Medium, CVSS 4.7
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
RubyGems secure_headers · Upgrade to 7.3.0 or later · < 7.3.0 · CVE-2026-54163 · GHSA-rqq5-2gf9-4w4q
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 948 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3901–3925 of 30,924 matching · newest first
- Critical, CVSS 9.9
SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260628153353-2d5d72223df4 (pre-release) or later · < 0.0.0-20260628153353-2d5d72223df4 · CVE-2026-50551 · GHSA-56mp-4f3v-fgj2
- Critical, CVSS 10.0
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
Packagist prestashop/ps_facetedsearch · Upgrade to 4.0.4 or later · >= 3.0.0, < 4.0.4 · CVE-2026-54159 · GHSA-m5f5-28qr-9g9r
- Critical, CVSS 9.9
SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260628153353-2d5d72223df4 (pre-release) or later · < 0.0.0-20260628153353-2d5d72223df4 · CVE-2026-54158 · GHSA-5xfx-xj4h-5p7r
- High, CVSS 7.7
mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-73498 · GHSA-g5r6-gv6m-f5jv · amended
- High, CVSS 7.7
mcp-atlassian: Arbitrary server-side file read via attachment upload
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-73496 · GHSA-wm45-qh3g-v83f · amended
- High, CVSS 8.8
SafeInstall agent guard shell parsing can miss raw package execution
npm safeinstall-cli · Upgrade to 0.10.2 or later · < 0.10.2 · GHSA-xrmc-c5cg-rv7x · amended
- High, CVSS 8.8
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)
Packagist notrinos/notrinos-erp · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-76913 · GHSA-qv4m-m73m-8hj7 · amended
- High, CVSS 7.8
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
PyPI babeldoc · Upgrade to 0.6.3 or later · <= 0.6.2 · CVE-2026-54071 · GHSA-m8gf-v64p-gfmg · amended
- Critical, CVSS 9.3
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.6 or later · <= 2.63.5 · CVE-2026-54088 · GHSA-m93h-4hw7-5qcm
- Medium, CVSS 5.1
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
crates.io windmill-api · Upgrade to 1.715.0 or later · <= 1.714.1 · CVE-2026-54136 · GHSA-2ppx-66jv-wpw5
- High, CVSS 7.1
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260628153353-2d5d72223df4 (pre-release) or later · < 0.0.0-20260628153353-2d5d72223df4 · CVE-2026-54070 · GHSA-w7cg-whh7-xp28
- Critical, CVSS 9.2
SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260628153353-2d5d72223df4 (pre-release) or later · < 0.0.0-20260628153353-2d5d72223df4 · CVE-2026-54069 · GHSA-hvr9-72v2-fff3
- Medium, CVSS 5.9
SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260628153353-2d5d72223df4 (pre-release) or later · < 0.0.0-20260628153353-2d5d72223df4 · CVE-2026-54068 · GHSA-gcm7-57gf-953c
- Medium, CVSS 5.5
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
PyPI credsweeper · Upgrade to 1.16.0 or later · >= 1.4.9, < 1.16.0 · GHSA-9mqm-qcwf-5qhg · amended
- Critical, CVSS 9.3
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
Go github.com/authorizerdev/authorizer · Upgrade to 0.0.0-20260409051328-bd3f5baf6d3d (pre-release) or later · < 0.0.0-20260409051328-bd3f5baf6d3d · CVE-2026-54072 · GHSA-h29v-hj44-q8cv
- Critical, CVSS 9.9
SiYuan: Stored XSS to RCE via CSS-snippet breakout in renderSnippet()
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260628153353-2d5d72223df4 (pre-release) or later · < 0.0.0-20260628153353-2d5d72223df4 · CVE-2026-54067 · GHSA-mvjr-vv3c-w4qv
- High, CVSS 7.5
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260628153353-2d5d72223df4 (pre-release) or later · < 0.0.0-20260628153353-2d5d72223df4 · CVE-2026-54066 · GHSA-p4m3-mgmm-c664
- High, CVSS 7.5
adm-zip: Crafted ZIP file triggers 4GB memory allocation
npm adm-zip · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-39244 · GHSA-xcpc-8h2w-3j85 · amended
- Medium, CVSS 6.5
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-73497 · GHSA-489g-7rxv-6c8q · amended
- Medium, CVSS 4.3
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
npm tarteaucitronjs · Upgrade to 1.33.0 or later · < 1.33.0 · CVE-2026-49977 · GHSA-jxj7-g6gm-49j7 · amended
- High, CVSS 7.5
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
npm @libp2p/gossipsub · Upgrade to 16.0.0 or later · < 16.0.0 · CVE-2026-49866 · GHSA-cwc9-cp4j-mcvv · amended
- Medium, CVSS 5.3
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-49865 · GHSA-pj8j-p4g4-4vw8
- Medium, CVSS 5.3
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
npm morgan · Upgrade to 1.11.0 or later · >= 1.2.0, <= 1.10.1 · CVE-2026-5078 · GHSA-4vj7-5mj6-jm8m · amended
- Medium, CVSS 5.9
API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
Packagist api-platform/core +2 · Upgrade all 3 to 4.3.8, 4.2.25 or 4.1.29 by release line · >= 2.6.0, < 4.1.29; >= 4.2.0, < 4.2.25; >= 4.3.0, < 4.3.8 · CVE-2026-49858 · GHSA-pjhx-3c3w-9v23
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.