High, CVSS 7.4
Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
RubyGems actionpack · Upgrade to 8.1.4.1 or later · >= 8.1.0.beta1, < 8.1.4.1 · CVE-2026-126083 · GHSA-2gff-2mmg-m73p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125117 · GHSA-8332-j7wj-wjw4 · amended
- High, CVSS 7.5
Mongoose: Connection-level sanitizeFilter not applied
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · >= 6.0.0, < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125119 · GHSA-gg4r-jv3p-qx3c · amended
- Critical, CVSS 9.8
Mongoose: sanitizeFilter not applied on countDocuments
npm mongoose · Upgrade to 9.9.2, 8.24.3, 7.8.12 or 6.13.11 by release line · < 6.13.11; >= 7.0.0, < 7.8.12; >= 8.0.0, < 8.24.3; >= 9.0.0, < 9.9.2 · CVE-2026-125120 · GHSA-pcrw-h46h-c93h · amended
- High, CVSS 8.7
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
RubyGems rack · Upgrade to 3.2.8, 3.1.23 or 2.2.25 by release line · < 2.2.25; >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125111 · GHSA-5v64-555j-wjxm · amended
- High, CVSS 8.8
OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
npm @ohif/extension-dicom-pdf · Upgrade to 3.14.0-beta.36 (pre-release), 3.13.10 or 3.12.18 by release line · >= 3.5.0-beta.0, < 3.12.18; >= 3.13.0-beta.0, < 3.13.10; >= 3.14.0-beta.0, < 3.14.0-beta.36 · CVE-2026-118670 · GHSA-xwgp-w3pj-q5h3 · amended
- High, CVSS 7.5
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119191 · GHSA-rhr8-3pm8-cq29 · amended
- High, CVSS 7.5
Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119192 · GHSA-6qrw-m8cv-hcxf · amended
- Critical, CVSS 9.3
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
npm bitcoinjs-lib · Upgrade to 7.0.2, 6.1.8 or 5.2.1 by release line · >= 2.3.0, < 5.2.1; >= 6.0.0, < 6.1.8; >= 7.0.0-rc.0, < 7.0.2 · CVE-2026-107846 · GHSA-8vv3-6qpc-gpw6 · amended
- High, CVSS 8.8
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
PyPI gpustack · Upgrade to 2.2.2 or later · >= 2.2.0, < 2.2.2 · CVE-2026-103002 · GHSA-3hch-x692-6qj3 · amended
- Critical, CVSS 9.1
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
PyPI gpustack · Upgrade to 2.2.2 or later · >= 0.7.1, < 2.2.2 · CVE-2026-102894 · GHSA-62m9-f875-rqw6 · amended
- High, CVSS 7.5
Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
npm @nuxt/content · Upgrade to 3.15.2 or later · >= 3.0.0, < 3.15.2 · CVE-2026-102650 · GHSA-xxrh-5hgg-gj4h · amended
- High, CVSS 7.2
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
Go github.com/ultravioletrs/cocos · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-119345 · GHSA-ghwv-vrp2-2975 · amended
- Critical, CVSS 9.1
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
npm node-opcua +2 · Upgrade all 3 to 2.180.0 or later · >= 2.42.0, < 2.180.0 · CVE-2026-95860 · GHSA-xggf-m53x-jc3f · amended
- High, CVSS 7.2
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260420170029-186dd1f3b040 (pre-release) or later · < 0.0.0-20260420170029-186dd1f3b040 · CVE-2026-88984 · GHSA-ghgh-57qv-h687 · amended
- High, CVSS 7.7
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
npm @anthropic-ai/claude-code · Upgrade to 2.1.251 or later · < 2.1.251 · CVE-2026-88968 · GHSA-5xjx-9qx6-jcrv · amended
- High, CVSS 8.8
DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
Go github.com/ddev/ddev · Upgrade to 1.25.4 or later · < 1.25.4 · CVE-2026-108262 · GHSA-9hq4-hm3j-jmph · amended
- High, CVSS 7.5
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
npm moleculer · Upgrade to 0.15.2 or 0.14.36 by release line · >= 0.15.0-beta1, < 0.15.2; < 0.14.36 · CVE-2026-97705 · GHSA-h89v-g948-47vp · amended
- Critical, CVSS 9.6
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260909234119-62516d8c525f (pre-release) or later · < 0.0.0-20260909234119-62516d8c525f · CVE-2026-77596 · GHSA-rjr3-43j3-4q8g · amended
- High, CVSS 7.1
Code Graph RAG structural tools follow out-of-root symlinks
PyPI code-graph-rag · Upgrade to 0.0.587 or later · < 0.0.587 · CVE-2026-87008 · GHSA-85gg-2gfq-q95m · amended
- Critical, CVSS 9.8Exploited · CISA KEV
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
PyPI gpustack · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-102895 · GHSA-gj9m-f8ph-pmhr · amended
- Critical, CVSS 9.6
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260727180059-43aaccd5bfac (pre-release) or later · < 0.0.0-20260727180059-43aaccd5bfac · CVE-2026-115770 · GHSA-rm8c-2cv8-jwf6 · amended
- High, CVSS 7.5
esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal
Go github.com/esm-dev/esm.sh/web · Upgrade to 0.2.0 or later · < 0.2.0 · CVE-2026-102657 · GHSA-g3c2-rjq2-c763 · amended
- High, CVSS 8.5
Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
Go github.com/telepresenceio/telepresence · Upgrade to 2.31.0 or later · < 2.31.0 · CVE-2026-102340 · GHSA-j8j4-rw65-56r6 · amended
- High, CVSS 8.2
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
Go github.com/telepresenceio/telepresence/v2 · Upgrade to 2.31.0 or later · < 2.31.0 · CVE-2026-102339 · GHSA-6j3h-rp73-6rvf · amended
A vendor fix does not resolve your finding until you verify it in your own systems.