High, CVSS 7.5
protobuf.js: Denial of service through unbounded protobuf recursion
npm protobufjs · Upgrade to 8.0.2 or 7.5.6 by release line · <= 7.5.5; >= 8.0.0, <= 8.0.1 · CVE-2026-44289 · GHSA-685m-2w69-288q · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6526–6550 of 30,985 matching · newest first
- Medium, CVSS 5.3
protobufjs has overlong UTF-8 decoding
npm protobufjs · Upgrade to 8.0.2 or 7.5.6 by release line · <= 7.5.5; >= 8.0.0, <= 8.0.1 · +1 more package · CVE-2026-44288 · GHSA-q6x5-8v7m-xcrf · amended
- High, CVSS 7.8
protobuf.js is Vulnerable to OS Command Injection in the CLI
npm protobufjs-cli · Upgrade to 2.0.2 or 1.2.1 by release line · <= 1.2.0; >= 2.0.0, <= 2.0.1 · CVE-2026-42290 · GHSA-f84p-cvgm-xgjj · amended
- High, CVSS 7.5
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
Maven org.springframework.ai:spring-ai-model +2 · Upgrade all 3 to 2.0.0-M6 (pre-release), 1.1.6 or 1.0.7 by release line · < 1.0.7; >= 1.1.0-M1, < 1.1.6; >= 2.0.0-M1, < 2.0.0-M6 · CVE-2026-41712 · GHSA-q62f-h9x2-gcqc
- High, CVSS 8.2
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
Maven org.springframework.ai:spring-ai-client-chat · Upgrade to 1.1.6 or 1.0.7 by release line · < 1.0.7; >= 1.1.0-M1, < 1.1.6 · CVE-2026-41713 · GHSA-5852-phmh-8fhr
- Unrated
Signed integer overflow in metaphone()
Bitnami php +2 · Upgrade all 3 to 8.5.6, 8.4.21, 8.3.31 or 8.2.31 by release line · >= 8.2.0, < 8.2.31; >= 8.3.0, < 8.3.31; >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-7568 · GHSA-96wq-48vp-hh57 · amended
- Unrated
DoS attack via DOMNode::C14N()
Bitnami php +2 · Upgrade all 3 to 8.5.6 or 8.4.21 by release line · >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-7263 · GHSA-4jhr-8w89-j733 · amended
- Unrated
NULL pointer dereference in SOAP apache:Map decoder with missing
Bitnami php +2 · Upgrade all 3 to 8.5.6, 8.4.21, 8.3.31 or 8.2.31 by release line · >= 8.2.0, < 8.2.31; >= 8.3.0, < 8.3.31; >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-7262 · GHSA-hmxp-6pc4-f3vv · amended
- Unrated
SoapServer session-persisted object use-after-free via SOAP header fault
Bitnami php +2 · Upgrade all 3 to 8.5.6, 8.4.21, 8.3.31 or 8.2.31 by release line · >= 8.2.0, < 8.2.31; >= 8.3.0, < 8.3.31; >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-7261 · GHSA-m33r-qmcv-p97q · amended
- Unrated
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
Bitnami php +2 · Upgrade all 3 to 8.5.6, 8.4.21, 8.3.31 or 8.2.31 by release line · >= 8.2.0, < 8.2.31; >= 8.3.0, < 8.3.31; >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-7259 · GHSA-wm6j-2649-pv75 · amended
- High, CVSS 7.3
XSS within PHP-FPM status endpoint
Bitnami php +2 · Upgrade all 3 to 8.5.6, 8.4.21, 8.3.31 or 8.2.31 by release line · >= 8.2.0, < 8.2.31; >= 8.3.0, < 8.3.31; >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-6735 · GHSA-7qg2-v9fj-4mwv · amended
- Critical, CVSS 9.5
Use-After-Free in SOAP using Apache map
Bitnami php +2 · Upgrade all 3 to 8.5.6, 8.4.21, 8.3.31 or 8.2.31 by release line · >= 8.2.0, < 8.2.31; >= 8.3.0, < 8.3.31; >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-6722 · GHSA-85c2-q967-79q5 · amended
- Unrated
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Bitnami php +2 · Upgrade all 3 to 8.5.6 or 8.4.21 by release line · >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2026-6104 · GHSA-74r9-qxhc-fx53 · amended
- Unrated
SQL injection in pdo_firebird via NUL bytes in quoted strings
Bitnami php +2 · Upgrade all 3 to 8.5.6, 8.4.21, 8.3.31 or 8.2.31 by release line · >= 8.2.0, < 8.2.31; >= 8.3.0, < 8.3.31; >= 8.4.0, < 8.4.21; >= 8.5.0, < 8.5.6 · CVE-2025-14179 · GHSA-w476-322c-wpvm · amended
- Critical, CVSS 9.6Exploited · CISA KEV
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
npm @tanstack/start-storage-context · Upgrade to 1.166.42 or later · >= 1.166.38, <= 1.166.38; >= 1.166.41, <= 1.166.41 · +41 more packages · CVE-2026-45321 · GHSA-g7cv-rxg3-hmpx · amended
- High, CVSS 7.5
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
PyPI mlflow · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-2614 · GHSA-42h5-h8qh-vv9v · amended
- Medium, CVSS 6.9
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json
npm @steipete/summarize · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2026-45222 · GHSA-qp7v-gjgg-4mj6 · amended
- Medium, CVSS 6.8
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution
Go github.com/openclaw/crabbox · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2026-45224 · GHSA-3cjv-h753-qf7h
- Medium, CVSS 5.5
Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content
Go github.com/safedep/gryph · Upgrade to 0.7.0 or later · <= 0.6.0 · CVE-2026-45046 · GHSA-f3jg-756w-gm35
- High, CVSS 7.5
MantisBT Vulnerable to Stored XSS in File Download
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · <= 2.28.1 · CVE-2026-44657 · GHSA-p6fr-rxq7-xcg8
- High, CVSS 8.6
MantisBT has Stored XSS on Move Attachments Admin Page
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · >= 1.3.0, <= 2.28.1 · CVE-2026-44655 · GHSA-7mqj-8gj2-cg59
- High, CVSS 7.5
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in
JSONPathBuilder.key()/.at()npm kysely · Upgrade to 0.28.17 or later · >= 0.26.0, < 0.28.17 · CVE-2026-44635 · GHSA-pv5w-4p9q-p3v2 · amended
- Medium, CVSS 5.0
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (
pdf_service.py:_markdown_to_html)PyPI local-deep-research · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-43979 · GHSA-fj2m-qvh9-jq4q · amended
- Critical, CVSS 10.0
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
npm @nyariv/sandboxjs · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-43898 · GHSA-g8f2-4f4f-5jqw · amended
- High, CVSS 7.2
MantisBT has a Private Bugnote Attachment Content Leak via REST API
Packagist mantisbt/mantisbt · Upgrade to 2.28.2 or later · >= 2.23.0, <= 2.28.1 · CVE-2026-42071 · GHSA-pw5x-2mf9-3xc8
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.