Medium, CVSS 5.3
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
npm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42034 · GHSA-5c9x-8gcm-mpgx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 975 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7076–7100 of 30,988 matching · newest first
- High, CVSS 7.5
Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes
Go github.com/hashicorp/boundary · Upgrade to 0.21.3, 0.20.3 or 0.19.5 by release line · < 0.19.5; >= 0.20.0, < 0.20.3; >= 0.21.0, < 0.21.3 · CVE-2026-7776 · GHSA-7x9r-wcgg-w86f
- Medium, CVSS 5.3
Axios: HTTP adapter streamed responses bypass maxContentLength
npm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42036 · GHSA-vf2m-468p-8v99 · amended
- High, CVSS 7.4
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
npm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42033 · GHSA-pf86-5x62-jrwf · amended
- High, CVSS 7.4
Axios: Header Injection via Prototype Pollution
npm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42035 · GHSA-6chq-wfr3-2hj9 · amended
- Medium, CVSS 5.4
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in
withXSRFTokenBoolean Coercionnpm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42042 · GHSA-xx6v-rp6x-q39c · amended
- Medium, CVSS 4.8
Axios: Authentication Bypass via Prototype Pollution Gadget in
validateStatusMerge Strategynpm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42041 · GHSA-w9j2-pvgh-6h63 · amended
- High, CVSS 7.2
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
npm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7 · amended
- Medium, CVSS 6.5
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in
parseRevivernpm axios · Upgrade to 1.15.2 or later · >= 1.0.0, < 1.15.2 · CVE-2026-42044 · GHSA-3w6x-2g7m-8v23 · amended
- High, CVSS 7.4
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
npm axios · Upgrade to 1.15.2 or later · >= 1.0.0, < 1.15.2 · CVE-2026-42264 · GHSA-q8qp-cvcw-x6jj · amended
- Low, CVSS 3.7
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
npm axios · Upgrade to 1.15.1 or 0.31.1 by release line · >= 1.0.0, < 1.15.1; <= 0.31.0 · CVE-2026-42040 · GHSA-xhjh-pmcv-23jw · amended
- Unrated
ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key
PyPI ogham-mcp · Upgrade to 0.11.1 or later · >= 0.6.3, < 0.11.1 · GHSA-8pqq-224h-x875 · amended
- Low, CVSS 1.8
sequoia-git has broken hard revocation handling
crates.io sequoia-git · Upgrade to 0.6.0 or later · < 0.6.0 · GHSA-g27r-r6ph-vf5r
- High, CVSS 7.5
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
Packagist webonyx/graphql-php · Upgrade to 15.32.2 or later · < 15.32.2 · GHSA-fc86-6rv6-2jpm
- High, CVSS 7.1
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler
Packagist mckenziearts/livewire-markdown-editor · Upgrade to 1.3 or later · < 1.3 · GHSA-gxxh-8vcj-w2mh
- High, CVSS 8.3
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted
proxy.*config (incomplete fix for CVE-2026-33509 / -35463 / -35464 /…PyPI pyload-ng · Upgrade to 0.5.0b3.dev100 (pre-release) or later · <= 0.5.0b3.dev99 · CVE-2026-42313 · GHSA-pg67-9wjv-mr85 · amended
- Medium, CVSS 6.8
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted
ssl_verifyconfig (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)PyPI pyload-ng · Upgrade to 0.5.0b3.dev100 (pre-release) or later · <= 0.5.0b3.dev99 · CVE-2026-42312 · GHSA-ccxc-x975-4hh9 · amended
- Medium, CVSS 5.8
net-imap vulnerable to command Injection via "raw" arguments to multiple commands
RubyGems net-imap · Upgrade to 0.6.4, 0.5.14 or 0.4.24 by release line · >= 0.6.0, <= 0.6.3; >= 0.5.0, <= 0.5.13; <= 0.4.23 · CVE-2026-42257 · GHSA-hm49-wcqc-g2xg
- Medium, CVSS 5.8
net-imap vulnerable to command Injection via unvalidated Symbol inputs
RubyGems net-imap · Upgrade to 0.6.4, 0.5.14 or 0.4.24 by release line · >= 0.6.0, <= 0.6.3; >= 0.5.0, <= 0.5.13; <= 0.4.23 · CVE-2026-42258 · GHSA-75xq-5h9v-w6px
- Medium, CVSS 6.0
net-imap vulnerable to denial of service via high iteration count for
SCRAM-*authenticationRubyGems net-imap · Upgrade to 0.6.4, 0.5.14 or 0.4.24 by release line · >= 0.6.0, <= 0.6.3; >= 0.5.0, <= 0.5.13; >= 0.4.0, <= 0.4.23 · CVE-2026-42256 · GHSA-87pf-fpwv-p7m7
- Low, CVSS 2.3
net-imap has quadratic complexity when reading response literals
RubyGems net-imap · Upgrade to 0.6.4, 0.5.14 or 0.4.24 by release line · >= 0.6.0, <= 0.6.3; >= 0.5.0, <= 0.5.13; <= 0.4.23 · CVE-2026-42245 · GHSA-q2mw-fvj9-vvcw
- High, CVSS 7.6
net-imap vulnerable to STARTTLS stripping via invalid response timing
RubyGems net-imap · Upgrade to 0.6.4, 0.5.14, 0.4.24 or 0.3.10 by release line · >= 0.6.0, <= 0.6.3; >= 0.5.0, <= 0.5.13; >= 0.4.0, <= 0.4.23; <= 0.3.9 · CVE-2026-42246 · GHSA-vcgp-9326-pqcp
- High, CVSS 8.1
IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users
PyPI rdiffweb · Upgrade to 2.10.6 or later · < 2.10.6 · CVE-2025-67796 · GHSA-v4gp-hf5j-4566 · amended
- High, CVSS 7.5
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
Go chainguard.dev/apko · Upgrade to 1.2.7 or later · < 1.2.7 · CVE-2026-42575 · GHSA-hcwr-pq9g-rq3m
- High, CVSS 7.5
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Go chainguard.dev/apko · Upgrade to 1.2.5 or later · >= 0.14.8, < 1.2.5 · CVE-2026-42574 · GHSA-qq3r-w4hj-gjp6
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.