High, CVSS 7.5
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
npm multiparty · Upgrade to 4.3.0 or later · <= 4.2.3 · CVE-2026-8161 · GHSA-qxch-whhj-8956 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6276–6300 of 30,985 matching · newest first
- Low, CVSS 2.3
Sulu: Used API Keys may be available via Admin API
Packagist sulu/sulu · Upgrade to 3.0.6 or 2.6.23 by release line · >= 3.0.0-alpha1, <= 3.0.5; <= 2.6.22 · GHSA-9m6v-8fxc-4r44
- Medium, CVSS 6.9
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
Packagist sulu/sulu · Upgrade to 3.0.6 or 2.6.23 by release line · >= 3.0.0-alpha1, <= 3.0.5; <= 2.6.22 · CVE-2026-45701 · GHSA-7fv8-6pp7-6h85
- High, CVSS 7.4
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
RubyGems jwt · Upgrade to 3.2.0 or 2.10.3 by release line · >= 3.0.0, < 3.2.0; < 2.10.3 · CVE-2026-45363 · GHSA-c32j-vqhx-rx3x
- Critical, CVSS 9.8
Formie: Pre-authenticated server-side template injection in Hidden fields
Packagist verbb/formie · Upgrade to 3.1.24 or 2.2.20 by release line · >= 3.0.0-beta.1, < 3.1.24; < 2.2.20 · CVE-2026-45697 · GHSA-x7m9-mwc2-g6w2
- High, CVSS 8.2
TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
Go github.com/DatanoiseTV/tinyice · Upgrade to 2.5.0 or later · >= 0.8.95, <= 2.4.1 · CVE-2026-45327 · GHSA-p7c4-8x34-8j8f
- High, CVSS 8.2
@tmlmobilidade/utils has prototype pollution in its setValueAtPath
npm @tmlmobilidade/utils · Upgrade to 20260509.340.15 or later · < 20260509.340.15 · CVE-2026-45325 · GHSA-cmxg-94mg-jq94
- Low, CVSS 3.5
LibreNMS: Cross-Site Scripting in ShowConfigController
Packagist librenms/librenms · Upgrade to 26.3.0 or later · >= 25.12.0, < 26.3.0 · CVE-2026-2728 · GHSA-5gm9-622f-qcg5
- High, CVSS 7.5
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
npm dynoxide +1 · Upgrade all 2 to 0.9.13 or later · >= 0.9.3, < 0.9.13 · CVE-2026-42559 · GHSA-fvh2-gm75-j4j7 · amended
- High, CVSS 8.2
parse-nested-form-data has Prototype Pollution via
__proto__in FormData field namesnpm parse-nested-form-data · Upgrade to 1.0.1 or later · <= 1.0.0 · CVE-2026-45302 · GHSA-xp7r-j8r6-j9h3 · amended
- High, CVSS 7.4
async-http-client: Cookie header not stripped on cross-origin redirect
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.10 or 2.15.0 by release line · >= 3.0.0.Beta1, < 3.0.10; >= 2.0.0, < 2.15.0 · CVE-2026-45300 · GHSA-fmxf-pm6p-7xgm
- Medium, CVSS 5.9
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
Packagist shopper/cart · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47741 · GHSA-9rh9-hf3w-9fgg
- High, CVSS 8.1
shopper/framework: Authorization bypass in multiple Livewire admin components
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47740 · GHSA-f946-9qp6-vgch
- High, CVSS 8.7
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45270 · GHSA-gqr2-7hcg-rchf
- Medium, CVSS 6.5
brace-expansion: Large numeric range defeats documented
maxDoS protectionnpm brace-expansion · Upgrade to 5.0.6 or later · >= 5.0.0, < 5.0.6 · CVE-2026-45149 · GHSA-jxxr-4gwj-5jf2 · amended
- Medium, CVSS 6.5
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45139 · GHSA-245j-xjvr-xvm5
- Medium, CVSS 5.4
CI4MS: Stored XSS in Blog Content via Broken
html_purifyValidation RulePackagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45138 · GHSA-2m69-jmvh-6chr
- High, CVSS 8.7
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-j5rm-v3vh-vx94 · amended
- High, CVSS 7.1
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-qq2p-4282-cfc5 · amended
- Medium, CVSS 6.5
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-74r7-3mjm-jc5v · amended
- Medium, CVSS 5.4
Statamic CMS: Server-Side Request Forgery via Glide
Packagist statamic/cms · Upgrade to 6.18.1 or 5.73.22 by release line · < 5.73.22; >= 6.0.0-alpha.1, < 6.18.1 · CVE-2026-45660 · GHSA-pf9c-ch8r-2958
- Medium, CVSS 5.1
ImageMagick: Heap Buffer Over-Read in IPTC encoder
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-42326 · GHSA-7wff-wpr6-vmhm
- Unrated
Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping
RubyGems faraday · Upgrade to 2.14.2 or later · >= 2.0.0, <= 2.14.1 · CVE-2026-33637 · GHSA-5rv5-xj5j-3484
- Medium, CVSS 6.9
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
npm neotoma · Upgrade to 0.11.1 or later · >= 0.6.0, < 0.11.1 · CVE-2026-45577 · GHSA-5cvp-p7p4-mcx9 · amended
- High, CVSS 8.2
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.0 or later · <= 1.18.1 · CVE-2026-45627 · GHSA-q2pj-8v84-9mh5
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.