High, CVSS 7.5
Seroval affected by Denial of Service via Deeply Nested Objects
npm seroval · Upgrade to 1.4.1 or later · <= 1.4.0 · CVE-2026-24006 · GHSA-3j22-8qj3-26mx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.4
Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass
npm @typebot.io/js · Upgrade to 0.9.15 or later · < 0.9.15 · CVE-2025-65098 · GHSA-4xc5-wfwc-jw47 · amended
- High, CVSS 8.1
Soft Serve Affected by an Authentication Bypass
Go github.com/charmbracelet/soft-serve · Upgrade to 0.11.3 or later · <= 0.11.2 · CVE-2026-24058 · GHSA-pchf-49fh-w34r
- High, CVSS 7.7
Wrangler affected by OS Command Injection in
wrangler pages deploynpm wrangler · Upgrade to 4.59.1 or 3.114.17 by release line · >= 2.0.15, < 3.114.17; >= 4.0.0, < 4.59.1 · CVE-2026-0933 · GHSA-36p8-mvp6-cv38 · amended
- High, CVSS 7.1
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
npm @backstage/backend-defaults · Upgrade to 0.14.1, 0.13.2 or 0.12.2 by release line · < 0.12.2; >= 0.13.0, < 0.13.2; >= 0.14.0, < 0.14.1 · +2 more packages · CVE-2026-24046 · GHSA-rq6q-wr2q-7pgp · amended
- High, CVSS 7.5
Seroval affected by Denial of Service via Array serialization
npm seroval · Upgrade to 1.4.1 or later · <= 1.4.0 · CVE-2026-23957 · GHSA-66fc-rw6m-c2q6 · amended
- High, CVSS 7.5
seroval affected by Denial of Service via RegExp serialization
npm seroval · Upgrade to 1.4.1 or later · >= 0.2.0, <= 1.4.0 · CVE-2026-23956 · GHSA-hx9m-jf43-8ffr · amended
- High, CVSS 8.7
@envelop/graphql-modules has a Race Condition vulnerability
npm @envelop/graphql-modules · Upgrade to 9.1.0 or later · < 9.1.0 · GHSA-h3hw-29fv-2x75 · amended
- High, CVSS 7.5
sm-crypto Affected by Signature Forgery in SM2-DSA
npm sm-crypto · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2026-23965 · GHSA-hpwg-xg7m-3p6m · amended
- High, CVSS 7.5
sm-crypto Affected by Signature Malleability in SM2-DSA
npm sm-crypto · Upgrade to 0.3.14 or later · < 0.3.14 · CVE-2026-23967 · GHSA-qv7w-v773-3xqm · amended
- Critical, CVSS 9.1
sm-crypto Affected by Private Key Recovery in SM2-PKE
npm sm-crypto · Upgrade to 0.3.14 or later · < 0.3.14 · CVE-2026-23966 · GHSA-pgx9-497m-6c4v · amended
- High, CVSS 8.8
vLLM affected by RCE via auto_map dynamic module loading during model initialization
PyPI vllm · Upgrade to 0.14.0 or later · >= 0.10.1, < 0.14.0 · CVE-2026-22807 · GHSA-2pc9-4j83-qjmr · amended
- High, CVSS 7.5
seroval Affected by Remote Code Execution via JSON Deserialization
npm seroval · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-23737 · GHSA-3rxj-6cgf-8cfw · amended
- High, CVSS 7.3
seroval Affected by Prototype Pollution via JSON Deserialization
npm seroval · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-23736 · GHSA-hj76-42vx-jwp4 · amended
- Critical, CVSS 9.8
Laravel Redis Horizontal Scaling Insecure Deserialization
Packagist laravel/reverb · Upgrade to 1.7.0 or later · < 1.7.0 · CVE-2026-23524 · GHSA-m27r-m6rx-mhm4
- High, CVSS 8.2
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
Maven org.apache.solr:solr-core · Upgrade to 9.10.1 or later · >= 5.3.0, < 9.10.1 · CVE-2026-22022 · GHSA-qr3p-2xj2-q7hq
- High, CVSS 7.1
Apache Solr: Insufficient file-access checking in standalone core-creation requests
Maven org.apache.solr:solr-core · Upgrade to 9.10.1 or later · >= 8.6.0, < 9.10.1 · CVE-2026-22444 · GHSA-vc2w-4v3p-2mqw
- High, CVSS 8.8
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
npm tar · Upgrade to 7.5.4 or later · <= 7.5.3 · CVE-2026-23950 · GHSA-r6q2-hw4h-h46w · amended
- High, CVSS 7.8
SiYuan vulnerable to Arbitrary file Read / SSRF
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260118092326-b2274baba2e1 (pre-release) or later · < 0.0.0-20260118092326-b2274baba2e1 · CVE-2026-23850 · GHSA-cv54-7wv7-qxcw
- High, CVSS 8.3
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260118092521-f8f4b517077b (pre-release) or later · < 0.0.0-20260118092521-f8f4b517077b · CVE-2026-23851 · GHSA-94c7-g2fj-7682
- Critical, CVSS 9.3
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
npm @orval/core · Upgrade to 8.0.2 or 7.19.0 by release line · >= 8.0.0-rc.0, < 8.0.2; < 7.19.0 · CVE-2026-23947 · GHSA-h526-wf6g-67jv · amended
- Critical, CVSS 9.3
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
Go github.com/fleetdm/fleet · Upgrade to 4.78.3, 4.77.1, 4.76.2 or 2 more by release line · >= 4.78.0, < 4.78.3; >= 4.77.0, < 4.77.1; >= 4.76.0, < 4.76.2; >= 4.75.0, < 4.75.2; < 4.43.5-0.20260112202845-e225ef57912c · CVE-2026-23518 · GHSA-63m5-974w-448v
- High, CVSS 7.1
Fleet has an Access Control vulnerability in debug/pprof endpoints
Go github.com/fleetdm/fleet · Upgrade to 4.78.3, 4.77.1, 4.76.2 or 4.75.2 by release line · >= 4.78.0, < 4.78.3; >= 4.77.0, < 4.77.1; >= 4.76.0, < 4.76.2; >= 4.75.0, < 4.75.2 · +1 more package · CVE-2026-23517 · GHSA-4r5r-ccr6-q6f6
- High, CVSS 7.5
ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion
PyPI chatterbot · Upgrade to 1.2.11 or later · <= 1.2.10 · CVE-2026-23842 · GHSA-v4w8-49pv-mf72 · amended
- Critical, CVSS 9.8
XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability
Maven fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2025-64087 · GHSA-r8w2-w357-9pjv
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.