High, CVSS 8.8
N8N's Chat Trigger component is vulnerable to XSS
npm @n8n/n8n-nodes-langchain · Upgrade to 1.107.0 or later · < 1.107.0 · CVE-2025-56265 · GHSA-v2x8-97xq-8xrr · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
CodeceptJS's incomprehensive sanitation can lead to Command Injection
npm codeceptjs · Upgrade to 3.7.5 or later · >= 3.5.0, < 3.7.5 · CVE-2025-57285 · GHSA-34w8-mcwr-vg29 · amended
- High, CVSS 7.1
Django is subject to SQL injection through its column aliases
PyPI django · Upgrade to 5.2.6, 5.1.12 or 4.2.24 by release line · < 4.2.24; >= 5.0a1, < 5.1.12; >= 5.2a1, < 5.2.6 · CVE-2025-57833 · GHSA-6w2r-r2m5-xq5w · amended
- Critical, CVSS 9.4
internetarchive Vulnerable to Directory Traversal in File.download()
PyPI internetarchive · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2025-58438 · GHSA-wx3r-v6h7-frjp · amended
- High, CVSS 8.1
Coder vulnerable to privilege escalation could lead to a cross workspace compromise
Go github.com/coder/coder/v2 · Upgrade to 2.25.2 or 2.24.4 by release line · >= 2.22.0, < 2.24.4; >= 2.25.0, < 2.25.2 · CVE-2025-58437 · GHSA-j6xf-jwrj-v5qp
- High, CVSS 7.9
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
PyPI pgadmin4 · Upgrade to 9.8 or later · < 9.8 · CVE-2025-9636 · GHSA-6859-2qxq-ffv2 · amended
- Critical, CVSS 9.3
TkEasyGUI Vulnerable to OS Command Injection
PyPI tkeasygui · Upgrade to 1.0.22 or later · < 1.0.22 · CVE-2025-55037 · GHSA-hfrj-3w3g-jv32 · amended
- High, CVSS 8.5
TkEasyGUI Affected by Uncontrolled Search Path Element Issue
PyPI tkeasygui · Upgrade to 1.0.22 or later · < 1.0.22 · CVE-2025-55671 · GHSA-ph2w-cx28-vhrq · amended
- Critical, CVSS 9.9
Argo CD's Project API Token Exposes Repository Credentials
Go github.com/argoproj/argo-cd/v2 · Upgrade to 2.14.16 or 2.13.9 by release line · >= 2.13.0, < 2.13.9; >= 2.14.0, < 2.14.16 · +1 more package · CVE-2025-55190 · GHSA-786q-9hcg-v9ff
- High, CVSS 7.2
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter
npm @astrojs/cloudflare · Upgrade to 12.6.6 or later · >= 11.0.3, < 12.6.6 · CVE-2025-58179 · GHSA-qpr4-c339-7vq8 · amended
- Critical, CVSS 9.4
Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution
PyPI usd-core · Upgrade to 25.8 or later · < 25.8 · GHSA-58p5-r2f6-g2cj · amended
- High, CVSS 7.5
Langchain Community Vulnerable to XML External Entity (XXE) Attacks
PyPI langchain-community · Upgrade to 0.3.27 or later · < 0.3.27 · CVE-2025-6984 · GHSA-pc6w-59fv-rh23 · amended
- High, CVSS 7.1
Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin
Maven com.liferay:com.liferay.portal.workflow.kaleo.forms.web · Upgrade to 5.0.29 or later · < 5.0.29 · CVE-2025-43772 · GHSA-j4fw-4mhr-hc45
- Critical, CVSS 10.0
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
PyPI deepdiff · Upgrade to 8.6.1 or later · >= 5.0.0, < 8.6.1 · CVE-2025-58367 · GHSA-mw26-5g2v-hqw3 · amended
- High, CVSS 7.5
Hono's flaw in URL path parsing could cause path confusion
npm hono · Upgrade to 4.9.6 or later · >= 4.8.0, < 4.9.6 · CVE-2025-58362 · GHSA-9hp6-4448-45g2 · amended
- High, CVSS 8.7
Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning
npm @anthropic-ai/claude-code · Upgrade to 1.0.87 or later · < 1.0.87 · GHSA-ph6w-f82w-28w6 · amended
- Critical, CVSS 9.3
XWiki configuration files can be accessed through jsx and sx endpoints
Maven org.xwiki.platform:xwiki-platform-skin-skinx · Upgrade to 16.10.7 or later · >= 4.2-milestone-2, < 16.10.7 · CVE-2025-55748 · GHSA-m63c-3rmg-r2cf
- High, CVSS 7.7
Soft Serve vulnerable to arbitrary file writing through SSH API
Go github.com/charmbracelet/soft-serve · Upgrade to 0.10.0 or later · < 0.10.0 · CVE-2025-58355 · GHSA-33pr-m977-5w97
- High, CVSS 7.5
mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool
npm mcp-markdownify-server · Upgrade to 0.0.2 or later · <= 0.0.1 · CVE-2025-58358 · GHSA-45qj-4xq3-3c45 · amended
- High, CVSS 7.8
Command Injection via sonarqube-scan-action GitHub Action
GitHub Actions sonarsource/sonarqube-scan-action · Upgrade to 5.3.1 or later · >= 4.0.0, <= 5.3.0 · CVE-2025-58178 · GHSA-f79p-9c5r-xg88
- High, CVSS 8.7
PocketMine-MP
ResourcePackDataInfoPacketamplification vulnerability due to lack of resource pack sequence status checkingPackagist pocketmine/pocketmine-mp · Upgrade to 5.32.1 or later · < 5.32.1 · GHSA-fqqv-56h5-f57g
- High, CVSS 8.1
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
PyPI esphome · Upgrade to 2025.8.1 or later · <= 2025.8.0 · CVE-2025-57808 · GHSA-mxh2-ccgj-8635 · amended
- High, CVSS 7.5
Undertow MadeYouReset HTTP/2 DDoS Vulnerability
Maven io.undertow:undertow-core · Upgrade to 2.3.20.Final or 2.2.38.Final by release line · < 2.2.38.Final; >= 2.3.0.Alpha1, < 2.3.20.Final · CVE-2025-9784 · GHSA-95h4-w6j8-2rp8
- High, CVSS 7.7
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
Go github.com/rancher/fleet · Upgrade to 0.13.1-0.20250806151509-088bcbea7edb (pre-release), 0.12.6 or 0.11.10 by release line · >= 0.13.0, < 0.13.1-0.20250806151509-088bcbea7edb; >= 0.12.0, < 0.12.6; >= 0.11.0, < 0.11.10 · CVE-2024-52284 · GHSA-6h9x-9j5v-7w9h
- High, CVSS 7.5
gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm
Go github.com/consensys/gnark · Upgrade to 0.13.0 or later · >= 0.12.0, <= 0.12.0 · CVE-2025-58157 · GHSA-9fvj-xqr2-xwg8
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.