Critical, CVSS 9.3
mpp has multiple payment bypass and griefing vulnerabilities
crates.io mpp · Upgrade to 0.8.0 or later · < 0.8.0 · GHSA-fxc9-7j2w-vx54
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion
Go github.com/antchfx/xpath · Upgrade to 1.3.6 or later · < 1.3.6 · CVE-2026-32287 · GHSA-65xw-vw82-r86x
- Critical, CVSS 9.3
mppx has multiple payment bypass and griefing vulnerabilities
npm mppx · Upgrade to 0.4.8 or later · < 0.4.8 · GHSA-8x4m-qw58-3pcx · amended
- High, CVSS 8.2
Parse Server exposes auth data via verify password endpoint
npm parse-server · Upgrade to 9.7.0-alpha.7 (pre-release) or 8.6.63 by release line · >= 9.0.0, < 9.7.0-alpha.7; < 8.6.63 · CVE-2026-34215 · GHSA-wp76-gg32-8258 · amended
- High, CVSS 7.7
Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON
Maven io.trino:trino-iceberg · Upgrade to 480 or later · >= 439, < 480 · CVE-2026-34214 · GHSA-x27p-5f68-m644
- High, CVSS 7.5
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
npm mppx · Upgrade to 0.4.11 or later · < 0.4.11 · CVE-2026-34209 · GHSA-mv9j-8jvg-j8mr · amended
- High, CVSS 7.5
path-to-regexp vulnerable to Denial of Service via sequential optional groups
npm path-to-regexp · Upgrade to 8.4.0 or later · >= 8.0.0, < 8.4.0 · CVE-2026-4926 · GHSA-j3q9-mxjg-w52f · amended
- High, CVSS 7.7
AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction
NuGet awssdk.cloudfront · Upgrade to 3.7.510.7 or later · < 3.7.510.7 · +1 more package · GHSA-mvm6-f9r3-fgfx
- Critical, CVSS 9.2
Zebra node crash — V5 transaction hash panic (P2P reachable)
crates.io zebra-chain · Upgrade to 6.0.1 or later · < 6.0.1 · +1 more package · CVE-2026-34202 · GHSA-qp6f-w4r3-h8wg
- High, CVSS 7.7
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
PyPI giskard-agents · Upgrade to 1.0.2b1 (pre-release) or 0.3.4 by release line · <= 0.3.3; >= 1.0.1a1, <= 1.0.2a1 · CVE-2026-34172 · GHSA-frv4-x25r-588m · amended
- High, CVSS 7.7
AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities
Maven software.amazon.awssdk:cloudfront · Upgrade to 2.41.30 or later · >= 2.18.33, <= 2.41.29 · GHSA-443w-3rq3-5m5h
- High, CVSS 7.5
Flannel has cross-node remote code execution via extension backend BackendData injection
Go github.com/flannel-io/flannel · Upgrade to 0.28.2 or later · <= 0.28.1 · CVE-2026-32241 · GHSA-vchx-5pr6-ffx2
- High, CVSS 7.7
path-to-regexp outputs backtracking regular expressions
npm path-to-regexp · Upgrade to 8.0.0, 6.3.0, 3.3.0 or 2 more by release line · >= 0.2.0, < 1.9.0; < 0.1.10; >= 7.0.0, < 8.0.0; >= 2.0.0, < 3.3.0; >= 4.0.0, < 6.3.0 · CVE-2024-45296 · GHSA-37ch-88jc-xwx2 · amended
- High, CVSS 7.4
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
npm @clerk/fastify · Upgrade to 3.1.5 or later · >= 3.1.0, <= 3.1.4 · +3 more packages · CVE-2026-34076 · GHSA-gjxx-92w9-8v8f · amended
- High, CVSS 7.7
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
Packagist aws/aws-sdk-php · Upgrade to 3.371.4 or later · >= 3.11.7, <= 3.371.3 · GHSA-27qh-8cxx-2cr5
- High, CVSS 7.5
LangChain Core has Path Traversal vulnerabilites in legacy
load_promptfunctionsPyPI langchain-core · Upgrade to 1.2.22 or later · < 1.2.22 · CVE-2026-34070 · GHSA-qh6h-p6c9-ff54 · amended
- High, CVSS 7.1
Ruby LSP has arbitrary code execution through branch setting
RubyGems ruby-lsp · Upgrade to 0.26.9 or later · < 0.26.9 · CVE-2026-34060 · GHSA-c4r5-fxqw-vh93
- High, CVSS 8.7
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
PyPI langflow · Upgrade to 1.5.1 or later · <= 1.5.0 · +1 more package · CVE-2026-34046 · GHSA-8c4j-f57c-35cf · amended
- High, CVSS 8.2
act: actions/cache server allows malicious cache injection
Go github.com/nektos/act · Upgrade to 0.2.86 or later · <= 0.2.85 · CVE-2026-34042 · GHSA-x34h-54cw-9825
- High, CVSS 7.7
act: Unrestricted set-env and add-path command processing enables environment injection
Go github.com/nektos/act · Upgrade to 0.2.86 or later · <= 0.2.85 · CVE-2026-34041 · GHSA-xmgr-9pqc-h5vw
- High, CVSS 8.1
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
npm @mobilenext/mobile-mcp · Upgrade to 0.0.49 or later · < 0.0.49 · CVE-2026-33989 · GHSA-3p2m-h2v6-g9mx · amended
- High, CVSS 8.3
Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
PyPI changedetection-io · Upgrade to 0.54.7 or later · <= 0.54.6 · CVE-2026-33981 · GHSA-58r7-4wr5-hfx8 · amended
- High, CVSS 8.2
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
RubyGems mcp · Upgrade to 0.9.2 or later · <= 0.9.1 · CVE-2026-33946 · GHSA-qvqr-5cv7-wh35
- High, CVSS 8.1
Saloon has insecure deserialization in AccessTokenAuthenticator
Packagist saloonphp/saloon · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-33942 · GHSA-rf88-776r-rcq9
- High, CVSS 8.2
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33941 · GHSA-xjpj-3mr7-gcpf · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.