Medium, CVSS 4.3
n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
npm n8n-mcp · Upgrade to 2.47.13 or later · < 2.47.13 · CVE-2026-42282 · GHSA-wg4g-395p-mqv3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7376–7400 of 31,057 matching · newest first
- High, CVSS 7.8
Heimdall has an authorization bypass via path normalization mismatch
Go github.com/dadrus/heimdall · Upgrade to 0.17.14 or later · < 0.17.14 · CVE-2026-42274 · GHSA-3q34-rx83-r6mq
- High, CVSS 7.8
Heimdall: Case-sensitive host matching may lead to policy bypass
Go github.com/dadrus/heimdall · Upgrade to 0.17.14 or later · < 0.17.14 · CVE-2026-42273 · GHSA-72h4-mxfc-jx37
- High, CVSS 7.8
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
Go github.com/dadrus/heimdall · Upgrade to 0.17.14 or later · < 0.17.14 · CVE-2026-42272 · GHSA-43jv-5j4x-qv67
- High, CVSS 8.7Exploited · CISA KEV
LiteLLM: Authenticated command execution via MCP stdio test endpoints
PyPI litellm · Upgrade to 1.83.7 or later · >= 1.74.2, < 1.83.7 · CVE-2026-42271 · GHSA-v4p8-mg3p-g94g · amended
- Medium, CVSS 5.3
ShowDoc has an Injection vulnerability
Packagist showdoc/showdoc · Upgrade to 3.8.1 or later · < 3.8.1 · CVE-2026-6982 · GHSA-fm5r-cj7v-rj2c
- High, CVSS 8.2
simple-git is vulnerable to Remote Code Execution
npm simple-git · Upgrade to 3.36.0 or later · < 3.36.0 · CVE-2026-6951 · GHSA-hffm-xvc3-vprc · amended
- Critical, CVSS 9.8
electerm has Command Injection via runLinux funtion
npm electerm · Upgrade to 3.3.8 or later · < 3.3.8 · CVE-2026-41501 · GHSA-8x35-hph8-37hq · amended
- Medium, CVSS 5.1
wlc: print_html outputs API data without HTML escaping
PyPI wlc · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2026-42150 · GHSA-gx2m-mcc2-r4p3 · amended
- Medium, CVSS 5.3
gitverify has improper tag signature verification
Go github.com/supply-chain-tools/gitverify · Upgrade to 0.0.0-20260421124901-c2c60da05d5c (pre-release) or later · < 0.0.0-20260421124901-c2c60da05d5c · GHSA-h829-5cg7-6hff
- Unrated
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
npm @excalidraw/excalidraw · Upgrade to 0.18.1 or later · >= 0.18.0, <= 0.18.0 · +1 more package · GHSA-39h7-pwv7-rc3x · amended
- High, CVSS 7.7
Kyverno Controller Denial of Service via forEach Mutation Panic
Go github.com/kyverno/kyverno · Upgrade to 1.17.2 or 1.16.4 by release line · >= 1.13.0, < 1.16.4; >= 1.17.0-rc.1, < 1.17.2 · CVE-2026-41485 · GHSA-fpjq-c37h-cqcv
- High, CVSS 7.1
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
Packagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · < 4.9.0; >= 5.0.0, < 5.4.0 · CVE-2026-41325 · GHSA-6gqr-mx34-wh8r
- Critical, CVSS 10.0
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
GitHub Actions google-github-actions/run-gemini-cli · Upgrade to 0.1.22 or later · < 0.1.22 · +1 more package · CVE-2026-12537 · GHSA-wpqr-6v78-jr5g · amended
- Medium, CVSS 5.3
ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
NuGet parquetsharp · Upgrade to 23.0.0.1 or later · >= 18.1.0, < 23.0.0.1 · CVE-2026-42241 · GHSA-rrjr-v56m-ww88
- High, CVSS 7.3
TYPO3 CMS Stores Cleartext Password in User Settings Module
Packagist typo3/cms-backend · Upgrade to 14.3.0 or later · >= 14.2.0, <= 14.2.0 · CVE-2026-6553 · GHSA-xvv6-p4wf-mvx7
- High, CVSS 8.7
k8sGPT has Prompt Injection through its k8sGPT-Operator
Go github.com/k8sgpt-ai/k8sgpt · Upgrade to 0.4.32 or later · < 0.4.32 · GHSA-rp7v-4384-hfrp
- High, CVSS 7.7
Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution
npm @anthropic-ai/claude-code · Upgrade to 2.1.84 or later · >= 2.1.63, < 2.1.84 · CVE-2026-40068 · GHSA-q5hj-mxqh-vv77 · amended
- Critical, CVSS 9.8
go-zserio has Unbounded Memory Allocation for All Platforms
Go github.com/woven-planet/go-zserio · Upgrade to 0.9.1 or later · < 0.9.1 · GHSA-xhj4-g6w8-2xjw
- High, CVSS 7.5
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
Maven io.github.ndsev:zserio-runtime · Upgrade to 2.18.1 or later · <= 2.18.0 · CVE-2026-33524 · GHSA-cwq5-8pvq-j65j
- High, CVSS 7.5
rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
crates.io rustls-webpki · Upgrade to 0.104.0-alpha.7 (pre-release) or 0.103.13 by release line · < 0.103.13; >= 0.104.0-alpha.1, < 0.104.0-alpha.7 · GHSA-82j2-j2ch-gfr8
- High, CVSS 8.1
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
npm @budibase/backend-core · Upgrade to 3.35.10 or later · < 3.35.10 · CVE-2026-42239 · GHSA-4f9j-vr4p-642r · amended
- Low, CVSS 3.3
Kimai has Missing Object-Level Authorization in the Team API
Packagist kimai/kimai · Upgrade to 2.54.0 or later · < 2.54.0 · CVE-2026-41498 · GHSA-jv9x-w4gm-hwcm
- Critical, CVSS 9.3Exploited · CISA KEV
LiteLLM has SQL Injection in Proxy API key verification
PyPI litellm · Upgrade to 1.83.7 or later · >= 1.81.16, < 1.83.7 · CVE-2026-42208 · GHSA-r75f-5x8p-qvmc · amended
- High, CVSS 8.8
Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources
RubyGems avo · Upgrade to 3.31.2 or later · < 3.31.2 · CVE-2026-42205 · GHSA-qc5p-3mg5-9fh8
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.