High, CVSS 8.8
Cornac: Path Traversal via _extract_archive() in download.py
PyPI cornac · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2026-43637 · GHSA-rrh3-cwwj-g5mg · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 948 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3826–3850 of 30,924 matching · newest first
- Critical, CVSS 9.9
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
Packagist facturascripts/facturascripts · Upgrade to 2026.3 or later · >= 2025, < 2026.3 · CVE-2026-77526 · GHSA-hgjx-r89m-m7v4 · amended
- High, CVSS 8.1
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
PyPI netlicensing-mcp · Upgrade to 0.1.6 or later · <= 0.1.5 · CVE-2026-54446 · GHSA-x9vc-9ffq-p3gj · amended
- High, CVSS 7.7
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via
allow_privateGo github.com/forgekeep/nebula-mesh · Upgrade to 0.7.2 or later · >= 0.6.0, <= 0.7.1 · GHSA-7rx3-5wx3-5v76
- High, CVSS 8.1
nebula-mesh: Certificate revocation is never enforced at the mesh
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.7.1 or later · < 0.7.1 · CVE-2026-61699 · GHSA-cm26-5974-52h8
- Medium, CVSS 4.2
n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode
npm n8n-mcp · Upgrade to 2.57.4 or later · <= 2.57.3 · CVE-2026-55608 · GHSA-2cf7-hpwf-47h9 · amended
- Medium, CVSS 5.4
nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.5.0 or later · >= 0.3.0, < 0.5.0 · CVE-2026-55513 · GHSA-g4x6-jcvr-9m3g
- Medium, CVSS 5.3
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.5.0 or later · >= 0.2.0, < 0.5.0 · CVE-2026-55512 · GHSA-m3cx-mwpg-32jg
- High, CVSS 7.1
nebula-mesh: Operator session tokens stored in plaintext in the database
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.3.8 or later · <= 0.3.7 · CVE-2026-53603 · GHSA-q4vm-pq3q-8wgq
- High, CVSS 7.5
Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
Maven io.netty:netty-codec-stomp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Alpha1, <= 4.2.15.Final; <= 4.1.135.Final · CVE-2026-44891 · GHSA-vhch-2wf3-m8rp
- High, CVSS 8.7
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.3.8 or later · <= 0.3.7 · CVE-2026-53604 · GHSA-2p2f-px33-4vv5
- Medium, CVSS 4.9
Umbraco.AI discloses sensitive application configuration values
NuGet umbraco.ai · Upgrade to 1.14.0 or later · <= 1.13.0 · GHSA-q3v2-xj35-9grx
- High, CVSS 7.6
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
Packagist easycorp/easyadmin-bundle · Upgrade to 5.0.13 or later · >= 5.0.0, < 5.0.13 · CVE-2026-54087 · GHSA-8559-gwj3-q37r
- Low, CVSS 3.7
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
npm @feathersjs/commons · Upgrade to 5.0.45 or later · <= 5.0.44 · CVE-2026-54335 · GHSA-28xv-ph75-77wh · amended
- High, CVSS 7.7
yutu: Arbitrary File Write via MCP
caption-downloadToolGo github.com/eat-pray-ai/yutu · Upgrade to 0.10.9-dev1 (pre-release) or later · < 0.10.9-dev1 · CVE-2026-50158 · GHSA-2c7f-fxww-6w6c
- Medium, CVSS 6.5
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
Packagist auth0/symfony · Upgrade to 5.9.0 or later · >= 5.0.0-BETA0, <= 5.8.0 · CVE-2026-50157 · GHSA-ffq7-hh2j-r24p
- Critical, CVSS 9.9
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
npm n8n-mcp · Upgrade to 2.56.1 or later · <= 2.56.0 · CVE-2026-54052 · GHSA-j6r7-6fhx-77wx · amended
- High, CVSS 7.1
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
Go go.woodpecker-ci.org/woodpecker/v3 · Upgrade to 3.14.1 or later · >= 3.0.0, < 3.14.1 · CVE-2026-50141 · GHSA-g7mm-9vx7-jm7h
- High, CVSS 8.6
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
npm @fedify/fedify · Upgrade to 2.2.4, 2.1.15, 2.0.19 or 2 more by release line · >= 0.11.2, < 1.9.12; >= 1.10.0, < 1.10.11; >= 2.0.0, < 2.0.19; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.4 · +1 more package · CVE-2026-50131 · GHSA-xw9q-2mv6-9fr8 · amended
- High, CVSS 7.5
MKP: Unbounded Pod Log Read via Attacker-Controlled
limitBytes/tailLinesCauses Memory ExhaustionGo github.com/StacklokLabs/mkp · Upgrade to 0.4.1 or later · < 0.4.1 · CVE-2026-50125 · GHSA-qw5r-ppcg-f8rj
- Medium, CVSS 6.5
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
Go github.com/SpectoLabs/hoverfly · Upgrade to 1.12.8 or later · <= 1.12.7 · CVE-2026-50018 · GHSA-42j2-w334-qxw7
- High, CVSS 7.5
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Go github.com/SpectoLabs/hoverfly · Upgrade to 1.12.8 or later · <= 1.12.7 · CVE-2026-50013 · GHSA-qrh4-p6v4-mrfg
- Medium, CVSS 5.8
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
Go github.com/k3s-io/k3s · Upgrade to 1.35.3, 1.34.6 or 1.33.10 by release line · >= 1.35.0-rc1, < 1.35.3; >= 1.34.0-rc1, < 1.34.6; < 1.33.10 · CVE-2026-54250 · GHSA-jxr7-mqhw-9p98
- Low, CVSS 1.0
Wasmtime: Memory leak in C API with
externrefandanyreftypescrates.io wasmtime-c-api-impl +1 · Upgrade all 2 to 37.0.2 or later · >= 37.0.0, < 37.0.2 · CVE-2025-61670 · GHSA-vvp9-h8p2-xwfc · amended
- Low, CVSS 3.5
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of
Tools::noHtml-escaped quotes insideonclick=Packagist facturascripts/facturascripts · Upgrade to 2026.2 or later · < 2026.2 · CVE-2026-45710 · GHSA-3x7p-v8hj-xh5m · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.