Low, CVSS 2.4
OctoPrint: Stored XSS via saved connection parameters
PyPI octoprint · Upgrade to 2.0.0rc7 (pre-release) or later · >= 2.0.0rc1, < 2.0.0rc7 · CVE-2026-123364 · GHSA-p623-mxf7-qxjm · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–67 of 67 matching · newest first
- Medium, CVSS 6.1
Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
npm altair-static +3 · Upgrade all 4 to 8.5.8 or later · >= 7.2.4, < 8.5.8 · CVE-2026-110802 · GHSA-752m-7p75-49gf · amended
- Critical, CVSS 9.3
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
npm bitcoinjs-lib · Upgrade to 7.0.2, 6.1.8 or 5.2.1 by release line · >= 2.3.0, < 5.2.1; >= 6.0.0, < 6.1.8; >= 7.0.0-rc.0, < 7.0.2 · CVE-2026-107846 · GHSA-8vv3-6qpc-gpw6 · amended
- Low, CVSS 2.3
compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated
.envPyPI compose-lint +1 · Upgrade all 2 to 0.33.0 or later · >= 0.32.0, < 0.33.0 · CVE-2026-123796 · GHSA-rm8w-w798-g545 · amended
- High, CVSS 8.8
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
PyPI gpustack · Upgrade to 2.2.2 or later · >= 2.2.0, < 2.2.2 · CVE-2026-103002 · GHSA-3hch-x692-6qj3 · amended
- Critical, CVSS 9.1
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
PyPI gpustack · Upgrade to 2.2.2 or later · >= 0.7.1, < 2.2.2 · CVE-2026-102894 · GHSA-62m9-f875-rqw6 · amended
- High, CVSS 7.5
Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
npm @nuxt/content · Upgrade to 3.15.2 or later · >= 3.0.0, < 3.15.2 · CVE-2026-102650 · GHSA-xxrh-5hgg-gj4h · amended
- Low, CVSS 2.3
compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
PyPI compose-lint +1 · Upgrade all 2 to 0.25.0 or later · >= 0.2.0, < 0.25.0 · CVE-2026-123373 · GHSA-whr6-fgpq-fpv9 · amended
- Low, CVSS 2.3
compose-lint: A
.compose-lint.ymlsymlinked outside the project is read, and a parse error quotes part of the targetPyPI compose-lint +1 · Upgrade all 2 to 0.32.0 or later · >= 0.2.0, < 0.32.0 · CVE-2026-123371 · GHSA-88f4-frh5-gmcr · amended
- Low, CVSS 2.3
compose-lint: A pull request can make compose-lint quote a secret from a CI-generated
.envinto its findingsPyPI compose-lint +1 · Upgrade all 2 to 0.32.0 or later · >= 0.22.0, < 0.32.0 · CVE-2026-123372 · GHSA-jf3h-8jvx-vcrg · amended
- Medium, CVSS 5.1
compose-lint:
fix --applycan delete a line the user did not select, including a security settingPyPI compose-lint · Upgrade to 0.18.0 or later · >= 0.9.0, < 0.18.0 · CVE-2026-123370 · GHSA-65v8-q222-64xx · amended
- Medium, CVSS 5.3
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
PyPI compose-lint +1 · Upgrade all 2 to 0.31.0 or later · < 0.31.0 · CVE-2026-123369 · GHSA-6f4g-xm8v-pgv6 · amended
- Low, CVSS 2.3
compose-lint: .env read through a symlink outside the project can expose the CI job's environment
PyPI compose-lint +1 · Upgrade all 2 to 0.31.0 or later · >= 0.22.0, < 0.31.0 · CVE-2026-123368 · GHSA-6wcv-rj3c-mhv3 · amended
- High, CVSS 7.2
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
Go github.com/ultravioletrs/cocos · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-119345 · GHSA-ghwv-vrp2-2975 · amended
- Critical, CVSS 9.1
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
npm node-opcua +2 · Upgrade all 3 to 2.180.0 or later · >= 2.42.0, < 2.180.0 · CVE-2026-95860 · GHSA-xggf-m53x-jc3f · amended
- Medium, CVSS 6.5
Dagu MCP DAG specification read bypasses path containment and workspace isolation
Go github.com/dagu-org/dagu/v2 · Upgrade to 2.11.0 or later · < 2.11.0 · CVE-2026-102943 · GHSA-5m6c-38r8-5w76 · amended
- Medium, CVSS 5.9
gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments
Go github.com/gopacket/gopacket · Upgrade to 1.7.2 or later · < 1.7.2 · CVE-2026-119299 · GHSA-358w-w75h-x6rx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.