Medium, CVSS 6.3
Axios: Excessive recursion in formDataToJSON can cause denial of service
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.28.0, < 0.33.0; >= 1.0.0, < 1.18.0 · CVE-2026-67313 · GHSA-42h9-826w-cgv3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 946 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3726–3750 of 30,922 matching · newest first
- Medium, CVSS 6.3
Axios: Prototype pollution auth subfields can inject Basic auth
npm axios · Upgrade to 1.18.0 or later · >= 1.15.2, < 1.18.0 · CVE-2026-67314 · GHSA-xj6q-8x83-jv6g · amended
- Medium, CVSS 6.3
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.28.0, < 0.33.0; >= 1.0.0, < 1.18.0 · CVE-2026-67312 · GHSA-pmv8-rq9r-6j72 · amended
- High, CVSS 7.8
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-12484 · GHSA-v2w2-w228-c444 · amended
- High, CVSS 8.7
SurrealDB: Full Table Permissions by Default
crates.io surrealdb +1 · Upgrade all 2 to 1.0.1 or later · < 1.0.1 · CVE-2023-54366 · GHSA-x5fr-7hhj-34j3 · amended
- High, CVSS 8.2
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
Go github.com/zalando/skipper · Upgrade to 0.27.26 or later · < 0.27.26 · CVE-2026-65838 · GHSA-8qqm-fp2q-v734
- Medium, CVSS 5.7
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication
Go github.com/zalando/skipper · Upgrade to 0.27.13 or later · < 0.27.13 · CVE-2026-54246 · GHSA-5587-2x54-jj6h
- High, CVSS 7.6
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard
npm @tak-ps/cloudtak · Upgrade to 13.10.0 or later · < 13.10.0 · CVE-2026-55177 · GHSA-r95q-fp26-h3hc · amended
- Medium, CVSS 6.9
PocketSphinx: Buffer overflows in language and acoustic model loading code
PyPI pocketsphinx · Upgrade to 5.1.1 or later · < 5.1.1 · CVE-2026-54559 · GHSA-56r5-2p2f-7cxp · amended
- Medium, CVSS 6.9
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
NuGet anglesharp · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-54570 · GHSA-pgww-w46g-26qg
- Medium, CVSS 6.6
PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs
PyPI proot-distro · Upgrade to 5.1.0 or later · < 5.1.0 · GHSA-mfr4-mq8w-vmg6 · amended
- Medium, CVSS 5.3
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
npm exifreader · Upgrade to 4.40.1 or later · <= 4.40.0 · CVE-2026-53496 · GHSA-g77h-45rf-hcx4 · amended
- High, CVSS 7.5
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
PyPI flask-reuploaded · Upgrade to 1.6.0 or later · <= 1.5.0 · CVE-2026-54567 · GHSA-937x-gpqr-72gg · amended
- High, CVSS 8.7
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
npm @prompty/core · Upgrade to 2.0.0-beta.3 (pre-release) or later · >= 2.0.0-alpha.1, < 2.0.0-beta.3 · CVE-2026-53597 · GHSA-c4gh-rv8h-q9vw · amended
- High, CVSS 7.5
Prompty: Arbitrary file read via file reference expansion
PyPI prompty · Upgrade to 2.0.0b2 (pre-release) or later · <= 2.0.0b1 · +3 more packages · CVE-2026-53598 · GHSA-wxhm-2mq7-7697 · amended
- Medium, CVSS 6.2
mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath
npm mcp-memory-keeper · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2026-54561 · GHSA-f7wf-v2vw-mpcx · amended
- Medium, CVSS 6.3
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Packagist verbb/formie · Upgrade to 3.1.28 or later · < 3.1.28 · GHSA-cvpc-hccg-wmw4
- High, CVSS 8.2
Gitea has insufficient permission checks for Composer package source links
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · <= 1.26.1 · CVE-2026-27771 · GHSA-8qw8-rq86-9pc2
- Medium, CVSS 5.0
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
npm @tak-ps/cloudtak · Upgrade to 13.22.1 or later · < 13.22.1 · CVE-2026-54546 · GHSA-vqrw-qphh-p34v · amended
- Unrated
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code
Go github.com/oapi-codegen/oapi-codegen/v2 · Upgrade to 2.7.1 or later · < 2.7.1 · GHSA-rjwr-m7qx-3fjr · amended
- High, CVSS 7.4
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
PyPI meta-ads-mcp · Upgrade to 1.0.115 or later · < 1.0.115 · CVE-2026-54547 · GHSA-2v2f-mvfg-ph56 · amended
- High, CVSS 8.3
meta-ads-mcp: Server-Side Request Forgery (SSRF) in
upload_ad_imagevia Unrestrictedimage_urlFetchPyPI meta-ads-mcp · Upgrade to 1.0.115 or later · < 1.0.115 · CVE-2026-54549 · GHSA-45gf-fjxp-cjpq · amended
- High, CVSS 7.9
sh _uid does not drop supplementary groups (incomplete privilege drop)
PyPI sh · Upgrade to 2.2.4 or later · < 2.2.4 · CVE-2026-54552 · GHSA-q38v-wp89-2w55 · amended
- High, CVSS 8.6
AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Maven software.amazon.jdbc:aws-advanced-jdbc-wrapper · Upgrade to 4.0.1 or later · >= 3.0.0, < 4.0.1 · CVE-2026-11400 · GHSA-mhww-p97m-3368
- Medium, CVSS 4.3
plone.restapi: Stored XSS by spoofing mime type
PyPI plone-restapi · Upgrade to 10.0.1 or 9.15.6 by release line · < 9.15.6; >= 10.0.0, <= 10.0.0 · GHSA-8rqh-vxpr-x77p · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.