Critical, CVSS 9.5
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
npm fuxa-server · Upgrade to 1.2.11 or later · >= 1.2.8, < 1.2.11 · CVE-2026-25938 · GHSA-v4p5-w6r3-2x4f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
Packagist vrana/adminer · Upgrade to 5.4.2 or later · >= 4.6.2, < 5.4.2 · CVE-2026-25892 · GHSA-q4f2-39gr-45jh
- High, CVSS 8.1
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.57.1 or later · <= 2.57.0 · CVE-2026-25890 · GHSA-4mh3-h929-w968
- Critical, CVSS 9.0
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
npm @nyariv/sandboxjs · Upgrade to 0.8.31 or later · <= 0.8.30 · CVE-2026-25881 · GHSA-ww7g-4gwx-m7wj · amended
- High, CVSS 8.8
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
Maven org.keycloak:keycloak-services · Upgrade to 26.5.3 or 26.4.9 by release line · >= 26.5.0, < 26.5.3; < 26.4.9 · CVE-2026-1486 · GHSA-37gf-gmxv-74wv
- High, CVSS 8.1
Keycloak affected by improper invitation token validation
Maven org.keycloak:keycloak-services · Upgrade to 26.5.3, 26.4.9 or 26.2.13 by release line · >= 26.5.0, < 26.5.3; < 26.2.13; >= 26.3.0, < 26.4.9 · CVE-2026-1529 · GHSA-hcvw-475w-8g7p
- High, CVSS 8.6
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Packagist craftcms/cms · Upgrade to 5.8.22 or 4.16.18 by release line · >= 5.0.0-RC1, <= 5.8.21; >= 4.0.0-RC1, <= 4.16.17 · CVE-2026-25498 · GHSA-7jx7-3846-m7w7
- High, CVSS 8.6
Craft CMS: GraphQL Asset Mutation Privilege Escalation
Packagist craftcms/cms · Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line · >= 5.0.0-RC1, < 5.9.0-beta.1; >= 4.0.0-RC1, < 4.17.0-beta.1 · CVE-2026-25497 · GHSA-fxp3-g6gw-4r4v
- High, CVSS 8.7
Craft CMS Vulnerable to SQL Injection in Element Indexes via
criteria[orderBy]Packagist craftcms/cms · Upgrade to 5.8.22 or 4.16.18 by release line · >= 5.0.0-RC1, <= 5.8.21; >= 4.0.0-RC1, <= 4.16.17 · CVE-2026-25495 · GHSA-2453-mppf-46cj
- High, CVSS 7.5
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
npm axios · Upgrade to 1.13.5 or 0.30.3 by release line · >= 1.0.0, <= 1.13.4; <= 0.30.2 · CVE-2026-25639 · GHSA-43fc-jf86-j433 · amended
- High, CVSS 7.4
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
PyPI litestar · Upgrade to 2.20.0 or later · >= 2.19.0, <= 2.19.0 · CVE-2026-25478 · GHSA-2p2x-hpg8-cqp2 · amended
- Critical, CVSS 9.2
Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
Go github.com/gofiber/fiber/v2 · Upgrade to 2.52.11 or later · < 2.52.11 · CVE-2025-66630 · GHSA-68rr-p4fp-j59v
- High, CVSS 8.2
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
npm jsonpath · Upgrade to 1.3.0 or later · <= 1.2.1 · CVE-2026-1615 · GHSA-87r5-mp6g-5w5j · amended
- High, CVSS 7.5
Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service
Go github.com/bishopfox/sliver · Upgrade to 1.6.12 or later · <= 1.6.11 · CVE-2026-25791 · GHSA-wxrw-gvg8-fqjp
- High, CVSS 8.0
Antrea has invalid enforcement order for network policy rules caused by integer overflow
Go antrea.io/antrea · Upgrade to 2.4.3 or 2.3.2 by release line · < 2.3.2; >= 2.4.0, < 2.4.3 · CVE-2026-25804 · GHSA-86x4-wp9f-wrr9
- Critical, CVSS 9.4
Keylime Missing Authentication for Critical Function and Improper Authentication
PyPI keylime · Upgrade to 7.13.1 or 7.12.2 by release line · >= 7.12.0, < 7.12.2; >= 7.13.0, <= 7.13.0 · CVE-2026-1709 · GHSA-4jqp-9qjv-57m2 · amended
- High, CVSS 7.6
Blocklist Bypass possible via ECDSA Signature Malleability
Go github.com/slackhq/nebula · Upgrade to 1.10.3 or later · >= 1.7.0, <= 1.10.2 · CVE-2026-25793 · GHSA-69x3-g4r3-p962
- High, CVSS 7.5
AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection
npm @adonisjs/bodyparser · Upgrade to 11.0.0-next.9 (pre-release) or 10.1.3 by release line · <= 10.1.2; >= 11.0.0-next.0, <= 11.0.0-next.8 · CVE-2026-25762 · GHSA-xx9g-fh25-4q64 · amended
- High, CVSS 7.3
Gogs vulnerable to Stored XSS via Mermaid diagrams
Go gogs.io/gogs · Upgrade to 0.13.4 or later · <= 0.13.3 · GHSA-26gq-grmh-6xm6
- Critical, CVSS 9.3
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
PyPI dydx-v4-client · Upgrade to 1.1.5 or later · >= 1.1.5.post1, <= 1.1.5.post1 · GHSA-4f84-67cv-qrv3 · amended
- High, CVSS 7.1
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values
RubyGems phlex · Upgrade to 2.4.1, 2.3.2, 2.2.2 or 3 more by release line · >= 2.4.0.beta1, < 2.4.1; >= 2.3.0, < 2.3.2; >= 2.2.0, < 2.2.2; >= 2.1.0, < 2.1.3; >= 2.0.0.beta1, < 2.0.2; < 1.11.1 · GHSA-w67g-2h6v-vjgq
- High, CVSS 7.2
AdonisJS multipart body parsing has Prototype Pollution issue
npm @adonisjs/bodyparser · Upgrade to 11.0.0-next.9 (pre-release) or 10.1.3 by release line · <= 10.1.2; >= 11.0.0-next.0, <= 11.0.0-next.8 · CVE-2026-25754 · GHSA-f5x2-vj4h-vg4c · amended
- High, CVSS 7.7
Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json
npm @anthropic-ai/claude-code · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-25725 · GHSA-ff64-7w26-62rf · amended
- High, CVSS 7.7
Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions
npm @anthropic-ai/claude-code · Upgrade to 2.0.55 or later · < 2.0.55 · CVE-2026-25723 · GHSA-mhg7-666j-cqg4 · amended
- High, CVSS 7.7
Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection
npm @anthropic-ai/claude-code · Upgrade to 2.0.57 or later · < 2.0.57 · CVE-2026-25722 · GHSA-66q4-vfjg-2qhh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.