Critical, CVSS 10.0
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
npm fuxa-server · Upgrade to 1.2.10 or later · <= 1.2.9 · CVE-2026-25893 · GHSA-vwcg-c828-9822 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 10.0
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
PyPI epyt-flow · Upgrade to 0.16.1 or later · < 0.16.1 · CVE-2026-25632 · GHSA-74vm-8frp-7w68 · amended
- High, CVSS 7.1
openmls has improper tag validation
crates.io openmls · Upgrade to 0.7.2 or later · < 0.7.2 · GHSA-8x3w-qj7j-gqhf
- Critical, CVSS 9.9
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
Go github.com/rancher/local-path-provisioner · Upgrade to 0.0.34 or later · < 0.0.34 · CVE-2025-62878 · GHSA-jr3w-9vfr-c746
- Critical, CVSS 9.2
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
npm survey-pdf · Upgrade to 2.5.5 or 1.12.59 by release line · <= 1.12.58; >= 2.0.0, <= 2.5.4 · CVE-2026-25630 · GHSA-h3q6-jfrg-3x6q · amended
- High, CVSS 8.4
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply
npm openclaw · Upgrade to 2026.1.20 or later · < 2026.1.20 · CVE-2026-25593 · GHSA-g55j-c2v4-pjcg · amended
- High, CVSS 7.1
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
npm @modelcontextprotocol/sdk · Upgrade to 1.26.0 or later · >= 1.10.0, <= 1.25.3 · CVE-2026-25536 · GHSA-345p-7cg4-v4c7 · amended
- High, CVSS 7.8
godot-mcp has Command Injection via unsanitized projectPath
npm @coding-solo/godot-mcp · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-25546 · GHSA-8jx2-rhfh-q928 · amended
- Critical, CVSS 9.4
n8n has a Python sandbox escape
npm n8n · Upgrade to 2.4.8 or later · < 2.4.8 · CVE-2026-25115 · GHSA-8398-gmmx-564h · amended
- Critical, CVSS 9.4
n8n Merge Node has Arbitrary File Write leading to RCE
npm n8n · Upgrade to 2.4.0 or 1.118.0 by release line · < 1.118.0; >= 2.0.0, < 2.4.0 · CVE-2026-25056 · GHSA-hv53-3329-vmrm · amended
- High, CVSS 7.1
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
npm n8n · Upgrade to 2.4.0 or 1.123.12 by release line · >= 2.0.0, < 2.4.0; < 1.123.12 · CVE-2026-25055 · GHSA-m82q-59gv-mcr9 · amended
- High, CVSS 8.5
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
npm n8n · Upgrade to 2.2.1 or 1.123.9 by release line · >= 2.0.0, < 2.2.1; < 1.123.9 · CVE-2026-25054 · GHSA-qpq4-pw7f-pp8w · amended
- High, CVSS 8.8
Alist vulnerable to Path Traversal in multiple file operation handlers
Go github.com/alist-org/alist/v3 · Upgrade to 3.57.0 or later · < 3.57.0 · CVE-2026-25161 · GHSA-x4q4-7phh-42j9
- Critical, CVSS 9.1
Alist has Insecure TLS Config
Go github.com/alist-org/alist/v3 · Upgrade to 3.57.0 or later · < 3.57.0 · CVE-2026-25160 · GHSA-8jmm-3xwx-w974
- Critical, CVSS 9.4
n8n has OS Command Injection in Git Node
npm n8n · Upgrade to 2.5.0 or 1.123.10 by release line · >= 2.0.0, < 2.5.0; < 1.123.10 · CVE-2026-25053 · GHSA-9g95-qf3f-ggrw · amended
- Critical, CVSS 9.4
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
npm n8n · Upgrade to 2.5.0 or 1.123.18 by release line · >= 2.0.0, < 2.5.0; < 1.123.18 · CVE-2026-25052 · GHSA-gfvg-qv54-r4pc · amended
- High, CVSS 8.5
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
npm n8n · Upgrade to 1.123.2 or 1.122.5 by release line · >= 1.123.0, < 1.123.2; < 1.122.5 · CVE-2026-25051 · GHSA-825q-w924-xhgx · amended
- Critical, CVSS 9.4
n8n Has Expression Escape Vulnerability Leading to RCE
npm n8n · Upgrade to 2.5.2 or 1.123.17 by release line · < 1.123.17; >= 2.0.0, < 2.5.2 · CVE-2026-25049 · GHSA-6cqr-8cfr-67f8 · amended
- Critical, CVSS 9.4
n8n Vulnerable to Command Injection in Community Package Installation
npm n8n · Upgrade to 1.120.3 or later · >= 0.187.0, < 1.120.3 · CVE-2026-21893 · GHSA-7c4h-vh2m-743m · amended
- High, CVSS 7.7
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
npm n8n · Upgrade to 1.114.3 or later · >= 1.65.0, < 1.114.3 · CVE-2025-61917 · GHSA-49mx-fj45-q3p6 · amended
- High, CVSS 8.8
ingress-nginx's
nginx.ingress.kubernetes.io/auth-methodIngress annotation can be used to inject configuration into nginxGo k8s.io/ingress-nginx · Upgrade to 1.14.3 or 1.13.7 by release line · < 1.13.7; >= 1.14.0, < 1.14.3 · CVE-2026-1580 · GHSA-9h3p-52vh-959w
- High, CVSS 8.8
ingress-nginx's
rules.http.paths.pathIngress field can be used to inject configuration into nginxGo k8s.io/ingress-nginx · Upgrade to 1.14.3 or 1.13.7 by release line · < 1.13.7; >= 1.14.0, < 1.14.3 · CVE-2026-24512 · GHSA-jx8c-56mg-h6vp
- Critical, CVSS 9.2
Navidrome affected by Denial of Service and disk exhaustion via oversized
sizeparameter in/rest/getCoverArtand/share/img/endpointsGo github.com/navidrome/navidrome · Upgrade to 0.60.0 or later · < 0.60.0 · CVE-2026-25579 · GHSA-hrr4-3wgr-68x3
- High, CVSS 7.8
melange affected by potential host command execution via license-check YAML mode patch pipeline
Go chainguard.dev/melange · Upgrade to 0.40.3 or later · >= 0.10.0, < 0.40.3 · CVE-2026-25143 · GHSA-rf4g-89h5-crcr
- High, CVSS 7.5
apko has a path traversal in apko dirFS which allows filesystem writes outside base
Go chainguard.dev/apko · Upgrade to 1.1.0 or later · >= 0.14.8, < 1.1.0 · CVE-2026-25121 · GHSA-5g94-c2wx-8pxw
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.