i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
npm i18next-http-middleware · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-42353 · GHSA-jfgf-83c5-2c4m · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
7251–7275 of 31,057 matching · newest first
npm i18next-http-middleware · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-42353 · GHSA-jfgf-83c5-2c4m · amended
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.2.1 or later · < 0.2.1 · GHSA-vjgj-42f6-7997
Go github.com/tinfoil-factory/netfoil · Upgrade to 0.2.1 or later · < 0.2.1 · GHSA-84g5-x8j3-7235
PyPI pygeoapi · Upgrade to 0.23.3 or later · >= 0.23.0, < 0.23.3 · CVE-2026-42352 · GHSA-jgvc-94c8-3chc · amended
PyPI pygeoapi · Upgrade to 0.23.3 or later · >= 0.23.0, < 0.23.3 · CVE-2026-42351 · GHSA-f6pr-83pg-ghh6 · amended
npm marked · Upgrade to 18.0.2 or later · >= 18.0.0, <= 18.0.1 · CVE-2026-41680 · GHSA-6v9c-7cg6-27q7 · amended
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41671 · GHSA-9xx5-cv6j-x533
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41670 · GHSA-p9w9-87c8-m235
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41669 · GHSA-25cw-98hg-g3cg
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41663 · GHSA-rw74-vc9h-534j
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41662 · GHSA-c7xm-r6vj-8vg6
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41661 · GHSA-gq27-fc8w-vcmp
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41660 · GHSA-rh3w-4ccx-prf9
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41659 · GHSA-68pr-7prh-mpv4
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41658 · GHSA-xqv4-xm7h-52cv
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41657 · GHSA-g8p8-94f2-28gr
name Parameter in Document Add Mode that Enables Arbitrary Server File ReadPackagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41656 · GHSA-m9h6-8pqm-xrhf
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-41655 · GHSA-m3vp-3jjm-gpmx
npm openclaw · Upgrade to 2026.4.15 or later · <= 2026.4.14 · CVE-2026-44996 · GHSA-gfg9-5357-hv4c · amended
npm openclaw · Upgrade to 2026.4.21 or later · <= 2026.4.20 · CVE-2026-44991 · GHSA-c28g-vh7m-fm7v · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4; < 1.123.32 · CVE-2026-42232 · GHSA-hqr4-h3xv-9m3r · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4 · CVE-2026-42231 · GHSA-q5f4-99jv-pgg5 · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4 · CVE-2026-42235 · GHSA-537j-gqpc-p7fq · amended
npm n8n · Upgrade to 2.17.5 or 1.123.33 by release line · >= 2.17.0, < 2.17.5; < 1.123.33 · CVE-2026-42226 · GHSA-r4v6-9fqc-w5jr · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.17.0, < 2.17.4 · CVE-2026-42234 · GHSA-44v6-jhgm-p3m4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.