High, CVSS 8.7
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
npm mcp-framework · Upgrade to 0.2.22 or later · <= 0.2.21 · CVE-2026-39313 · GHSA-353c-v8x9-v7c3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7701–7725 of 31,057 matching · newest first
- High, CVSS 8.7
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
npm apostrophe · Upgrade to 4.29.0 or later · <= 4.28.0 · CVE-2026-35569 · GHSA-855c-r2vq-c292 · amended
- High, CVSS 8.7
SpdyStream: DOS on CRI
Go github.com/moby/spdystream · Upgrade to 0.5.1 or later · <= 0.5.0 · CVE-2026-35469 · GHSA-pc3f-x583-g7j2
- High, CVSS 8.8
Weblate: Privilege escalation in the user API endpoint
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-34393 · GHSA-3382-gw9x-477v · amended
- Medium, CVSS 5.0
Weblate: SSRF via Project-Level Machinery Configuration
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-34244 · GHSA-xrwr-fcw6-fmq8 · amended
- High, CVSS 7.7
Weblate: Arbitrary File Read via Symlink
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-34242 · GHSA-hv99-mxm5-q397 · amended
- Medium, CVSS 4.9
Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Maven com.ritense.valtimo:inbox · Upgrade to 13.22.0.RELEASE or later · >= 13.0.0.RELEASE, < 13.22.0.RELEASE · CVE-2026-34164 · GHSA-hfrg-mcvw-8mch
- Medium, CVSS 5.4
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
npm apostrophe · Upgrade to 4.29.0 or later · < 4.29.0 · CVE-2026-33889 · GHSA-97v6-998m-fp4g · amended
- Medium, CVSS 5.3
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
npm apostrophe · Upgrade to 4.29.0 or later · < 4.29.0 · CVE-2026-33888 · GHSA-xhq9-58fw-859p · amended
- Low, CVSS 3.7
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
npm apostrophe · Upgrade to 4.29.0 or later · < 4.29.0 · CVE-2026-33877 · GHSA-mj7r-x3h3-7rmr · amended
- Medium, CVSS 5.0
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-33440 · GHSA-5fhx-9jwj-867m · amended
- High, CVSS 8.0
Weblate: Remote code execution during backup restoration
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-33435 · GHSA-558g-h753-6m33 · amended
- Medium, CVSS 6.8
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-33220 · GHSA-mqph-7h49-hqfm · amended
- Medium, CVSS 4.3
Weblate: Improper access control for the translation memory in API
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-33214 · GHSA-mpf5-3vph-q75r · amended
- Low, CVSS 3.1
Weblate: Improper access control for pending tasks in API
PyPI weblate · Upgrade to 5.17 or later · < 5.17 · CVE-2026-33212 · GHSA-vj45-x3pj-f4w4 · amended
- Medium, CVSS 5.9
Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
RubyGems zlib · Upgrade to 3.2.3, 3.1.2 or 3.0.1 by release line · >= 3.2.0, < 3.2.3; >= 3.1.0, < 3.1.2; < 3.0.1 · CVE-2026-27820 · GHSA-g857-hhfv-j68w
- Medium, CVSS 5.3
Silverstripe Assets Module has a DBFile::getURL() permission bypass
Packagist silverstripe/assets · Upgrade to 3.1.3 or 2.4.5 by release line · < 2.4.5; >= 3.0.0, < 3.1.3 · CVE-2026-24749 · GHSA-jgcf-rf45-2f8v
- Medium, CVSS 6.9
Apache Airflow: JWT token appearing in logs
PyPI apache-airflow · Upgrade to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2026-31987 · GHSA-phv5-vq5p-qhp7 · amended
- Critical, CVSS 10.0
goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files
Packagist goodoneuz/pay-uz · Upgrade to 3.0.0 or later · <= 2.2.24 · CVE-2026-31843 · GHSA-m5wg-cjgh-223j
- High, CVSS 7.5
SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information
Maven org.apache.skywalking:server-core · Upgrade to 10.4.0 or later · >= 9.7.0, < 10.4.0 · CVE-2026-30778 · GHSA-27h3-crw2-q36w
- Medium, CVSS 6.3
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
npm renovate · Upgrade to 43.102.11 or later · >= 43.65.0, < 43.102.11 · CVE-2026-76226 · GHSA-5vjq-5jmg-39xq · amended
- Medium, CVSS 4.8
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
PyPI pyload-ng · Upgrade to 0.5.0b3.dev98 (pre-release) or later · <= 0.5.0b3.dev97 · CVE-2026-40594 · GHSA-mp82-fmj6-f22v · amended
- Medium, CVSS 5.3
LangSmith SDK: Streaming token events bypass output redaction
npm langsmith · Upgrade to 0.5.19 or later · <= 0.5.18 · +1 more package · CVE-2026-41182 · GHSA-rr7j-v2q5-chgv · amended
- Medium, CVSS 6.9
PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code
PyPI pyspector · Upgrade to 0.1.8 or later · <= 0.1.7 · CVE-2026-41206 · GHSA-vp22-38m5-r39r · amended
- Critical, CVSS 9.8
MsQuic has a Remote Elevation of Privilege Vulnerability
NuGet microsoft.native.quic.msquic.schannel +1 · Upgrade all 2 to 2.5.7 or 2.4.18 by release line · >= 2.5.0-ci.532574, < 2.5.7; < 2.4.18 · CVE-2026-32179 · GHSA-gvvw-8j96-8g5r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.