High, CVSS 8.7
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
npm ep_etherpad-lite · Upgrade to 3.3.0 or later · <= 1.8.14 · CVE-2026-55090 · GHSA-2jp7-wwpg-3p9w · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2801–2825 of 30,921 matching · newest first
- Unrated
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
npm ep_etherpad-lite · Upgrade to 3.3.0 or later · <= 1.8.14 · GHSA-92hr-gmr6-h8cp
- Medium, CVSS 6.9
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability
Go gitlab.com/uniget-org/cli · Upgrade to 0.27.6 or later · < 0.27.6 · CVE-2026-55062 · GHSA-m6jg-wr9m-cg2f · amended
- Medium, CVSS 6.9
uniget CLI has an EDITOR Command Injection
Go gitlab.com/uniget-org/cli · Upgrade to 0.27.6 or later · < 0.27.6 · CVE-2026-55061 · GHSA-qmcq-xw74-w667 · amended
- High, CVSS 7.5
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · GHSA-v836-6xw4-9cx3
- Critical, CVSS 10.0
vm2: NodeVM
builtin: ['*']exposesosanddns— process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)npm vm2 · Upgrade to 3.11.6 or later · < 3.11.6 · CVE-2026-92960 · GHSA-m5w8-4gq2-6f8x · amended
- Critical, CVSS 9.8
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47698 · GHSA-cfcw-xp6x-25gj · amended
- Critical, CVSS 9.9
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47686 · GHSA-m283-3h24-438v · amended
- High, CVSS 8.7
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47683 · GHSA-gmc2-2x9w-cgh9
- High, CVSS 8.7
sqlparse: Quadratic O(n²) DoS in group_comments
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-71491 · GHSA-f2ff-p2ww-7p4p
- Medium, CVSS 5.3
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
PyPI glances · Upgrade to 4.5.6 or later · < 4.5.6 · CVE-2026-68520 · GHSA-4h34-v6r8-mmjc
- High, CVSS 7.1
Glances:
--disable-config-execdoes not cover on-alert action commands (incomplete fix of CVE-2026-53925)PyPI glances · Upgrade to 4.5.6 or later · <= 4.5.5 · CVE-2026-68519 · GHSA-59fj-m2j6-hcxh
- High, CVSS 8.8
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
PyPI glances · Upgrade to 4.5.6 or later · >= 4.5.2, < 4.5.6 · CVE-2026-62982 · GHSA-73wf-9vmv-5pv9
- Medium, CVSS 6.2
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-59894 · GHSA-3496-9g83-7v6x
- Medium, CVSS 6.5
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
PyPI glances · Upgrade to 4.5.6 or later · < 4.5.6 · CVE-2026-68517 · GHSA-fp27-88fp-2phg
- Medium, CVSS 6.9
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Go github.com/gruntwork-io/terragrunt · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2026-45099 · GHSA-8394-6f8r-whxg · amended
- High, CVSS 8.8
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
PyPI glances · Upgrade to 4.5.6 or later · <= 4.5.5 · CVE-2026-68518 · GHSA-qcpp-8x79-hhp3
- Medium, CVSS 6.0
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.16 (pre-release) or later · <= 1.0.0-rc.15 · CVE-2026-64865 · GHSA-j6gc-4893-qwmp · amended
- Critical, CVSS 9.1
New API: Integer overflow in quota billing yields negative charges (self-crediting)
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.18 (pre-release) or later · <= 1.0.0-rc.17 · CVE-2026-71479 · GHSA-8r8v-xf7q-rcpr · amended
- High, CVSS 7.5
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.11 (pre-release) or later · < 1.0.0-rc.11 · CVE-2026-64868 · GHSA-v828-m3pf-vq9q · amended
- Critical, CVSS 9.1
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.7 (pre-release) or later · < 1.0.0-rc.7 · CVE-2026-64859 · GHSA-6x2c-phff-wx57 · amended
- High, CVSS 7.1
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
npm @medplum/core · Upgrade to 5.1.6 or later · <= 5.1.5 · CVE-2026-53728 · GHSA-m44r-7c5h-m6mj
- Critical, CVSS 9.1
conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target
GitHub Actions wktk/conflibot · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-55158 · GHSA-2qvg-qr73-mqxp · amended
- High, CVSS 8.2
DeepmergeTS has stack exhaustion when merging recursive object graphs
npm deepmerge-ts · Upgrade to 8.0.0 or later · < 8.0.0 · CVE-2026-40345 · GHSA-ggr8-5vv4-36mx
- Unrated
h2 unbounded empty DATA frames
crates.io h2 · Upgrade to 0.4.16 or later · >= 0.0.0-0, < 0.4.16 · GHSA-q83h-524g-xf6h
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.