Medium, CVSS 5.7
MCP Registry has open redirect via protocol-relative path in trailing-slash middleware
Go github.com/modelcontextprotocol/registry · Upgrade to 1.7.5 or later · >= 1.1.0, < 1.7.5 · CVE-2026-44427 · GHSA-v8vw-gw5j-w7m6
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
6726–6750 of 30,985 matching · newest first
- High, CVSS 8.3
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
npm n8n-mcp · Upgrade to 2.50.1 or later · < 2.50.1 · GHSA-8g7g-hmwm-6rv2 · amended
- High, CVSS 7.2
n8n-mcp webhook and API client paths has an authenticated SSRF
npm n8n-mcp · Upgrade to 2.50.2 or later · >= 2.18.7, < 2.50.2 · CVE-2026-44694 · GHSA-cmrh-wvq6-wm9r · amended
- Critical, CVSS 9.3
PrestaShop has a stored XSS executable in customer service view
Packagist prestashop/prestashop · Upgrade to 9.1.1 or 8.2.6 by release line · < 8.2.6; >= 9.0.0, < 9.1.1 · CVE-2026-44212 · GHSA-w9f3-qc75-qgx9
- Critical, CVSS 9.4
SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260512140701-d7b77d945e0d (pre-release) or later · <= 0.0.0-20260421031503-96dfe0bea474 · CVE-2026-44670 · GHSA-2h64-c999-c9r6
- High, CVSS 8.3
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
PyPI gmaps-mcp · Upgrade to 0.1.3 or later · <= 0.1.2 · GHSA-52cq-7v8r-62c6 · amended
- High, CVSS 8.7
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
npm fast-xml-builder · Upgrade to 1.1.7 or later · <= 1.1.6 · CVE-2026-44665 · GHSA-5wm8-gmm8-39j9 · amended
- Medium, CVSS 6.1
fast-xml-builder Comment Value regex can be bypassed
npm fast-xml-builder · Upgrade to 1.1.6 or later · >= 1.1.5, <= 1.1.5 · CVE-2026-44664 · GHSA-45c6-75p6-83cc · amended
- Medium, CVSS 5.3
vm2 has access to
VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAILnpm vm2 · Upgrade to 3.11.2 or later · < 3.11.2 · CVE-2026-92963 · GHSA-2cm2-m3w5-gp2f · amended
- Critical, CVSS 9.8
vm2 has Sandbox Breakout Through Null Proto Exception
npm vm2 · Upgrade to 3.11.2 or later · < 3.11.2 · CVE-2026-44009 · GHSA-9vg3-4rfj-wgcm · amended
- Critical, CVSS 9.8
vm2 has sandbox breakout via
neutralizeArraySpeciesBatchnpm vm2 · Upgrade to 3.11.2 or later · < 3.11.2 · CVE-2026-44008 · GHSA-9qj6-qjgg-37qq · amended
- Medium, CVSS 6.1
Devise has an Open Redirect via Unvalidated
request.referrerin Timeoutable Session Timeout HandlerRubyGems devise · Upgrade to 5.0.4 or later · <= 5.0.3 · CVE-2026-40295 · GHSA-jp94-3292-c3xv
- High, CVSS 7.5
Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
Maven org.apache.nifi:nifi-other-graph-services-nar · Upgrade to 2.9.0 or later · >= 2.0.0-M1, <= 2.8.0 · CVE-2026-39816 · GHSA-2j9m-25xv-mp6r
- High, CVSS 7.5
PYSEC-2026-37
PyPI dash-uploader · Upgrade to 0.7.0a1 (pre-release) or later · >= 0.1.0, < 0.7.0a1 · CVE-2026-38361
- Medium, CVSS 5.1
Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption
Maven org.bouncycastle:bcprov-lts8on · Upgrade to 2.73.11 or later · >= 2.73.0, <= 2.73.10 · CVE-2026-8149 · GHSA-mx76-r943-rf8g
- Medium, CVSS 6.1
Alkacon OpenCms is vulnerable to XSS via cmis-online/type
Maven org.opencms:opencms-core · Upgrade to 16.0 or later · < 16.0 · CVE-2023-42343 · GHSA-8gpv-c454-3hfc
- High, CVSS 7.3
Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information
Maven org.opencms:opencms-core · Upgrade to 10.5.1 or later · < 10.5.1 · CVE-2023-42344 · GHSA-rcc6-6q2f-m2cw
- Medium, CVSS 6.1
Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp
Maven org.opencms:opencms-core · Upgrade to 16.0 or later · < 16.0 · CVE-2023-42345 · GHSA-2887-f3v6-6rjf
- High, CVSS 7.5
Alkacon OpenCms is vulnerable to XXE when the refers to an external host
Maven org.opencms:opencms-core · Upgrade to 16.0 or later · < 16.0 · CVE-2023-42346 · GHSA-pj6p-9p8x-5mfc
- Medium, CVSS 6.3
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
PyPI openstack-cyborg · Upgrade to 16.0.1 or later · < 16.0.1 · CVE-2026-40214 · GHSA-mmpc-xjxr-5hf8 · amended
- High, CVSS 7.4
OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
PyPI openstack-cyborg · Upgrade to 16.0.1 or later · < 16.0.1 · CVE-2026-40213 · GHSA-mm7j-mhhj-hj36 · amended
- Medium, CVSS 5.1
rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
crates.io openssl · Upgrade to 0.10.79 or later · >= 0.10.0, < 0.10.79 · CVE-2026-44662 · GHSA-xv59-967r-8726 · amended
- Medium, CVSS 4.7
utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
PyPI utcp-http · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-44661 · GHSA-39j6-4867-gg4w · amended
- High, CVSS 8.7
netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables
PyPI netbox-data-flows · Upgrade to 1.5.1 or later · <= 1.5.0 · GHSA-v7qw-hx66-4w9x · amended
- High, CVSS 8.7
mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening
npm mcp-ssh-tool · Upgrade to 2.1.1 or later · <= 2.1.0 · GHSA-j7h9-2jh7-g967 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.