High, CVSS 8.7
MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token
PyPI mcp-salesforce-connector · Upgrade to 0.1.10 or later · < 0.1.10 · CVE-2026-25650 · GHSA-vf6j-c56p-cq58 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
PyPI pydantic-ai +1 · Upgrade all 2 to 1.51.0 or later · >= 1.34.0, < 1.51.0 · CVE-2026-25640 · GHSA-wjp5-868j-wqv7 · amended
- Critical, CVSS 9.9
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
NuGet microsoft.semantickernel.core · Upgrade to 1.71.0 or later · < 1.71.0 · +1 more package · CVE-2026-25592 · GHSA-2ww3-72rp-wpp4 · amended
- High, CVSS 8.6
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
PyPI pydantic-ai +1 · Upgrade all 2 to 1.56.0 or later · >= 0.0.26, < 1.56.0 · CVE-2026-25580 · GHSA-2jrp-274c-jhv3 · amended
- High, CVSS 7.7
Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering
Go github.com/mattermost/mattermost-plugin-confluence · Upgrade to 1.7.0 or later · < 1.7.0 · CVE-2025-13523 · GHSA-ffx7-34p2-vm3w
- High, CVSS 7.2
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update
Go gogs.io/gogs · Upgrade to 0.13.4 or later · <= 0.13.3 · CVE-2026-24135 · GHSA-jp7c-wj6q-3qf2
- High, CVSS 7.7
Gogs Vulnerable to 2FA Bypass via Recovery Code
Go gogs.io/gogs · Upgrade to 0.13.4 or later · >= 0.11.19, <= 0.13.3 · CVE-2025-64175 · GHSA-p6x6-9mx6-26wj
- Critical, CVSS 9.3
Gogs's update .git/config file allows remote command execution
Go gogs.io/gogs · Upgrade to 0.13.4 or later · <= 0.13.3 · CVE-2025-64111 · GHSA-gg64-xxr9-qhjp
- Critical, CVSS 10.0
@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses
npm @nyariv/sandboxjs · Upgrade to 0.8.29 or later · <= 0.8.28 · CVE-2026-25641 · GHSA-7x3h-rm86-3342 · amended
- High, CVSS 8.2
OpenCloud Affected by Public Link Exploit
Go github.com/opencloud-eu/opencloud · Upgrade to 5.0.2 or 4.0.3 by release line · >= 4.0.0, < 4.0.3; >= 5.0.0, < 5.0.2 · GHSA-vf5j-r2hw-2hrw
- High, CVSS 8.5
qdrant has arbitrary file write via
/loggerendpointcrates.io qdrant · Upgrade to 1.15.6 or later · >= 1.9.3, < 1.15.6 · CVE-2026-25628 · GHSA-f632-vm87-2m2f
- High, CVSS 7.7
Unauthenticated Spree Commerce users can access all guest addresses
RubyGems spree_api · Upgrade to 5.3.2, 5.2.7, 5.1.10 or 2 more by release line · < 4.10.3; >= 5.0.0, < 5.0.8; >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.7; >= 5.3.0, < 5.3.2 · CVE-2026-25758 · GHSA-87fh-rc96-6fr6
- High, CVSS 7.7
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
RubyGems spree_storefront · Upgrade to 5.3.2, 5.2.7, 5.1.10 or 5.0.8 by release line · < 5.0.8; >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.7; >= 5.3.0, < 5.3.2 · CVE-2026-25757 · GHSA-p6pv-q7rc-g4h9
- High, CVSS 7.5
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
PyPI nicegui · Upgrade to 3.7.0 or later · <= 3.6.1 · CVE-2026-25732 · GHSA-9ffm-fxg3-xrhh · amended
- Critical, CVSS 10.0
@nyariv/sandboxjs has a Sandbox Escape vulnerability
npm @nyariv/sandboxjs · Upgrade to 0.8.29 or later · <= 0.8.28 · CVE-2026-25587 · GHSA-66h4-qj4x-38xp · amended
- Critical, CVSS 10.0
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
npm @nyariv/sandboxjs · Upgrade to 0.8.29 or later · <= 0.8.28 · CVE-2026-25586 · GHSA-jjpw-65fv-8g48 · amended
- Critical, CVSS 9.8
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
npm @payloadcms/drizzle · Upgrade to 3.73.0 or later · < 3.73.0 · CVE-2026-25544 · GHSA-xx6w-jxg9-2wh8 · amended
- Critical, CVSS 10.0
@nyariv/sandboxjs has a Sandbox Escape issue
npm @nyariv/sandboxjs · Upgrade to 0.8.29 or later · <= 0.8.28 · CVE-2026-25520 · GHSA-58jh-xv4v-pcx4 · amended
- High, CVSS 8.2
OpenCloud Reva has a Public Link Exploit
Go github.com/opencloud-eu/reva/v2 · Upgrade to 2.42.3 or 2.40.3 by release line · <= 2.40.1; >= 2.41.0, < 2.42.3 · CVE-2026-23989 · GHSA-9j2f-3rj3-wgpg
- High, CVSS 7.4
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
PyPI pgadmin4 · Upgrade to 9.12 or later · < 9.12 · CVE-2026-1707 · GHSA-3p7x-94q9-jq9x · amended
- Critical, CVSS 9.8
FrankenPHP has delayed propagation of security fixes in upstream base images
Go github.com/dunglas/frankenphp · Upgrade to 1.1.11 or later · < 1.1.11 · GHSA-x9p2-77v6-6vhf
- Critical, CVSS 9.3
FUXA Unauthenticated Remote Arbitrary Device Tag Write
npm fuxa-server · Upgrade to 1.2.10 or later · <= 1.2.9 · CVE-2026-25752 · GHSA-ggxw-g3cp-mgf8 · amended
- Critical, CVSS 9.5
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
npm fuxa-server · Upgrade to 1.2.10 or later · <= 1.2.9 · CVE-2026-25895 · GHSA-88qh-cphv-996c · amended
- Critical, CVSS 9.5
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
npm fuxa-server · Upgrade to 1.2.10 or later · <= 1.2.9 · CVE-2026-25894 · GHSA-32cc-x95p-fxcg · amended
- Critical, CVSS 9.1
FUXA Unauthenticated Exposure of Plaintext Database Credentials
npm fuxa-server · Upgrade to 1.2.10 or later · <= 1.2.9 · CVE-2026-25751 · GHSA-c5gq-4h56-4mmx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.