High, CVSS 7.0
PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
Maven org.pac4j:pac4j-core · Upgrade to 6.4.1 or 5.7.10 by release line · < 5.7.10; >= 6.0.0-RC1, < 6.4.1 · CVE-2026-40458 · GHSA-xw5c-jc7x-gf75
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7626–7650 of 31,057 matching · newest first
- Medium, CVSS 5.1
goldmark vulnerable to Cross-site Scripting (XSS)
Go github.com/yuin/goldmark/renderer/html · Upgrade to 1.7.17 or later · < 1.7.17 · CVE-2026-5160 · GHSA-c97m-vxhj-p7j6
- Medium, CVSS 6.8
Mattermost doesn't validate CSRF tokens on an authentication endpoint
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 11.5.0, 11.4.3, 11.3.3 or 8.0.0-20260220133927-c29cf05d40f8 (pre-release) by release line · >= 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20260220133927-c29cf05d40f8; >= 11.5.0-rc1, <= 11.5.0-rc1; >= 11.4.0-rc1, < 11.4.3; >= 11.3.0-rc1, < 11.3.3 · CVE-2026-28741 · GHSA-m7cf-4gh2-v4qg
- Medium, CVSS 6.5
Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20250723052842-4cb8d8940332 (pre-release) or later · >= 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20250723052842-4cb8d8940332 · +1 more package · CVE-2026-3590 · GHSA-mh4x-rmrx-3hp4
- Low, CVSS 2.7
Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace
Go github.com/mattermost/mattermost-server · Upgrade to 8.0.0-20260316060126-bc1a2b34b1f9 (pre-release) or later · >= 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20260316060126-bc1a2b34b1f9 · CVE-2026-27769 · GHSA-mxxh-fmjq-j6x4
- Medium, CVSS 5.1
Saltcorn: Open Redirect in
POST /auth/logindue to incompleteis_relative_urlvalidation (backslash bypass)npm @saltcorn/server · Upgrade to 1.6.0-beta.5 (pre-release), 1.5.6 or 1.4.6 by release line · < 1.4.6; >= 1.5.0-beta.0, < 1.5.6; >= 1.6.0-alpha.0, < 1.6.0-beta.5 · CVE-2026-42259 · GHSA-f3g8-9xv5-77gv · amended
- Low, CVSS 3.1
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
PyPI langchain-openai · Upgrade to 1.1.14 or later · < 1.1.14 · CVE-2026-41488 · GHSA-r7w7-9xr2-qq2r · amended
- Medium, CVSS 6.5
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
PyPI langchain-text-splitters · Upgrade to 1.1.2 or later · < 1.1.2 · CVE-2026-41481 · GHSA-fv5p-p927-qmxr · amended
- Critical, CVSS 9.9
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
npm @saltcorn/server · Upgrade to 1.6.0-beta.5 (pre-release), 1.5.6 or 1.4.6 by release line · < 1.4.6; >= 1.5.0-beta.0, < 1.5.6; >= 1.6.0-alpha.0, < 1.6.0-beta.5 · CVE-2026-41478 · GHSA-jp74-mfrx-3qvh · amended
- High, CVSS 7.5
Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)
NuGet meridian.mapping +1 · Upgrade all 2 to 2.1.1 or later · >= 2.0.0, < 2.1.1 · GHSA-f5v8-v6q3-q4h6
- Critical, CVSS 9.9
Paperclip: Cross-tenant agent API key IDOR in
/agents/:id/keysroutes allows full victim-company compromisenpm @paperclipai/server · Upgrade to 2026.416.0 or later · < 2026.416.0 · GHSA-3xx2-mqjm-hg9x · amended
- Medium, CVSS 5.4
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization
npm @paperclipai/ui · Upgrade to 2026.416.0 or later · < 2026.416.0 · GHSA-fpw4-p57j-hqmq · amended
- Medium, CVSS 4.3
Paperclip: Approval decision attribution spoofing via client-controlled
decidedByUserIdin paperclip servernpm @paperclipai/server · Upgrade to 2026.416.0 or later · < 2026.416.0 · GHSA-p7mm-r948-4q3q · amended
- Critical, CVSS 9.9
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
npm @paperclipai/server · Upgrade to 2026.416.0 or later · < 2026.416.0 · GHSA-47wq-cj9q-wpmp · amended
- Critical, CVSS 9.8
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
npm @paperclipai/server · Upgrade to 2026.416.0 or later · < 2026.416.0 · CVE-2026-119713 · GHSA-vr7g-88fq-vhq3 · amended
- High, CVSS 8.3
Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode
npm @paperclipai/server · Upgrade to 2026.416.0 or later · < 2026.416.0 · GHSA-xfqj-r5qw-8g4j · amended
- High, CVSS 7.3
Paperclip: Malicious skills able to exfiltrate and destroy all user data
npm @paperclipai/server · Upgrade to 2026.416.0 or later · < 2026.416.0 · GHSA-w8hx-hqjv-vjcq · amended
- High, CVSS 8.8
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
npm @paperclipai/server · Upgrade to 2026.416.0 or later · < 2026.416.0 · CVE-2026-41208 · GHSA-265w-rf2w-cjh4 · amended
- Medium, CVSS 6.5
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath
npm @paperclipai/shared · Upgrade to 2026.416.0 or later · < 2026.416.0 · GHSA-3pw3-v88x-xj24 · amended
- High, CVSS 8.4
OAuth 2.1 Provider: Unprivileged users can register OAuth clients
npm @better-auth/oauth-provider · Upgrade to 1.6.5; some affected versions have no fix yet · >= 1.4.8-beta.7, < 1.6.5; >= 1.7.0-beta.0, <= 1.7.0-beta.1 · CVE-2026-41427 · GHSA-xr8f-h2gw-9xh6 · amended
- High, CVSS 8.8
Unsafe object property setter in mathjs
npm mathjs · Upgrade to 15.2.0 or later · >= 13.1.1, < 15.2.0 · CVE-2026-40897 · GHSA-29qv-4j9f-fjw5 · amended
- Medium, CVSS 5.4
Authlib: Cross-site request forging when using cache
PyPI authlib · Upgrade to 1.6.11 or later · < 1.6.11 · CVE-2026-41425 · GHSA-jj8c-mmj3-mmgv · amended
- High, CVSS 8.7
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
npm @angular/platform-server · Upgrade to 22.0.0-next.8 (pre-release), 21.2.9, 20.3.19 or 19.2.21 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-next.8; >= 21.0.0-next.0, < 21.2.9; >= 20.0.0-next.0, < 20.3.19; >= 19.0.0-next.0, < 19.2.21; <= 18.2.14 · CVE-2026-41423 · GHSA-45q2-gjvg-7973 · amended
- Critical, CVSS 9.4
protobufjs has an arbitrary code execution issue
npm protobufjs · Upgrade to 8.0.1, 7.5.5 or 6.11.6 by release line · >= 8.0.0, < 8.0.1; >= 7.0.0, < 7.5.5; < 6.11.6 · CVE-2026-41242 · GHSA-xq3m-2v4x-88gg · amended
- Medium, CVSS 5.3
@fastify/static vulnerable to path traversal in directory listing
npm @fastify/static · Upgrade to 9.1.1 or later · >= 8.0.0, <= 9.1.0 · CVE-2026-6410 · GHSA-pr96-94w5-mx2h · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.