High, CVSS 8.7
formie's unauthenticated front-end submission editing can overwrite existing submissions
Packagist verbb/formie · Upgrade to 3.1.26 or 2.2.21 by release line · >= 3.0.0, < 3.1.26; < 2.2.21 · CVE-2026-47266 · GHSA-pgxq-p76c-x9cg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
stigmem-node's federation peer registration lacked explicit out-of-band approval
PyPI stigmem-node · Upgrade to 0.9.0a2 (pre-release) or later · < 0.9.0a2 · CVE-2026-76242 · GHSA-9vp8-3hmv-8fgh · amended
- High, CVSS 7.3
stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment
PyPI stigmem-node · Upgrade to 0.9.0a2 (pre-release) or later · < 0.9.0a2 · CVE-2026-76241 · GHSA-w7pm-9g55-mxfm · amended
- Critical, CVSS 9.1
stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation
PyPI stigmem-node · Upgrade to 0.9.0a2 (pre-release) or later · < 0.9.0a2 · CVE-2026-76244 · GHSA-jmfc-hfjq-pxcp · amended
- High, CVSS 7.5
stigmem-node's Postgres schema identifier handling required defensive quoting
PyPI stigmem-node · Upgrade to 0.9.0a2 (pre-release) or later · < 0.9.0a2 · CVE-2026-76240 · GHSA-9pc9-4crj-mhpj · amended
- High, CVSS 7.1
stigmem-node's federation peer token timestamp validation may reject valid peer tokens
PyPI stigmem-node · Upgrade to 0.9.0a2 (pre-release) or later · < 0.9.0a2 · CVE-2026-76245 · GHSA-xh5j-xjfq-qvvx · amended
- Critical, CVSS 9.2
stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback
PyPI stigmem-node · Upgrade to 0.9.0a2 (pre-release) or later · < 0.9.0a2 · CVE-2026-76243 · GHSA-fp6w-8wpg-74g5 · amended
- High, CVSS 8.1
Admidio has IDOR in
documents-files.phpmode=move_savethat lets any folder-uploader exfiltrate files from private foldersPackagist admidio/admidio · Upgrade to 5.0.10 or later · <= 5.0.9 · CVE-2026-47231 · GHSA-x628-457g-2pw9
- High, CVSS 8.7
Spatie Laravel Media Library contains a file upload restriction bypass
Packagist spatie/laravel-medialibrary · Upgrade to 11.23.0 or later · < 11.23.0 · CVE-2026-48557 · GHSA-3ggm-c5m7-hfv5
- High, CVSS 8.6
ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env
PyPI ouroboros-ai · Upgrade to 0.39.0 or later · < 0.39.0 · CVE-2026-47211 · GHSA-c4m7-2gwp-vw76 · amended
- High, CVSS 7.1
CC-Tweaked has an SSRF Protection Bypass with NAT64
Maven cc.tweaked:cc-tweaked-1.20.5-core +7 · Upgrade all 8 to 1.119.0 or later · < 1.119.0 · CVE-2026-47695 · GHSA-5jh9-2h63-pw4q
- High, CVSS 7.7
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Packagist phanan/koel · Upgrade to 9.3.5 or later · <= 9.3.4 · CVE-2026-47260 · GHSA-7j2f-6h2r-6cqc
- High, CVSS 7.5
russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets
crates.io russh · Upgrade to 0.61.1 or later · >= 0.34.0, < 0.61.1 · CVE-2026-46702 · GHSA-wwx6-x28x-8259 · amended
- Critical, CVSS 9.3
amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection
PyPI redshift-connector · Upgrade to 2.1.14 or later · <= 2.1.13 · CVE-2026-8838 · GHSA-29h4-r29x-hchv · amended
- High, CVSS 8.7
xiaomusic contains an unauthenticated path traversal vulnerability
PyPI xiaomusic · Upgrade to 0.5.8 or later · < 0.5.8 · CVE-2026-10108 · GHSA-5j8p-5rrj-8wjg · amended
- High, CVSS 8.6
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47139 · GHSA-r9pm-gxmw-wv6p · amended
- Critical, CVSS 10.0
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47140 · GHSA-rp36-8xq3-r6c4 · amended
- High, CVSS 7.7
ExifReader is vulnerable to denial of service via crafted ICC
mluctagnpm exifreader · Upgrade to 4.39.0 or later · >= 2.10.0, < 4.39.0 · CVE-2026-8813 · GHSA-h64w-w9pr-82m4 · amended
- Critical, CVSS 9.8
vm2 sandbox escape via JSPI-backed Promise
.finally()species bypassnpm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47210 · GHSA-6j2x-vhqr-qr7q · amended
- Critical, CVSS 10.0
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47137 · GHSA-m4wx-m65x-ghrr · amended
- High, CVSS 8.6
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47209 · GHSA-c4cf-2hgv-2qv6 · amended
- High, CVSS 8.7
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47135 · GHSA-m5q2-4fm3-vfqp · amended
- Critical, CVSS 10.0
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47208 · GHSA-76w7-j9cq-rx2j · amended
- Critical, CVSS 10.0
vm2 has a Sandbox Escape issue
npm vm2 · Upgrade to 3.11.4 or later · <= 3.11.3 · CVE-2026-47131 · GHSA-v6mx-mf47-r5wg · amended
- High, CVSS 7.5
Gotenberg has a Race Condition via Multipart
downloadFromHandlingGo github.com/gotenberg/gotenberg/v8 · Upgrade to 8.33.0 or later · >= 8.10.0, <= 8.32.0 · CVE-2026-45742 · GHSA-vp73-vjw8-8f32
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.