High, CVSS 8.5
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
npm n8n-mcp · Upgrade to 2.47.14 or later · >= 2.47.4, < 2.47.14 · CVE-2026-42449 · GHSA-56c3-vfp2-5qqj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 10.0
Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.31.0 or later · <= 8.30.1 · CVE-2026-40281 · GHSA-q7r4-hc83-hf2q
- High, CVSS 8.4
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
PyPI notebook · Upgrade to 7.5.6 or later · >= 7.0.0, <= 7.5.5 · +3 more packages · CVE-2026-40171 · GHSA-rch3-82jr-f9w9 · amended
- High, CVSS 7.8
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.31.0 or later · <= 8.30.1 · CVE-2026-40280 · GHSA-5q7p-7jgv-ww56
- High, CVSS 8.3
CKAN has Unauthenticated SQL Injection and Authorization Bypass in
datastore_search_sqlPyPI ckan · Upgrade to 2.11.5 or 2.10.10 by release line · < 2.10.10; >= 2.11.0, <= 2.11.4 · CVE-2026-42031 · GHSA-h7j7-3rx6-xvcg · amended
- High, CVSS 8.2
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
npm i18next-http-middleware · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-42353 · GHSA-jfgf-83c5-2c4m · amended
- High, CVSS 8.6
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
PyPI pygeoapi · Upgrade to 0.23.3 or later · >= 0.23.0, < 0.23.3 · CVE-2026-42352 · GHSA-jgvc-94c8-3chc · amended
- High, CVSS 7.5
pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider
PyPI pygeoapi · Upgrade to 0.23.3 or later · >= 0.23.0, < 0.23.3 · CVE-2026-42351 · GHSA-f6pr-83pg-ghh6 · amended
- High, CVSS 8.7
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
npm marked · Upgrade to 18.0.2 or later · >= 18.0.0, <= 18.0.1 · CVE-2026-41680 · GHSA-6v9c-7cg6-27q7 · amended
- High, CVSS 8.2
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41670 · GHSA-p9w9-87c8-m235
- High, CVSS 8.2
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41669 · GHSA-25cw-98hg-g3cg
- High, CVSS 7.1
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41660 · GHSA-rh3w-4ccx-prf9
- Critical, CVSS 9.4
n8n has XML Node Prototype Pollution that to RCE
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4; < 1.123.32 · CVE-2026-42232 · GHSA-hqr4-h3xv-9m3r · amended
- Critical, CVSS 10.0
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4 · CVE-2026-42231 · GHSA-q5f4-99jv-pgg5 · amended
- High, CVSS 8.8
n8n Vulnerable to XSS via MCP OAuth client
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4 · CVE-2026-42235 · GHSA-537j-gqpc-p7fq · amended
- High, CVSS 7.1
n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
npm n8n · Upgrade to 2.17.5 or 1.123.33 by release line · >= 2.17.0, < 2.17.5; < 1.123.33 · CVE-2026-42226 · GHSA-r4v6-9fqc-w5jr · amended
- High, CVSS 7.1
n8n has a Python Task Runner Sandbox Escape Vulnerability
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4 · CVE-2026-42234 · GHSA-44v6-jhgm-p3m4 · amended
- High, CVSS 8.7
n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42236 · GHSA-49m9-pgww-9vq6 · amended
- High, CVSS 7.6
ipl/web is vulnerable to reflected XSS by malformed search requests
Packagist ipl/web · Upgrade to 0.13.1 or 0.10.3 by release line · >= 0.11.0, <= 0.13.0; <= 0.10.2 · CVE-2026-42224 · GHSA-55wf-5m3q-6jjf
- High, CVSS 7.2
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
Maven com.appsmith:interfaces · Upgrade to 1.99 or later · <= 1.98 · GHSA-h8cj-hpmg-636v
- High, CVSS 7.5
GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
Go github.com/osrg/gobgp/v4 · Upgrade to 4.3.0 or later · <= 4.2.0 · CVE-2026-41643 · GHSA-8rxh-r2p6-7f2q
- High, CVSS 7.5
GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
Go github.com/osrg/gobgp/v4 · Upgrade to 4.4.0 or later · >= 4.3.0, <= 4.3.0 · CVE-2026-41642 · GHSA-7235-89m6-f4px
- High, CVSS 8.6
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.7.0 or later · >= 0.26.0.0, <= 0.31.6.0 · CVE-2026-41587 · GHSA-fw49-9xq4-gmx6
- High, CVSS 7.5
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
Packagist phpoffice/phpspreadsheet · Upgrade to 5.7.0, 3.10.5, 2.4.5 or 2 more by release line · >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3 · CVE-2026-40902 · GHSA-7c6m-4442-2x6m
- High, CVSS 7.5
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Packagist phpoffice/phpspreadsheet · Upgrade to 5.7.0, 3.10.5, 2.4.5 or 2 more by release line · >= 4.0.0, < 5.7.0; >= 3.3.0, < 3.10.5; >= 2.2.0, < 2.4.5; >= 2.0.0, < 2.1.16; < 1.30.6 · CVE-2026-40863 · GHSA-84wq-86v6-x5j6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.