.4
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
npm fast-jwt · Upgrade to 6.3.0 or later · >= 6.2.4, <= 6.2.4 · CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx · amended
- High, CVSS 8.6
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
npm praisonai · Upgrade to 1.7.3 or later · < 1.7.3 · CVE-2026-61426 · GHSA-6wjp-v33h-5cvq · amended
- High, CVSS 7.1
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
PyPI praisonai-platform · Upgrade to 0.1.9 or later · <= 0.1.8 · CVE-2026-61442 · GHSA-c78w-2q4r-68r7 · amended
- High, CVSS 8.8
PraisonAI: Shell command allowlist bypass via find -exec built-in action
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61434 · GHSA-cv3g-hj65-pcfh · amended
- Critical, CVSS 9.9
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61445 · GHSA-9mp3-24cc-77mg · amended
- High, CVSS 7.3
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61427 · GHSA-hc5v-gxvj-58wh · amended
- Medium, CVSS 6.5
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
PyPI praisonai-platform · Upgrade to 0.1.9 or later · <= 0.1.8 · CVE-2026-61440 · GHSA-xxgv-vgvj-qvxh · amended
- High, CVSS 8.7
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60085 · GHSA-5r6c-gj4g-r697 · amended
- High, CVSS 7.2
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60091 · GHSA-4w49-gwv8-fpjg · amended
- Medium, CVSS 6.2
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
npm music-metadata · Upgrade to 11.16.0 or later · < 11.16.0 · CVE-2026-107391 · GHSA-f94x-6692-553q · amended
- Medium, CVSS 6.2
music-metadata: Uncontrolled memory allocation in APEv2 parser
npm music-metadata · Upgrade to 11.16.0 or later · <= 11.12.3 · CVE-2026-107387 · GHSA-53v6-4h7p-p4gj · amended
- Medium, CVSS 6.2
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
npm music-metadata · Upgrade to 11.16.0 or later · <= 11.12.3 · CVE-2026-107388 · GHSA-jjpr-9cvf-cq55 · amended
- Medium, CVSS 6.2
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
npm music-metadata · Upgrade to 11.16.0 or later · < 11.16.0 · CVE-2026-107389 · GHSA-5gfj-9q3v-qfp3 · amended
- High, CVSS 7.5
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
PyPI pydantic-ai +1 · Upgrade all 2 to 2.53.0 or later · >= 2.10.0, < 2.53.0 · CVE-2026-107286 · GHSA-6fqq-452j-qhrp · amended
- High, CVSS 7.4
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107385 · GHSA-r3rv-jm3r-62q2 · amended
- High, CVSS 8.1
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · >= 3.2.0, < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107384 · GHSA-v6pj-gxxw-phfw · amended
- High, CVSS 7.5
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107383 · GHSA-48qf-xh34-q73r · amended
- Medium, CVSS 5.9
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
npm mariadb · Upgrade to 3.5.4 or later · >= 3.3.0, < 3.5.4 · CVE-2026-107382 · GHSA-cx2f-j9fh-8g68 · amended
- High, CVSS 8.7
CairoSVG: Quadratic-time DoS parsing a crafted SVG
PyPI cairosvg · Upgrade to 2.9.1 or later · <= 2.9.0 · CVE-2026-107378 · GHSA-c3jg-qh8m-j3h2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.