High, CVSS 8.2
node-tar Symlink Path Traversal via Drive-Relative Linkpath
npm tar · Upgrade to 7.5.11 or later · <= 7.5.10 · CVE-2026-31802 · GHSA-9ppj-qmqm-q256 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
pdfmake is vulnerable to server-side request forgery (SSRF)
npm pdfmake · Upgrade to 0.3.6 or later · >= 0.3.0-beta.2, < 0.3.6 · CVE-2026-26801 · GHSA-wp52-r2fp-4vmr · amended
- High, CVSS 7.5
Elysia has a string URL format ReDoS
npm elysia · Upgrade to 1.4.26 or later · < 1.4.26 · CVE-2026-30837 · GHSA-f45g-68q3-5w8x · amended
- Critical, CVSS 9.3
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
npm @feathersjs/mongodb · Upgrade to 5.0.42 or later · >= 5.0.0, <= 5.0.41 · CVE-2026-29793 · GHSA-p9xr-7p9p-gpqx · amended
- Critical, CVSS 9.3
Feathers has an OAuth Callback Account Takeover issue
npm @feathersjs/authentication-oauth · Upgrade to 5.0.42 or later · >= 5.0.0, <= 5.0.41 · CVE-2026-29792 · GHSA-wg9x-qfgw-pxhj · amended
- Critical, CVSS 9.0
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
PyPI mcp-atlassian · Upgrade to 0.17.0 or later · < 0.17.0 · CVE-2026-27825 · GHSA-xjgw-4wvw-rgm4 · amended
- High, CVSS 8.2
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
PyPI mcp-atlassian · Upgrade to 0.17.0 or later · < 0.17.0 · CVE-2026-27826 · GHSA-7r34-79r5-rcc9 · amended
- Critical, CVSS 9.8
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
npm simple-git · Upgrade to 3.32.3 or later · >= 3.15.0, < 3.32.3 · CVE-2026-28292 · GHSA-r275-fr43-pm7q · amended
- High, CVSS 8.8
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
npm @azure/mcp · Upgrade to 2.0.0-beta.17 (pre-release) or 1.0.2 by release line · >= 2.0.0-beta.1, < 2.0.0-beta.17; >= 1.0.0, < 1.0.2 · +2 more packages · CVE-2026-26118 · GHSA-hhfx-wfvq-7g9c · amended
- High, CVSS 7.5
LimeSurvey is vulnerable to SQL injection
Packagist limesurvey/limesurvey · Upgrade to 6.15.4 or later · < 6.15.4 · CVE-2025-56421 · GHSA-rccq-2fxq-7x3h
- High, CVSS 7.5
Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation
Go github.com/envoyproxy/envoy · Upgrade to 1.37.1, 1.36.5, 1.35.9 or 1.34.13 by release line · >= 1.37.0, <= 1.37.0; >= 1.36.0, <= 1.36.4; >= 1.35.0, <= 1.35.8; <= 1.34.12 · CVE-2026-26308 · GHSA-ghc4-35x6-crw5
- Critical, CVSS 9.3
Parse Server: SQL injection via dot-notation field name in PostgreSQL
npm parse-server · Upgrade to 9.6.0-alpha.2 (pre-release) or 8.6.28 by release line · >= 9.0.0, < 9.6.0-alpha.2; < 8.6.28 · CVE-2026-31840 · GHSA-qpr4-jrj4-6f27 · amended
- High, CVSS 8.6
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
Packagist craftcms/commerce · Upgrade to 5.5.3 or later · >= 5.0.0, <= 5.5.2 · CVE-2026-29175 · GHSA-cfpv-rmpf-f624
- High, CVSS 8.7
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Packagist craftcms/commerce · Upgrade to 5.5.3 or later · >= 5.0.0, <= 5.5.2 · CVE-2026-29174 · GHSA-pmgj-gmm4-jh6j
- High, CVSS 8.7
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Packagist craftcms/commerce · Upgrade to 5.5.3 or 4.10.2 by release line · >= 4.0.0, <= 4.10.1; >= 5.0.0, <= 5.5.2 · CVE-2026-29172 · GHSA-j3x5-mghf-xvfw
- High, CVSS 8.8
StudioCMS has Privilege Escalation via Insecure API Token Generation
npm studiocms · Upgrade to 0.4.0 or later · <= 0.3.0 · CVE-2026-30944 · GHSA-667w-mmh7-mrr4 · amended
- Critical, CVSS 9.4
RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface
crates.io rssn · Upgrade to 0.2.9 or later · < 0.2.9 · CVE-2026-30960 · GHSA-9c4h-pwmf-m6fj
- Critical, CVSS 9.3
Linkdave Missing Authentication on REST and WebSocket endpoints
Go github.com/shi-gg/linkdave · Upgrade to 0.1.5 or later · < 0.1.5 · GHSA-xv8g-fj9h-6gmv
- Critical, CVSS 9.9
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object
npm @oneuptime/common · Upgrade to 10.0.21 or later · < 10.0.21 · CVE-2026-30957 · GHSA-jw8q-gjvg-8w4q · amended
- Critical, CVSS 9.9
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
npm @oneuptime/common · Upgrade to 10.0.21 or later · < 10.0.21 · CVE-2026-30956 · GHSA-r5v6-2599-9g3m · amended
- High, CVSS 8.7
liquidjs has a path traversal fallback vulnerability
npm liquidjs · Upgrade to 10.25.0 or later · < 10.25.0 · CVE-2026-30952 · GHSA-wmfp-5q7x-987x · amended
- High, CVSS 8.8
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
npm parse-server · Upgrade to 9.5.1-alpha.2 (pre-release) or 8.6.13 by release line · < 8.6.13; >= 9.0.0-alpha.1, < 9.5.1-alpha.2 · CVE-2026-30939 · GHSA-5j86-7r7m-p8h6 · amended
- High, CVSS 8.2
Parse Server has Regular Expression Denial of Service (ReDoS) via
$regexquery in LiveQuerynpm parse-server · Upgrade to 9.5.0-alpha.14 (pre-release) or 8.6.11 by release line · >= 9.0.0-alpha.1, < 9.5.0-alpha.14; < 8.6.11 · CVE-2026-30925 · GHSA-mf3j-86qx-cq5j · amended
- High, CVSS 8.6
NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-0846 · GHSA-h8wq-7xc4-p3qx · amended
- High, CVSS 8.7
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Packagist azuracast/azuracast · Upgrade to 0.23.4 or later · <= 0.23.3 · GHSA-93fx-5qgc-wr38
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.