Critical, CVSS 9.8
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
PyPI praisonai · Upgrade to 4.5.69 or later · >= 4.5.15, <= 4.5.68 · CVE-2026-34935 · GHSA-9gm9-c8mq-vq7m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.8
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
PyPI praisonaiagents · Upgrade to 1.5.90 or later · <= 1.5.89 · CVE-2026-34937 · GHSA-w37c-qqfp-c67f · amended
- Critical, CVSS 10.0
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
PyPI praisonaiagents · Upgrade to 1.5.90 or later · <= 1.5.89 · CVE-2026-34938 · GHSA-6vh2-h83c-9294 · amended
- High, CVSS 8.2
Parser Server's streaming file download bypasses afterFind file trigger authorization
npm parse-server · Upgrade to 9.7.1-alpha.1 (pre-release) or 8.6.71 by release line · >= 9.0.0, < 9.7.1-alpha.1; < 8.6.71 · CVE-2026-34784 · GHSA-hpm8-9qx6-jvwv · amended
- High, CVSS 8.7
phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController
Packagist phpmyfaq/phpmyfaq · Upgrade to 4.1.1 or later · <= 4.1.0 · CVE-2026-34728 · GHSA-38m8-xrfj-v38x
- High, CVSS 8.2
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
npm dbgate-web · Upgrade to 7.1.5 or later · >= 7.0.0, < 7.1.5 · CVE-2026-34725 · GHSA-35xm-qvjg-8m42 · amended
- High, CVSS 7.1
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
PyPI poetry · Upgrade to 2.3.3 or later · >= 1.4.0, <= 2.3.2 · CVE-2026-34591 · GHSA-2599-h6xx-hpxp · amended
- High, CVSS 8.8
CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34572 · GHSA-8fq3-c5w3-pj3q
- Critical, CVSS 9.9
CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34571 · GHSA-fc4p-p49v-r948
- High, CVSS 8.8
CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34570 · GHSA-4vxv-4xq4-p84h
- Critical, CVSS 9.9
CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34569 · GHSA-fhrf-q333-82fm
- Critical, CVSS 9.1
CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34568 · GHSA-x7wh-g25g-53vg
- Critical, CVSS 9.1
CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34567 · GHSA-r33w-c82v-x5v7
- Critical, CVSS 9.1
CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34566 · GHSA-458r-h248-29c5
- Critical, CVSS 9.1
CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34565 · GHSA-xgh5-w62m-8mpr
- Critical, CVSS 9.1
CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34564 · GHSA-g4pp-fhgf-8653
- Critical, CVSS 9.9
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34563 · GHSA-85m8-g393-jcxf
- Critical, CVSS 9.1
CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34561 · GHSA-gcfj-cf7j-vwgj
- Critical, CVSS 9.1
CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34560 · GHSA-r4v5-rwr2-q7r4
- Critical, CVSS 9.1
CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34559 · GHSA-4333-387x-w245
- High, CVSS 8.3
SillyTavern: Path Traversal in
/api/chats/exportand/api/chats/deleteallows arbitrary file read/delete within user data rootnpm sillytavern · Upgrade to 1.17.0 or later · <= 1.16.0 · CVE-2026-34524 · GHSA-vprr-q85p-79mf · amended
- High, CVSS 8.1
SillyTavern has a path traversal in
/api/chats/importallows arbitrary file write outside intended chat directorynpm sillytavern · Upgrade to 1.17.0 or later · <= 1.16.0 · CVE-2026-34522 · GHSA-xvww-xhx6-22pf · amended
- High, CVSS 7.7
Payload has Authenticated SSRF via Upload Functionality
npm payload · Upgrade to 3.79.1 or later · < 3.79.1 · CVE-2026-34746 · GHSA-6r7f-q7f5-wpx8 · amended
- High, CVSS 8.7
@payloadcms/next has Stored XSS in Admin Panel
npm @payloadcms/next · Upgrade to 3.78.0 or later · < 3.78.0 · CVE-2026-34748 · GHSA-mmxc-95ch-2j7c · amended
- High, CVSS 8.5
Payload has an SQL Injection via Query Handling
npm payload · Upgrade to 3.79.1 or later · < 3.79.1 · CVE-2026-34747 · GHSA-7xxh-373w-35vg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.