Critical, CVSS 9.3
Strapi Vulnerable to SQL Injection in Content Type Builder
npm @strapi/content-type-builder · Upgrade to 5.33.2 or later · >= 5.0.0, < 5.33.2 · +1 more package · CVE-2026-22599 · GHSA-3xcq-8mjw-h6mx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.2
SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260512140701-d7b77d945e0d (pre-release) or later · < 0.0.0-20260512140701-d7b77d945e0d · CVE-2026-45371 · GHSA-gmmv-4cc5-wr9r
- High, CVSS 8.7
Anchor:
InterfaceAccountallows account substitution between unexpected typescrates.io anchor-lang · Upgrade to 1.0.0-rc.2 (pre-release) or later · >= 1.0.0-rc.1, <= 1.0.0-rc.1 · GHSA-429q-fhh4-r6hj
- High, CVSS 7.8
uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution
Go gitlab.com/uniget-org/cli · Upgrade to 0.27.1 or later · < 0.27.1 · CVE-2026-45152 · GHSA-qqq4-5773-pmw5
- Critical, CVSS 9.6
Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server
Go github.com/obot-platform/obot · Upgrade to 0.21.1 or later · <= 0.21.0 · GHSA-vw82-7fv8-r6gp
- High, CVSS 8.2
Anchor: Program is not properly validated
crates.io anchor-lang · Upgrade to 1.0.2 or later · >= 1.0.0, < 1.0.2 · CVE-2026-45137 · GHSA-c6rc-8jpp-2fgc
- High, CVSS 8.6
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
npm claude-code-cache-fix · Upgrade to 3.5.2 or later · >= 3.5.0, < 3.5.2 · CVE-2026-45136 · GHSA-g3xq-3gmv-qq8g · amended
- High, CVSS 7.1
Nautobot: GitRepository.current_head field should not be writable through REST API
PyPI nautobot · Upgrade to 3.1.2 or 2.4.33 by release line · >= 3.0.0a2, < 3.1.2; < 2.4.33 · CVE-2026-44798 · GHSA-p3hx-pwf3-j8wr · amended
- High, CVSS 8.5
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
PyPI nautobot · Upgrade to 3.1.2 or 2.4.33 by release line · >= 3.0.0a2, < 3.1.2; < 2.4.33 · CVE-2026-44797 · GHSA-c35q-vxrp-ph26 · amended
- High, CVSS 7.7
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Packagist getgrav/grav · Upgrade to 2.0.0-rc.2 (pre-release) or later · <= 2.0.0-rc.1 · CVE-2026-44738 · GHSA-j274-39qw-32c9
- High, CVSS 7.1
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
npm langsmith · Upgrade to 0.6.0 or later · < 0.6.0 · +3 more packages · CVE-2026-45134 · GHSA-3644-q5cj-c5c7 · amended
- High, CVSS 7.8
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
npm systeminformation · Upgrade to 5.31.6 or later · >= 4.17.0, <= 5.31.5 · CVE-2026-44724 · GHSA-hvx9-hwr7-wjj9 · amended
- Critical, CVSS 9.3
Mapfish Print: Remote Code Injection (RCE) in Dynamic table
Maven org.mapfish.print:print-lib +1 · Upgrade all 2 to 4.0.3, 3.33.14, 3.31.21 or 2 more by release line · >= 3.23.0, < 3.28.28; >= 3.29.0, < 3.30.30; >= 3.31.0, < 3.31.21; >= 3.32.0, < 3.33.14; >= 3.34.0, < 4.0.3 · CVE-2026-44672 · GHSA-q7m6-wpvf-mvwx
- High, CVSS 8.7
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
PyPI ujson · Upgrade to 5.12.1 or later · <= 5.12.0 · CVE-2026-44660 · GHSA-c38f-wx89-p2xg · amended
- Critical, CVSS 9.1
SillyTavern has a Path Traversal issue
npm sillytavern · Upgrade to 1.18.0 or later · <= 1.17.0 · CVE-2026-44650 · GHSA-886q-f44j-h6wh · amended
- Critical, CVSS 9.8
SillyTavern has Authentication Bypass via SSO Header Injection
npm sillytavern · Upgrade to 1.18.0 or later · <= 1.17.0 · CVE-2026-44649 · GHSA-gxx6-h3g6-vwjh · amended
- High, CVSS 7.5
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
npm sillytavern · Upgrade to 1.18.0 or later · <= 1.17.0 · CVE-2026-44648 · GHSA-wmm3-h9qj-p5v6 · amended
- High, CVSS 7.5
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
Go github.com/esm-dev/esm.sh · Upgrade to 0.0.0-20250616164159-0593516c4cfa (pre-release) or later · < 0.0.0-20250616164159-0593516c4cfa · CVE-2026-44594 · GHSA-rg65-45m7-hq57
- High, CVSS 8.7
esm.sh: Legacy Route Path Traversal Can Lead to RCE
Go github.com/esm-dev/esm.sh · Upgrade to 0.0.0-20260508100112-1960055e1d53 (pre-release) or later · < 0.0.0-20260508100112-1960055e1d53 · CVE-2026-44593 · GHSA-3636-h3vx-6465
- High, CVSS 8.8
HashiCorp Nomad vulnerable to a path traversal
Go github.com/hashicorp/nomad · Upgrade to 1.11.0-rc.1.0.20260511152149-cd7240c4099a (pre-release) or later · < 1.11.0-rc.1.0.20260511152149-cd7240c4099a · CVE-2026-7474 · GHSA-hx53-77qj-8663
- Critical, CVSS 9.1
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
Maven com.azure:azure-security-keyvault-keys · Upgrade to 4.10.6 or later · < 4.10.6 · CVE-2026-33117 · GHSA-97jf-46m3-8953
- High, CVSS 7.5
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-41284 · GHSA-gx5v-xp9w-j4cg
- High, CVSS 7.3
Apache Tomcat - WebSocket authentication header exposure
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-42498 · GHSA-fv25-8xcx-gqjc
- Critical, CVSS 9.8
Apache Tomcat - HTTP/2 request headers not validated
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118 · CVE-2026-41293 · GHSA-r29c-68gh-xp6x
- Critical, CVSS 9.8
Apache Tomcat - Digest authenticator will authenticate any unknown user
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.22, 10.1.55 or 9.0.118 by release line · < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22 · CVE-2026-43512 · GHSA-h6fc-48rj-7qqh
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.