High, CVSS 8.8
Rollup 4 has Arbitrary File Write via Path Traversal
npm rollup · Upgrade to 4.59.0, 3.30.0 or 2.80.0 by release line · < 2.80.0; >= 3.0.0, < 3.30.0; >= 4.0.0, < 4.59.0 · CVE-2026-27606 · GHSA-mw96-cpmx-2vgc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
npm basic-ftp · Upgrade to 5.2.0 or later · < 5.2.0 · CVE-2026-27699 · GHSA-5rq4-664w-9x2c · amended
- High, CVSS 8.5
n8n Vulnerable to Stored XSS via Various Nodes
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.0.0, < 2.9.3; >= 2.10.0, < 2.10.1 · CVE-2026-27578 · GHSA-2p9h-rqjw-gm92 · amended
- Critical, CVSS 9.4
n8n: Expression Sandbox Escape Leads to RCE
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.0.0, < 2.9.3; >= 2.10.0, < 2.10.1 · CVE-2026-27577 · GHSA-vpcf-gvg4-6qwr · amended
- Critical, CVSS 9.0
n8n has Arbitrary Command Execution via File Write and Git Operations
npm n8n · Upgrade to 2.2.0 or 1.123.8 by release line · < 1.123.8; >= 2.0.0, < 2.2.0 · CVE-2026-27498 · GHSA-x2mw-7j39-93xq · amended
- Critical, CVSS 9.4
n8n has Potential Remote Code Execution via Merge Node
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.0.0, < 2.9.3; >= 2.10.0, < 2.10.1 · CVE-2026-27497 · GHSA-wxx7-mcgf-j869 · amended
- Critical, CVSS 9.4
n8n has a Sandbox Escape in its JavaScript Task Runner
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.0.0, < 2.9.3; >= 2.10.0, < 2.10.1 · CVE-2026-27495 · GHSA-jjpj-p2wh-qf23 · amended
- High, CVSS 7.1
n8n has Arbitrary File Read via Python Code Node Sandbox Escape
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.0.0, < 2.9.3; >= 2.10.0, < 2.10.1 · CVE-2026-27494 · GHSA-mmgg-m5j7-f83h · amended
- Critical, CVSS 9.5
n8n has Unauthenticated Expression Evaluation via Form Node
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.0.0, < 2.9.3; >= 2.10.0, < 2.10.1 · CVE-2026-27493 · GHSA-75g8-rv7v-32f7 · amended
- High, CVSS 7.6
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
Packagist mautic/core · Upgrade to 7.0.1, 6.0.8 or 5.2.10 by release line · >= 2.10.0, < 5.2.10; >= 6.0.0-alpha, < 6.0.8; >= 7.0.0-alpha, < 7.0.1 · CVE-2026-3105 · GHSA-r5j5-q42h-fc93
- High, CVSS 8.6
changedetection.io is Vulnerable to SSRF via Watch URLs
PyPI changedetection-io · Upgrade to 0.54.1 or later · < 0.54.1 · CVE-2026-27696 · GHSA-3c45-4pj5-ch7m · amended
- Critical, CVSS 9.8
Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
PyPI flask-reuploaded · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-27641 · GHSA-65mp-fq8v-56jr · amended
- High, CVSS 7.0
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
npm parse-dashboard · Upgrade to 9.0.0-alpha.8 (pre-release) or later · >= 7.3.0-alpha.42, < 9.0.0-alpha.8 · CVE-2026-27610 · GHSA-jhp4-jvq3-w5xr · amended
- High, CVSS 8.3
Parse Dashboard is Missing CSRF Protection for its Agent Endpoint
npm parse-dashboard · Upgrade to 9.0.0-alpha.8 (pre-release) or later · >= 7.3.0-alpha.42, < 9.0.0-alpha.8 · CVE-2026-27609 · GHSA-3534-xp88-25rc · amended
- Critical, CVSS 9.3
Parse Dashboard is Missing Authorization for its Agent Endpoint
npm parse-dashboard · Upgrade to 9.0.0-alpha.8 (pre-release) or later · >= 7.3.0-alpha.42, <= 9.0.0-alpha.7 · CVE-2026-27608 · GHSA-cvwj-6c9h-jg6v · amended
- High, CVSS 7.3
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
PyPI rucio-webui · Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line · < 35.8.3; >= 36.0.0rc1, < 38.5.4; >= 39.0.0rc1, < 39.3.1 · CVE-2026-25733 · GHSA-rwj9-7j48-9f7q · amended
- Critical, CVSS 9.9
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
npm budibase · Upgrade to 3.30.4 or later · < 3.30.4 · CVE-2026-27702 · GHSA-rvhr-26g4-p2r8 · amended
- High, CVSS 8.6
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
Packagist wwbn/avideo · Upgrade to 22.0 or later · <= 21.0 · CVE-2026-27732 · GHSA-h39h-7cvg-q7j6
- High, CVSS 8.1
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
PyPI rucio-webui · Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line · < 35.8.3; >= 36.0.0rc1, < 38.5.4; >= 39.0.0rc1, < 39.3.1 · CVE-2026-25136 · GHSA-h79m-5jjm-jm4q · amended
- Critical, CVSS 9.9
Parse Dashboard has incomplete authentication on AI Agent endpoint
npm parse-dashboard · Upgrade to 9.0.0-alpha.8 (pre-release) or later · >= 7.3.0-alpha.42, < 9.0.0-alpha.8 · CVE-2026-27595 · GHSA-qwc3-h9mg-4582 · amended
- High, CVSS 8.9
c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property
Maven com.mchange:c3p0 · Upgrade to 0.12.0 or later · < 0.12.0 · CVE-2026-27830 · GHSA-5476-xc4j-rqcv
- High, CVSS 8.9
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
Maven com.mchange:mchange-commons-java · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2026-27727 · GHSA-m2cm-222f-qw44
- Critical, CVSS 9.9
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
npm @oneuptime/common · Upgrade to 10.0.7 or later · < 10.0.7 · CVE-2026-27728 · GHSA-jmhp-5558-qxh5 · amended
- High, CVSS 8.2
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
npm hono · Upgrade to 4.12.2 or later · >= 4.12.0, < 4.12.2 · CVE-2026-27700 · GHSA-xh87-mx6m-69f3 · amended
- High, CVSS 7.7
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder
Go github.com/BishopFox/sliver · Upgrade to 1.7.2 or later · < 1.7.2 · GHSA-2phg-qgmm-r638
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.