High, CVSS 8.6
Prebid.js NPM package briefly compromised
npm prebid.js · Upgrade to 10.10.0 or later · >= 10.9.2, <= 10.9.2 · CVE-2025-59038 · GHSA-jwq7-6j4r-2f92 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Shopware: Reflective Cross Site-Scripting (XSS) in CMS components
Packagist shopware/shopware +1 · Upgrade all 2 to 6.7.2.1 or later · >= 6.7.0.0, < 6.7.2.1 · GHSA-9v82-vcjx-m76j
- High, CVSS 8.7
xml2rfc is vulnerable to arbitrary file reads through prepped files
PyPI xml2rfc · Upgrade to 3.30.2 or later · < 3.30.2 · CVE-2025-11059 · GHSA-9mv7-3c64-mmqw · amended
- High, CVSS 7.8
WebSocket endpoint
/api/v2/ws/logsreachable without authentication even when --auth is enabledGo github.com/SpectoLabs/hoverfly · Upgrade to 1.12.0 or later · < 1.12.0 · CVE-2025-54376 · GHSA-jxmr-2h4q-rhxp
- High, CVSS 7.0
PyInstaller has local privilege escalation vulnerability
PyPI pyinstaller · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2025-59042 · GHSA-p2xp-xx3r-mffc · amended
- High, CVSS 8.5
Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
npm @anthropic-ai/claude-code · Upgrade to 1.0.105 or later · < 1.0.105 · CVE-2025-59041 · GHSA-j4h9-wv2m-wrf7 · amended
- Critical, CVSS 9.3
Picklescan Bypass is Possible via File Extension Mismatch
PyPI picklescan · Upgrade to 0.0.31 or later · <= 0.0.30 · CVE-2025-10155 · GHSA-jgw4-cr84-mqxg · amended
- Critical, CVSS 9.3
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
PyPI picklescan · Upgrade to 0.0.31 or later · <= 0.0.30 · CVE-2025-10156 · GHSA-mjqp-26hc-grxg · amended
- Critical, CVSS 9.3
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
PyPI picklescan · Upgrade to 0.0.31 or later · <= 0.0.30 · CVE-2025-10157 · GHSA-f7qq-56ww-84cr · amended
- High, CVSS 7.1
Webrecorder packages are vulnerable to XSS through 404 error handling logic
npm @webrecorder/wabac · Upgrade to 2.23.11 or later · < 2.23.11 · +2 more packages · CVE-2025-58765 · GHSA-w765-jm6w-4hhj · amended
- High, CVSS 8.7
Claude Code rg vulnerability does not protect against approval prompt bypass
npm @anthropic-ai/claude-code · Upgrade to 1.0.105 or later · < 1.0.105 · CVE-2025-58764 · GHSA-qxfv-fcpc-w36x · amended
- High, CVSS 8.8
Monai: Unsafe use of Pickle deserialization may lead to RCE
PyPI monai · Upgrade to 1.5.1 or later · <= 1.5.0 · CVE-2025-58757 · GHSA-p8cm-mm2v-gwjm · amended
- High, CVSS 8.8
MONAI: Unsafe torch usage may lead to arbitrary code execution
PyPI monai · Upgrade to 1.5.1 or later · <= 1.5.0 · CVE-2025-58756 · GHSA-6vm5-6jv9-rjpj · amended
- High, CVSS 8.8
MONAI does not prevent path traversal, potentially leading to arbitrary file writes
PyPI monai · Upgrade to 1.5.1 or later · <= 1.5.0 · CVE-2025-58755 · GHSA-x6ww-pf9m-m73m · amended
- High, CVSS 8.7
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload
Packagist mahocommerce/maho · Upgrade to 25.9.0 or later · < 25.9.0 · CVE-2025-58449 · GHSA-vgmm-27fc-vmgp
- High, CVSS 8.7
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
npm cattown · Upgrade to 1.0.2 or later · < 1.0.2 · CVE-2025-58451 · GHSA-455v-w7r9-3vv9 · amended
- High, CVSS 7.5
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
PyPI octoprint · Upgrade to 1.11.3 or later · < 1.11.3 · CVE-2025-58180 · GHSA-49mj-x8jp-qvfc · amended
- High, CVSS 7.1
CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion
Go github.com/coredns/coredns · Upgrade to 1.12.4 or later · >= 1.2.0, < 1.12.4 · CVE-2025-58063 · GHSA-93mf-426m-g6x9
- High, CVSS 8.8
Apache DolphinScheduler vulnerable to Alert Script Attack
Maven org.apache.dolphinscheduler:dolphinscheduler · Upgrade to 3.2.2 or later · < 3.2.2 · CVE-2024-43115 · GHSA-3vcp-r62v-xpvg
- High, CVSS 8.8
toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor
crates.io toodee · Upgrade to 0.6.0 or later · >= 0.2.0, < 0.6.0 · GHSA-pfp7-vxgr-83pw
- High, CVSS 8.6
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
npm duckdb · Upgrade to 1.3.4 or later · >= 1.3.3, <= 1.3.3 · +3 more packages · CVE-2025-59037 · GHSA-w62p-hx95-gf2c · amended
- High, CVSS 8.6
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
npm @modelcontextprotocol/inspector · Upgrade to 0.16.6 or later · < 0.16.6 · CVE-2025-58444 · GHSA-g9hg-qhmf-q45m · amended
- High, CVSS 8.7
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Maven org.xwiki.contrib.blog:application-blog-ui · Upgrade to 9.14 or later · < 9.14 · CVE-2025-58365 · GHSA-gwj6-xpfg-pxwr
- High, CVSS 8.6
Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
PyPI ethyca-fides · Upgrade to 2.69.1 or later · < 2.69.1 · CVE-2025-57817 · GHSA-hjfh-p8f5-24wr · amended
- Critical, CVSS 9.3
@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through
execAPInpm @akoskm/create-mcp-server-stdio · Upgrade to 0.0.13 or later · < 0.0.13 · CVE-2025-54994 · GHSA-3ch2-jxxc-v4xf · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.