High, CVSS 7.5
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
npm protobufjs · Upgrade to 8.4.1 or 7.6.1 by release line · <= 7.6.0; >= 8.0.0, <= 8.4.0 · CVE-2026-48712 · GHSA-wcpc-wj8m-hjx6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
npm form-data · Upgrade to 4.0.6, 3.0.5 or 2.5.6 by release line · < 2.5.6; >= 3.0.0, < 3.0.5; >= 4.0.0, < 4.0.6 · CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx · amended
- High, CVSS 8.3
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
npm @angular/service-worker · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54264 · GHSA-qxh6-94w6-9r5p · amended
- High, CVSS 8.2
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
npm @angular/common · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54268 · GHSA-48r7-hpm6-gfxm · amended
- High, CVSS 8.8
@angular/common: Weak 32-Bit Cache Key Hashing in
HttpTransferCacheLeading to Cross-Request Data Leakage and State Poisoningnpm @angular/common · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54266 · GHSA-39pv-4j6c-2g6v · amended
- High, CVSS 8.6
@angular/platform-server: Missing
npm @angular/platform-server · Upgrade to 22.0.0-rc.2 (pre-release), 21.2.16, 20.3.24 or 19.2.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.16; >= 20.0.0-next.0, < 20.3.24; >= 19.0.0-next.0, < 19.2.25; <= 18.2.14 · CVE-2026-50556 · GHSA-gxx4-3xcv-f8qx · amended
- High, CVSS 8.6
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
npm @angular/platform-server · Upgrade to 22.0.0-rc.2 (pre-release), 21.2.16, 20.3.24 or 19.2.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.16; >= 20.0.0-next.0, < 20.3.24; >= 19.0.0-next.0, < 19.2.25; <= 18.2.14 · CVE-2026-50555 · GHSA-hqr9-c56f-3x7f · amended
- High, CVSS 8.2
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
npm @angular/common · Upgrade to 22.0.0-rc.2 (pre-release), 21.2.15, 20.3.22 or 19.2.23 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-rc.2; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14; >= 21.0.0-next.0, < 21.2.15 · CVE-2026-50171 · GHSA-p3vc-36g9-x9gr · amended
- High, CVSS 8.2
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
npm @angular/common · Upgrade to 22.0.0-rc.2 (pre-release), 21.2.15, 20.3.22 or 19.2.23 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-rc.2; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14; >= 21.0.0-next.0, < 21.2.15 · CVE-2026-50170 · GHSA-q6f4-qqrg-jv6x · amended
- High, CVSS 8.8
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
npm @angular/platform-server · Upgrade to 22.0.0-rc.2 (pre-release), 21.2.15, 20.3.22 or 19.2.23 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-rc.2; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14; >= 21.0.0-next.0, < 21.2.15 · CVE-2026-50168 · GHSA-xrxm-cp7j-8xf6 · amended
- High, CVSS 8.2
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
npm tmp · Upgrade to 0.2.7 or later · >= 0.2.6, < 0.2.7 · CVE-2026-49982 · GHSA-7c78-jf6q-g5cm · amended
- High, CVSS 7.5
ws: Memory exhaustion DoS from tiny fragments and data chunks
npm ws · Upgrade to 8.21.0, 7.5.11, 6.2.4 or 5.2.5 by release line · >= 1.1.0, < 5.2.5; >= 6.0.0, < 6.2.4; >= 7.0.0, < 7.5.11; >= 8.0.0, < 8.21.0 · CVE-2026-48779 · GHSA-96hv-2xvq-fx4p · amended
- High, CVSS 8.6
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
npm @angular/core · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54267 · GHSA-rgjc-h3x7-9mwg · amended
- High, CVSS 8.7
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.33.8 or later · < 2.33.8 · CVE-2026-54090 · GHSA-8c9q-7855-wfxq
- High, CVSS 7.5
File Browser has incorrect access control for public directory shares via rule path rebasing
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.6 or later · <= 2.63.5 · CVE-2026-54091 · GHSA-j9jx-hp4c-ghhh
- High, CVSS 7.7
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Go github.com/radius-project/radius · Upgrade to 0.58.0 or later · < 0.58.0 · CVE-2026-53999 · GHSA-fp5j-4fj2-4jvq
- High, CVSS 7.6
TYPO3 CMS has Broken Access Control in its Form Framework
Packagist typo3/cms-core +1 · Upgrade all 2 to 14.3.3, 13.4.31, 12.4.46 or 2 more by release line · < 10.4.57; >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-11607 · GHSA-pjpj-v387-x4vq
- High, CVSS 7.2
TYPO3 CMS: Destructive Actions on File Mount Folders
Packagist typo3/cms-core · Upgrade to 14.3.3, 13.4.31, 12.4.46 or 2 more by release line · < 10.4.57; >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-47343 · GHSA-3v8v-4wg6-r7qh
- High, CVSS 8.7
PyO3 has an Out-of-bounds Read in
nth/nth_backforPyListandPyTupleiteratorscrates.io pyo3 · Upgrade to 0.29.0 or later · < 0.29.0 · GHSA-36hh-v3qg-5jq4
- High, CVSS 8.7
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
Packagist typo3/cms-core +1 · Upgrade all 2 to 14.3.3 or later · >= 14.0.0, < 14.3.3 · CVE-2026-49741 · GHSA-jh32-v29g-68pq
- High, CVSS 7.6
TYPO3 CMS has Broken Access Control in its Form Framework
Packagist typo3/cms-core +1 · Upgrade all 2 to 14.3.3, 13.4.31, 12.4.46 or 2 more by release line · < 10.4.57; >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-47346 · GHSA-hwvq-2w67-rvxp
- High, CVSS 7.1
TYPO3 CMS has Broken Access Control in its Media Module
Packagist typo3/cms-filelist +1 · Upgrade all 2 to 14.3.3, 13.4.31, 12.4.46 or 11.5.51 by release line · >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3 · CVE-2026-49742 · GHSA-chm7-4vch-h8vr
- High, CVSS 8.1
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
Maven com.appsmith:server · Upgrade to 2.0 or later · < 2.0 · GHSA-j9gf-vw2f-9hrw
- High, CVSS 8.1
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48152 · GHSA-3gp5-q4jw-3v94 · amended
- High, CVSS 7.5
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48151 · GHSA-qhv3-wjg8-6fx6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.