High, CVSS 8.1
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33940 · GHSA-xhpv-hc6g-r9c6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33939 · GHSA-9cx6-37pm-9jff · amended
- High, CVSS 8.1
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33938 · GHSA-3mfm-83xf-c92r · amended
- Critical, CVSS 9.8
Handlebars.js has JavaScript Injection via AST Type Confusion
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33937 · GHSA-2w6w-674q-4c4q · amended
- High, CVSS 8.7
Fleet's unbounded request body read allows remote Denial of Service
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.43.5-0.20260113202849-bbc1aef2987d (pre-release) or later · < 4.43.5-0.20260113202849-bbc1aef2987d · CVE-2026-26061 · GHSA-99hj-44vg-hfcp
- High, CVSS 8.2
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
npm express-xss-sanitizer · Upgrade to 2.0.2 or later · < 2.0.2 · CVE-2026-33979 · GHSA-3843-rr4g-m8jq · amended
- High, CVSS 8.8
Moby has AuthZ plugin bypass when provided oversized request bodies
Go github.com/moby/moby · Upgrade to 29.3.1 or later · < 29.3.1 · +1 more package · CVE-2026-34040 · GHSA-x744-4wpc-v9h2
- Critical, CVSS 9.9
Incus has an abitrary file write through its systemd-creds options
Go github.com/lxc/incus/v6 · Upgrade to 6.23.0 or later · < 6.23.0 · CVE-2026-33945 · GHSA-q4q8-7f2j-9h9f
- High, CVSS 8.8
Local Incus UI web server vulnerable to nuthentication bypass
Go github.com/lxc/incus/v6/cmd/incus · Upgrade to 6.23.0 or later · < 6.23.0 · CVE-2026-33898 · GHSA-453r-g2pg-cxxq
- High, CVSS 7.0
Incus does not verify combined fingerprint when downloading images from simplestreams servers
Go github.com/lxc/incus/v6/client · Upgrade to 6.23.0 or later · < 6.23.0 · CVE-2026-33542 · GHSA-p8mm-23gg-jc9r
- High, CVSS 8.4
TSPortal: Any user can forge self-deletion requests for any account
Packagist miraheze/ts-portal · Upgrade to 30 or later · <= 29 · CVE-2026-29788 · GHSA-gfhq-7499-f3f2
- High, CVSS 7.1
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
PyPI open-webui · Upgrade to 0.8.6 or later · < 0.8.6 · CVE-2026-28788 · GHSA-jjp7-g2jw-wh3j · amended
- High, CVSS 8.8
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
PyPI vllm · Upgrade to 0.18.0 or later · >= 0.10.1, < 0.18.0 · CVE-2026-27893 · GHSA-7972-pg2x-xr59 · amended
- High, CVSS 7.5
Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter
Maven org.springframework.ai:spring-ai-neo4j-store · Upgrade to 1.1.4 or 1.0.5 by release line · >= 1.0.0-M5, < 1.0.5; >= 1.1.0-M1, < 1.1.4 · CVE-2026-22743 · GHSA-7cj7-rcw6-p68v
- High, CVSS 7.5
Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters
Maven org.springframework.ai:spring-ai-redis-store · Upgrade to 1.1.4 or 1.0.5 by release line · >= 1.0.0-M5, < 1.0.5; >= 1.1.0-M1, < 1.1.4 · CVE-2026-22744 · GHSA-44f4-gvwj-6qg3
- High, CVSS 8.6
Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs
Maven org.springframework.ai:spring-ai-bedrock-converse · Upgrade to 1.1.4 or 1.0.5 by release line · >= 1.0.0-M5, < 1.0.5; >= 1.1.0-M1, < 1.1.4 · CVE-2026-22742 · GHSA-mhrg-94vw-45c5
- Critical, CVSS 9.8
Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key
Maven org.springframework.ai:spring-ai-vector-store · Upgrade to 1.1.4 or 1.0.5 by release line · >= 1.0.0, < 1.0.5; >= 1.1.0-M1, < 1.1.4 · CVE-2026-22738 · GHSA-fvh3-672c-7p6c
- High, CVSS 7.5
Grafana Tempo has Inadequate Encryption Strength
Go github.com/grafana/tempo · Upgrade to 2.10.3 or later · < 2.10.3 · CVE-2026-28377 · GHSA-ffqx-q65f-36jf
- High, CVSS 7.5
C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)
PyPI c2cciutils · Upgrade to 1.1.66 or later · < 1.1.66 · GHSA-wcjx-v2wj-xg87
- High, CVSS 8.8
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
npm happy-dom · Upgrade to 20.8.8 or later · >= 15.10.0, <= 20.8.7 · CVE-2026-33943 · GHSA-6q6h-j7hj-3r64 · amended
- High, CVSS 7.2
Ella Core has Privilege Escalation via Database Restore by NetworkManager role
Go github.com/ellanetworks/core · Upgrade to 1.7.0 or later · < 1.7.0 · CVE-2026-33906 · GHSA-87j9-m7x6-hvw2
- High, CVSS 7.4
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
npm node-forge · Upgrade to 1.4.0 or later · <= 1.3.3 · CVE-2026-33896 · GHSA-2328-f5f3-gj25 · amended
- High, CVSS 7.5
Forge has signature forgery in Ed25519 due to missing S > L check
npm node-forge · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-33895 · GHSA-q67f-28xg-22rw · amended
- High, CVSS 8.7
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
npm node-forge · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-33894 · GHSA-ppp5-5v6c-4jwp · amended
- High, CVSS 7.5
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
npm node-forge · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-33891 · GHSA-5m6q-g25r-mvwx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.