High, CVSS 8.1
CKEditor: Cross-site scripting (XSS) in the engine package
npm ckeditor5 +1 · Upgrade all 2 to 48.5.1 or 47.7.4 by release line · >= 45.0.0, < 47.7.4; >= 48.0.0, < 48.5.1 · CVE-2026-116688 · GHSA-rh54-vffm-5fvp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
451–475 of 30,910 matching · newest first
- Medium, CVSS 5.4
Neko: Authorization bypass in legacy WebRTC input handling
Go github.com/m1k1o/neko/server · Upgrade to 0.0.0-20260805142851-395ca1a6f62b (pre-release) or later · >= 0.0.0-20250401220545-fe94c999c6af, < 0.0.0-20260805142851-395ca1a6f62b · CVE-2026-116679 · GHSA-5cp7-fp4j-wwcv · amended
- High, CVSS 8.8
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Go github.com/runatlantis/atlantis · Upgrade to 0.47.1 or later · >= 0.4.0, < 0.47.1 · CVE-2026-116676 · GHSA-rjh2-4xgw-p2hj · amended
- High, CVSS 8.6
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260814233832-4126edeb07a0 (pre-release) or later · < 0.0.0-20260814233832-4126edeb07a0 · CVE-2026-116682 · GHSA-mgqf-5mf5-prfj · amended
- High, CVSS 7.4
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
npm undici · Upgrade to 8.12.2 or 7.30.1 by release line · >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109829 · GHSA-4w7w-5xrc-9h26 · amended
- High, CVSS 7.4
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 4.0.0, < 6.29.1; >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109383 · GHSA-2m5v-pch6-74hx · amended
- High, CVSS 7.5
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 4.2.1, < 6.29.1; >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm · amended
- Medium, CVSS 5.9
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 5.15.0, < 6.29.1; >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109932 · GHSA-9fm3-97px-rjf6 · amended
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
npm undici · Upgrade to 8.12.2 or 7.30.1 by release line · >= 7.15.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-87029 · GHSA-55wc-3pg8-jfw6 · amended
- High, CVSS 7.5
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
npm @modelcontextprotocol/sdk · Upgrade to 1.30.1 or later · >= 1.10.0, < 1.30.1 · +3 more packages · GHSA-f897-62hf-6gxq · amended
- High, CVSS 8.7
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
Packagist symfony/symfony +1 · Upgrade all 2 to 8.1.6, 7.4.18, 6.4.45 or 5.4.54 by release line · >= 2.0.0, < 5.4.54; >= 6.0.0, < 6.4.45; >= 7.0.0, < 7.4.18; >= 8.0.0, < 8.1.6 · CVE-2026-109413 · GHSA-2v3c-qxhr-7vpv · amended
- High, CVSS 8.7
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
Packagist symfony/symfony +1 · Upgrade all 2 to 8.1.7, 7.4.19, 6.4.46 or 5.4.54 by release line · >= 6.0.1, < 6.4.46; >= 7.0.0, < 7.4.19; >= 8.0.0, < 8.1.7; >= 4.1.0, < 5.4.54 · CVE-2026-108082 · GHSA-r925-mgvr-h9cc · amended
- High, CVSS 7.8
Hydra legacy target blacklist permits unsafe PyYAML loading
PyPI hydra-core · Upgrade to 1.4.0rc3 (pre-release) or 1.3.8 by release line · >= 1.3.6, < 1.3.8; >= 1.4.0.dev9, < 1.4.0rc3 · GHSA-wf6j-7hvr-gr93 · amended
- Medium, CVSS 6.3
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
npm qs · Upgrade to 6.16.1 or later · >= 6.7.0, <= 6.16.0 · CVE-2026-110816 · GHSA-6pq8-jhm2-2vcw · amended
- High, CVSS 7.5
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
npm undici · Upgrade to 8.11.2 or later · >= 8.11.0, < 8.11.2 · CVE-2026-109855 · GHSA-qq8j-7v2v-3rwp · amended
- High, CVSS 7.4
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
PyPI authlib · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg · amended
- Medium, CVSS 5.4
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
PyPI authlib · Upgrade to 1.9.0 or later · >= 1.6.0, < 1.9.0 · CVE-2026-114620 · GHSA-x4rv-c3wx-4cr8 · amended
- Medium, CVSS 4.2
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
PyPI authlib · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-114617 · GHSA-c5mf-xmp2-59rc · amended
- Medium, CVSS 6.8
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
PyPI authlib · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-114618 · GHSA-fch4-3c6x-j4gc · amended
- Medium, CVSS 4.6
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
PyPI authlib · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-114619 · GHSA-q686-2qmg-hqc7 · amended
- High, CVSS 7.4
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
PyPI authlib · Upgrade to 1.9.0 or later · >= 1.3.1, < 1.9.0 · CVE-2026-114615 · GHSA-7vr2-2fgp-9w7p · amended
- Medium, CVSS 6.4
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0, 3.10.8, 2.4.8 or 2 more by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8; >= 2.2.0, < 2.4.8; >= 2.0.0, < 2.1.19; < 1.30.7 · CVE-2026-108360 · GHSA-2phh-27fw-q4gc · amended
- High, CVSS 8.7
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0, 3.10.8, 2.4.8 or 2 more by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8; >= 2.2.0, < 2.4.8; >= 2.0.0, < 2.1.19; < 1.30.7 · CVE-2026-108359 · GHSA-j2w7-387v-m2rq · amended
- High, CVSS 8.8
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0, 3.10.8, 2.4.8 or 2 more by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8; >= 2.2.0, < 2.4.8; >= 2.0.0, < 2.1.19; < 1.30.7 · CVE-2026-108358 · GHSA-3x94-m842-937c · amended
- High, CVSS 8.8
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0 or 3.10.8 by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8 · CVE-2026-108357 · GHSA-rxj4-h86g-25gc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.