High, CVSS 7.2
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
npm @playwright/mcp · Upgrade to 0.0.40 or later · < 0.0.40 · CVE-2025-9611 · GHSA-6fg3-hvw7-2fwq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 407 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.0
Bypassing Kyverno Policies via Double Policy Exceptions
Go github.com/kyverno/kyverno · Upgrade to 1.13.0 or later · >= 1.9.0, <= 1.12.7 · GHSA-gg4x-fgg2-h9w9
- Critical, CVSS 9.9
n8n Vulnerable to RCE via Arbitrary File Write
npm n8n · Upgrade to 1.121.3 or later · >= 0.123.0, < 1.121.3 · CVE-2026-21877 · GHSA-v364-rw7m-3263 · amended
- High, CVSS 7.5
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Packagist pterodactyl/panel +1 · Upgrade all 2 to 1.12.0 or later · < 1.12.0 · CVE-2025-68954 · GHSA-8c39-xppg-479c
- High, CVSS 7.5
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
PyPI aiohttp · Upgrade to 3.13.3 or later · <= 3.13.2 · CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg · amended
- High, CVSS 7.2
vega-functionsvulnerable to Cross-site Scripting viasetdatafunctionnpm vega-functions · Upgrade to 6.1.1 or later · <= 6.1.0 · CVE-2025-66648 · GHSA-m9rg-mr6g-75gm · amended
- High, CVSS 8.1
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
npm vega-selections · Upgrade to 6.1.2 or 5.6.3 by release line · < 5.6.3; >= 6.0.0, < 6.1.2 · CVE-2025-65110 · GHSA-829q-m3qg-ph8r · amended
- High, CVSS 7.9
Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
Maven io.spinnaker.clouddriver:clouddriver-artifacts · Upgrade to 2025.2.3 or 2025.1.6 by release line · < 2025.1.6; >= 2025.2.0, < 2025.2.3 · CVE-2025-61916 · GHSA-vrjc-q2fh-6x9h
- High, CVSS 8.7
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
npm @modelcontextprotocol/sdk · Upgrade to 1.25.2 or later · >= 1.3.0, < 1.25.2 · CVE-2026-0621 · GHSA-8r9q-7v3j-jr4g · amended
- High, CVSS 8.3
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
Packagist redaxo/source · Upgrade to 5.20.2 or later · <= 5.20.1 · CVE-2026-21857 · GHSA-824x-88xg-cwrv
- High, CVSS 8.6
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Packagist craftcms/cms · Upgrade to 5.8.21 or 4.16.17 by release line · >= 5.0.0-RC1, <= 5.8.20; >= 4.0.0-RC1, <= 4.16.16 · CVE-2025-68455 · GHSA-255j-qw47-wjh5
- High, CVSS 7.0
Unauthenticated Craft CMS users can trigger a database backup
Packagist craftcms/cms · Upgrade to 5.8.21 or 4.16.17 by release line · >= 5.0.0-RC1, <= 5.8.20; >= 3.0.0, <= 4.16.16 · CVE-2025-68456 · GHSA-v64r-7wg9-23pr
- Critical, CVSS 9.1
PYSEC-2026-116
PyPI pycti · Upgrade to 6.8.1 or later · < 6.8.1 · CVE-2025-61781 · GHSA-pr6m-q4g7-342c
- Critical, CVSS 9.2
jsPDF has Local File Inclusion/Path Traversal vulnerability
npm jspdf · Upgrade to 4.0.0 or later · <= 3.0.4 · CVE-2025-68428 · GHSA-f8cm-6447-x5h2 · amended
- High, CVSS 7.5
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Maven org.msgpack:msgpack-core · Upgrade to 0.9.11 or later · < 0.9.11 · CVE-2026-21452 · GHSA-cw39-r4h6-8j3x
- High, CVSS 8.8
Apache Kyuubi Server vulnerable to Path Traversal
Maven org.apache.kyuubi:kyuubi-server_2.12 · Upgrade to 1.10.3 or later · >= 1.6.0, < 1.10.3 · CVE-2025-66518 · GHSA-f8r6-6222-9pvc
- High, CVSS 7.4
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
Packagist bagisto/bagisto · Upgrade to 2.3.10 or later · < 2.3.10 · CVE-2026-21449 · GHSA-mqhg-v22x-pqj8
- High, CVSS 7.1
Bagisto has IDOR in Customer Order Reorder Functionality
Packagist bagisto/bagisto · Upgrade to 2.3.10 or later · < 2.3.10 · CVE-2026-21447 · GHSA-x5rw-qvvp-5cgm
- High, CVSS 8.9
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
Packagist bagisto/bagisto · Upgrade to 2.3.10 or later · < 2.3.10 · CVE-2026-21448 · GHSA-5j4h-4f72-qpm6
- High, CVSS 7.3
Bagisto SSTI vulnerability in type parameter can lead to RCE
Packagist bagisto/bagisto · Upgrade to 2.3.10 or later · < 2.3.10 · CVE-2026-21450 · GHSA-9hvg-qw5q-wqwp
- High, CVSS 8.8
Bagisto Missing Authentication on Installer API Endpoints
Packagist bagisto/bagisto · Upgrade to 2.3.10 or later · >= 2.3.0, < 2.3.10 · CVE-2026-21446 · GHSA-6h7w-v2xr-mqvw
- High, CVSS 8.8
Langflow Missing Authentication on Critical API Endpoints
PyPI langflow · Upgrade to 1.7.1 or later · <= 1.7.0.dev44 · +1 more package · CVE-2026-21445 · GHSA-c5cp-vx83-jhqx · amended
- Critical, CVSS 9.2
AdonisJS Path Traversal in Multipart File Handling
npm @adonisjs/bodyparser · Upgrade to 11.0.0-next.6 (pre-release) or 10.1.2 by release line · < 10.1.2; >= 11.0.0-next.0, < 11.0.0-next.6 · CVE-2026-21440 · GHSA-gvq6-hvvp-h34h · amended
- Critical, CVSS 9.1
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
npm signalk-server · Upgrade to 2.19.0 or later · < 2.19.0 · CVE-2025-68620 · GHSA-fq56-hvg6-wvm5 · amended
- High, CVSS 7.3
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
npm signalk-server · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2025-68619 · GHSA-93jc-vqqc-vvvh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.