Medium, CVSS 5.9
@fastify/static vulnerable to route guard bypass via encoded path separators
npm @fastify/static · Upgrade to 9.1.1 or later · >= 8.0.0, <= 9.1.0 · CVE-2026-6414 · GHSA-x428-ghpx-8j92 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7651–7675 of 31,057 matching · newest first
- Critical, CVSS 9.1
@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
npm @fastify/middie · Upgrade to 9.3.2 or later · <= 9.3.1 · CVE-2026-6270 · GHSA-72c6-fx6q-fr5w · amended
- High, CVSS 7.4
@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
npm @fastify/middie · Upgrade to 9.3.2 or later · <= 9.3.1 · CVE-2026-33804 · GHSA-v9ww-2j6r-98q6 · amended
- High, CVSS 7.7
Flowise: resetPassword Authentication Bypass Vulnerability
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41276 · GHSA-f6hc-c5jr-878p · amended
- High, CVSS 8.7
Flowise: Cypher Injection in GraphCypherQAChain
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41274 · GHSA-28g4-38q8-3cwc · amended
- High, CVSS 7.5
Flowise: Password Reset Link Sent Over Unsecured HTTP
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41275 · GHSA-x5w6-38gp-mrqh · amended
- High, CVSS 7.7
Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41273 · GHSA-6f7g-v4pp-r667 · amended
- High, CVSS 7.1
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41271 · GHSA-6r77-hqx7-7vw8 · amended
- High, CVSS 7.1
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41272 · GHSA-2x8m-83vc-6wv4 · amended
- High, CVSS 7.1
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41270 · GHSA-xhmj-rg95-44hv · amended
- High, CVSS 7.1
Flowise: File Upload Validation Bypass in createAttachment
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41269 · GHSA-rh7v-6w34-w2rr · amended
- High, CVSS 7.7
Flowise: Parameter Override Bypass Remote Command Execution
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41268 · GHSA-cvrr-qhgw-2mm6 · amended
- High, CVSS 7.7
Flowise: Sensitive Data Leak in public-chatbotConfig
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41266 · GHSA-4jpm-cgx2-8h37 · amended
- High, CVSS 8.1
Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
npm flowise · Upgrade to 3.1.0 or later · <= 3.0.13 · CVE-2026-41267 · GHSA-48m6-ch88-55mj · amended
- Critical, CVSS 9.4
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41137 · GHSA-9wc7-mj3f-74xv · amended
- High, CVSS 8.3
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using
Pandas.npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41138 · GHSA-f228-chmx-v6j6 · amended
- Medium, CVSS 5.0
Istio: SSRF via RequestAuthentication jwksUri
Go istio.io/istio · Upgrade to 0.0.0-20260410004459-189832a289c1 (pre-release) or later · < 0.0.0-20260410004459-189832a289c1 · CVE-2026-41413 · GHSA-fgw5-hp8f-xfhc
- High, CVSS 7.5
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
npm basic-ftp · Upgrade to 5.3.0 or later · <= 5.2.2 · CVE-2026-41324 · GHSA-rp42-5vxx-qpwr · amended
- High, CVSS 7.7
Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)
Go github.com/kyverno/kyverno · Upgrade to 1.17.0 or later · < 1.17.0 · GHSA-8wfp-579w-6r25
- High, CVSS 8.1
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
Go github.com/kyverno/kyverno · Upgrade to 1.17.0 or later · < 1.17.0 · CVE-2026-41323 · GHSA-f9g8-6ppc-pqq4
- High, CVSS 8.8
Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar
Packagist joedolson/my-calendar · Upgrade to 3.7.7 or later · < 3.7.7 · CVE-2026-40308 · GHSA-2mvx-f5qm-v2ch
- Medium, CVSS 6.8
pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
PyPI pypdf · Upgrade to 6.10.2 or later · < 6.10.2 · CVE-2026-41314 · GHSA-x284-j5p8-9c5p · amended
- Medium, CVSS 6.8
pypdf: Possible long runtimes for wrong size values in incremental mode
PyPI pypdf · Upgrade to 6.10.2 or later · < 6.10.2 · CVE-2026-41313 · GHSA-4pxv-j86v-mhcw · amended
- Medium, CVSS 6.8
pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
PyPI pypdf · Upgrade to 6.10.2 or later · < 6.10.2 · CVE-2026-41312 · GHSA-7gw9-cf7v-778f · amended
- Medium, CVSS 5.6
Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates
PyPI homeassistant-cli · Upgrade to 1.0.0 or later · < 1.0.0 · CVE-2026-40602 · GHSA-33qf-q99x-wpm8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.