High, CVSS 8.1
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
Go github.com/dunglas/frankenphp · Upgrade to 1.12.3 or later · >= 1.11.2, <= 1.12.2 · CVE-2026-45062 · GHSA-3g8v-8r37-cgjm
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6351–6375 of 30,985 matching · newest first
- High, CVSS 7.5
Pipecat: Path Traversal in Pipecat Runner
/filesEndpoint — Arbitrary File Read via%2F-Encoded SeparatorPyPI pipecat-ai · Upgrade to 1.2.0 or later · >= 0.0.90, < 1.2.0 · CVE-2026-44716 · GHSA-3363-2ph6-35wh · amended
- High, CVSS 8.2
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
npm @joplin/onenote-converter · Upgrade to 3.5.7 or later · < 3.5.7 · CVE-2026-22810 · GHSA-gcmj-c9gg-9vh6 · amended
- High, CVSS 8.7
smtp-server's command parser memory exhaustion denial-of-service
npm smtp-server · Upgrade to 3.18.3 or later · < 3.18.3 · CVE-2026-38728 · GHSA-fv2f-rw9f-v9cm · amended
- High, CVSS 8.6
MLflow: unauthenticated access to certain FastAPI routes
PyPI mlflow · Upgrade to 3.11.0 or later · < 3.11.0 · CVE-2026-2652 · GHSA-75cm-x2w3-8mgf · amended
- Critical, CVSS 9.3
Crabbox: environment variable exposure vulnerability
Go github.com/openclaw/crabbox · Upgrade to 0.12.0 or later · < 0.12.0 · CVE-2026-8634 · GHSA-fm77-94qm-4894
- High, CVSS 8.7
Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers
Go github.com/openclaw/crabbox · Upgrade to 0.12.0 or later · < 0.12.0 · CVE-2026-8621 · GHSA-4g9m-rffv-h6wq
- Critical, CVSS 9.8
vm2 Has a Sandbox Breakout Using Async Generator
npm vm2 · Upgrade to 3.11.3 or later · <= 3.11.2 · CVE-2026-45411 · GHSA-248r-7h7q-cr24 · amended
- High, CVSS 7.7
python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
PyPI utcp-cli · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-45370 · GHSA-5v57-8rxj-3p2r · amended
- Critical, CVSS 10.0
utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
PyPI utcp-cli · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-45369 · GHSA-33p6-5jxp-p3x4 · amended
- High, CVSS 8.2
@ranfdev/deepobj has a Prototype Pollution vulnerability
npm @ranfdev/deepobj · Upgrade to 1.0.3 or later · <= 1.0.2 · CVE-2026-46509 · GHSA-x7q7-fchv-8h2j · amended
- Medium, CVSS 4.7
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
npm @utcp/http · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-45366 · GHSA-r8j5-8747-88cm · amended
- Medium, CVSS 4.8
slack-go
SecretsVerifieraccepts empty signing secret without preconditionGo github.com/slack-go/slack · Upgrade to 0.23.1 or later · < 0.23.1 · GHSA-gxhx-2686-5h9g
- Critical, CVSS 9.8
Marten has an injection vulnerability in its full-text search regConfig parameter
NuGet marten · Upgrade to 8.37.0 or later · <= 8.36 · CVE-2026-45288 · GHSA-vmw2-qwm8-x84c
- Critical, CVSS 9.1
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
npm @samanhappy/mcphub · Upgrade to 0.12.15 or later · < 0.12.15 · GHSA-wf8q-wvv8-p8jf · amended
- Medium, CVSS 5.3
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
npm svelte · Upgrade to 5.55.7 or later · >= 5.46.0, <= 5.55.6 · GHSA-f3cj-j4f6-wq85 · amended
- Medium, CVSS 6.0
electerm's encrypt method not safe enough
npm electerm · Upgrade to 3.9.5 or later · < 3.9.5 · CVE-2026-45787 · GHSA-g29v-q6h7-76wh · amended
- Critical, CVSS 9.3
Electerm Local code through electerm's single-instance socket
npm electerm · Upgrade to 3.9.0 or later · >= 3.0.6, <= 3.8.8 · CVE-2026-45353 · GHSA-7p5m-v798-f8vv · amended
- Critical, CVSS 9.6
DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files
crates.io deepseek-tui · Upgrade to 0.8.26 or later · < 0.8.26 · CVE-2026-45374 · GHSA-72w5-pf8h-xfp4
- High, CVSS 7.4
DeepSeek TUI has SSRF IPV6 bypass
crates.io deepseek-tui · Upgrade to 0.8.26 or later · < 0.8.26 · CVE-2026-45373 · GHSA-88gh-2526-gfrr
- Critical, CVSS 9.6
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
npm deepseek-tui +2 · Upgrade all 3 to 0.8.23 or later · >= 0.3.0, < 0.8.23 · CVE-2026-45311 · GHSA-wx44-2q6h-j6p8 · amended
- High, CVSS 7.4
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
npm deepseek-tui +2 · Upgrade all 3 to 0.8.22 or later · < 0.8.22 · CVE-2026-45310 · GHSA-96ff-gc8g-wpvg · amended
- Medium, CVSS 5.3
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
npm svelte · Upgrade to 5.55.7 or later · <= 5.55.6 · CVE-2026-42573 · GHSA-rcqx-6q8c-2c42 · amended
- Medium, CVSS 5.9
Svelte: ReDoS in
npm svelte · Upgrade to 5.55.7 or later · >= 5.51.5, <= 5.55.6 · CVE-2026-42567 · GHSA-9rmh-mm8f-r9h6 · amended
- High, CVSS 8.1
Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
PyPI open-webui · Upgrade to 0.9.0 or later · <= 0.8.12 · CVE-2026-45675 · GHSA-h3ww-q6xx-w7x3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.