High, CVSS 8.7
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy
npm axios · Upgrade to 1.16.0 or later · >= 1.0.0, < 1.16.0 · CVE-2026-44494 · GHSA-35jp-ww65-95wh · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5826–5850 of 30,985 matching · newest first
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in
- High, CVSS 8.6
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · <= 0.31.1; >= 1.15.0, < 1.16.0 · CVE-2026-44492 · GHSA-pjwm-pj3p-43mv · amended
- Medium, CVSS 4.8
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44490 · GHSA-898c-q2cr-xwhg · amended
- Low, CVSS 3.7
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
npm axios · Upgrade to 1.16.0 or later · >= 1.15.2, <= 1.15.2 · CVE-2026-44489 · GHSA-654m-c8p4-x5fp · amended
- High, CVSS 8.6
Froxlor has an incomplete fix for CVE-2026-30932
Packagist froxlor/froxlor · Upgrade to 2.3.7 or later · <= 2.3.6 · CVE-2026-41237 · GHSA-j6fm-9rfm-j5hx
- High, CVSS 8.8
Froxlor has privilege escalation in SSH key synchronization via symlinked
authorized_keyspathPackagist froxlor/froxlor · Upgrade to 2.3.7 or later · >= 2.3.6, <= 2.3.6 · CVE-2026-41236 · GHSA-mq5v-pxpm-8jw2
- High, CVSS 8.6
Froxlor has an authorization bypass in FTP shell assignment via missing server-side
available_shellsenforcementPackagist froxlor/froxlor · Upgrade to 2.3.7 or later · >= 2.3.6, <= 2.3.6 · CVE-2026-41235 · GHSA-gcv3-5v9q-fmhh
- High, CVSS 7.4
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via
gh attestation,gh release verify, andgh release verify-assetcommandsGo github.com/cli/cli/v2 · Upgrade to 2.93.0 or later · <= 2.92.0 · CVE-2026-48501 · GHSA-8xvp-7hj6-mcj9
- High, CVSS 8.7
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
npm @haxtheweb/haxcms-nodejs · Upgrade to 26.0.1 or later · <= 26.0.0 · CVE-2026-48527 · GHSA-g2g8-95qg-v35h · amended
- Medium, CVSS 5.3
OpenStack Neutron has an Incorrect Authorization issue
PyPI neutron · Upgrade to 28.0.1, 27.0.3 or 26.0.4 by release line · >= 28.0.0, < 28.0.1; >= 27.0.0, < 27.0.3; >= 26.0.0, < 26.0.4 · CVE-2026-49299 · GHSA-xv24-hxh9-2hh9 · amended
- Medium, CVSS 4.0
tuf has platform-dependent delegation path matching
PyPI tuf · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-123806 · GHSA-qp9x-wp8f-qgjj · amended
- High, CVSS 7.7
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.4 or later · <= 1.19.3 · CVE-2026-47179 · GHSA-c3px-h233-h6fq
- High, CVSS 7.7
Dulwich Vulnerable to Command Injection via Merge Driver Path
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.24.0, < 1.2.5 · CVE-2026-42563 · GHSA-9277-mp7x-85jf · amended
- High, CVSS 8.8
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
PyPI dulwich · Upgrade to 1.2.5 or later · >= 0.10.0, < 1.2.5 · CVE-2026-42305 · GHSA-897w-fcg9-f6xj · amended
- Medium, CVSS 6.0
OpenStack Keystone has an Incorrect Authorization issue
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-43000 · GHSA-q623-f4j4-p4xj · amended
- Medium, CVSS 6.0
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-42998 · GHSA-8f8m-wrvr-wcvf · amended
- Medium, CVSS 6.0
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-44394 · GHSA-whqr-fgm5-x77q · amended
- Medium, CVSS 6.0
OpenStack Keystone has an Authorization Bypass
PyPI keystone · Upgrade to 29.0.2, 28.0.2 or 27.0.2 by release line · >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2 · CVE-2026-42999 · GHSA-2r23-2g6v-2m5f · amended
- High, CVSS 7.0
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; <= 11.5.16; >= 2026.1.0, < 2026.1.3 · CVE-2026-5394 · GHSA-r2f4-ff2p-xc64
- Medium, CVSS 5.5
FUXA provides guest and invalid-token access to protected read APIs in secure mode
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0-2773, <= 1.3.0-2773 · CVE-2026-47718 · GHSA-r9g5-7q8j-958c · amended
- Medium, CVSS 5.5
Shamefile has an arbitrary file read via shamefile.yaml in shame next
PyPI shamefile +2 · Upgrade all 3 to 0.1.7 or later · <= 0.1.6 · CVE-2026-47144 · GHSA-x6p3-76f2-xxvh · amended
- Medium, CVSS 6.1
nono: Sandbox escape on Linux via D-Bus:
systemd-run --usercrates.io nono-cli · Upgrade to 0.55.0 or later · < 0.55.0 · CVE-2026-47128 · GHSA-27vp-2mmc-vmh3
- Low, CVSS 2.7
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Packagist symfony/polyfill-intl-idn +1 · Upgrade all 2 to 1.38.1 or later · >= 1.17.1, < 1.38.1 · CVE-2026-46644 · GHSA-2xf4-cg6j-vhgq
- Medium, CVSS 5.0
local-deep-research has an SSRF bypass in
safe_getPyPI local-deep-research · Upgrade to 1.6.10 or later · < 1.6.10 · CVE-2026-46526 · GHSA-g23j-2vwm-5c25 · amended
- High, CVSS 7.8
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
PyPI compliance-trestle · Upgrade to 4.0.3 or 3.12.2 by release line · <= 3.12.1; >= 4.0.0, < 4.0.3 · CVE-2026-46439 · GHSA-gg2g-p7xc-qqmm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.