High, CVSS 7.7
Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41273 · GHSA-6f7g-v4pp-r667 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41271 · GHSA-6r77-hqx7-7vw8 · amended
- High, CVSS 7.1
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41272 · GHSA-2x8m-83vc-6wv4 · amended
- High, CVSS 7.1
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41270 · GHSA-xhmj-rg95-44hv · amended
- High, CVSS 7.1
Flowise: File Upload Validation Bypass in createAttachment
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41269 · GHSA-rh7v-6w34-w2rr · amended
- High, CVSS 7.7
Flowise: Parameter Override Bypass Remote Command Execution
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41268 · GHSA-cvrr-qhgw-2mm6 · amended
- High, CVSS 7.7
Flowise: Sensitive Data Leak in public-chatbotConfig
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41266 · GHSA-4jpm-cgx2-8h37 · amended
- High, CVSS 8.1
Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41267 · GHSA-48m6-ch88-55mj · amended
- Critical, CVSS 9.4
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41137 · GHSA-9wc7-mj3f-74xv · amended
- High, CVSS 8.3
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using
Pandas.npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41138 · GHSA-f228-chmx-v6j6 · amended
- High, CVSS 7.5
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
npm basic-ftp · Upgrade to 5.3.0 or later · <= 5.2.2 · CVE-2026-41324 · GHSA-rp42-5vxx-qpwr · amended
- High, CVSS 7.7
Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)
Go github.com/kyverno/kyverno · Upgrade to 1.17.0 or later · < 1.17.0 · GHSA-8wfp-579w-6r25
- High, CVSS 8.1
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
Go github.com/kyverno/kyverno · Upgrade to 1.17.0 or later · < 1.17.0 · CVE-2026-41323 · GHSA-f9g8-6ppc-pqq4
- High, CVSS 8.8
Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar
Packagist joedolson/my-calendar · Upgrade to 3.7.7 or later · < 3.7.7 · CVE-2026-40308 · GHSA-2mvx-f5qm-v2ch
- Critical, CVSS 9.1
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
npm @clerk/nuxt · Upgrade to 2.2.2 or 1.13.28 by release line · >= 1.1.0, < 1.13.28; >= 2.0.0, < 2.2.2 · +3 more packages · CVE-2026-41248 · GHSA-vqx2-fgx2-5wq9 · amended
- High, CVSS 8.1
Statamic: Unsafe method invocation via query value resolution allows data destruction
Packagist statamic/cms · Upgrade to 6.13.0 or 5.73.20 by release line · < 5.73.20; >= 6.0.0-alpha.1, < 6.13.0 · CVE-2026-41175 · GHSA-4jjr-vmv7-wh4w
- Critical, CVSS 9.8
electerm: electerm_install_script_CommandInjection Vulnerability Report
npm electerm · Upgrade to 3.3.8 or later · < 3.3.8 · CVE-2026-41500 · GHSA-wxw2-rwmh-vr8f · amended
- Critical, CVSS 9.9
Flowise: Authenticated RCE Via MCP Adapters
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-40933 · GHSA-c9gw-hvqq-f33r · amended
- High, CVSS 7.7
Mako: Path traversal via double-slash URI prefix in TemplateLookup
PyPI mako · Upgrade to 1.3.11 or later · <= 1.3.10 · CVE-2026-41205 · GHSA-v92g-xgxw-vvmm · amended
- High, CVSS 7.5
PsiTransfer: Upload PATCH path traversal can create
config. .jsand lead to code execution on restartnpm psitransfer · Upgrade to 2.4.3 or later · < 2.4.3 · CVE-2026-41180 · GHSA-533q-w4g6-5586 · amended
- Critical, CVSS 9.1
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
NuGet hotchocolate.language · Upgrade to 15.1.14, 14.3.1, 13.9.16 or 12.22.7 by release line · < 12.22.7; >= 13.0.0, < 13.9.16; >= 14.0.0, < 14.3.1; >= 15.0.0, < 15.1.14 · CVE-2026-40324 · GHSA-qr3m-xw4c-jqw3
- High, CVSS 8.7
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
npm mcp-framework · Upgrade to 0.2.22 or later · <= 0.2.21 · CVE-2026-39313 · GHSA-353c-v8x9-v7c3 · amended
- High, CVSS 8.7
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
npm apostrophe · Upgrade to 4.29.0 or later · <= 4.28.0 · CVE-2026-35569 · GHSA-855c-r2vq-c292 · amended
- High, CVSS 8.7
SpdyStream: DOS on CRI
Go github.com/moby/spdystream · Upgrade to 0.5.1 or later · <= 0.5.0 · CVE-2026-35469 · GHSA-pc3f-x583-g7j2
- High, CVSS 8.8
Weblate: Privilege escalation in the user API endpoint
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-34393 · GHSA-3382-gw9x-477v · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.