Critical, CVSS 9.1
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
PyPI gramps-webapi · Upgrade to 3.11.1 or later · >= 1.6.0, < 3.11.1 · CVE-2026-40258 · GHSA-m5gr-86j6-99jp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
7876–7900 of 31,057 matching · newest first
- High, CVSS 8.2
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport
npm n8n-mcp · Upgrade to 2.47.6 or later · <= 2.47.5 · GHSA-75hx-xj24-mqrw · amended
- Medium, CVSS 6.9
pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
PyPI pypdf · Upgrade to 6.10.0 or later · < 6.10.0 · CVE-2026-40260 · GHSA-3crg-w4f6-42mx · amended
- High, CVSS 7.2
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.17.3 or later · <= 1.17.2 · CVE-2026-40242 · GHSA-ff24-4prj-gpmj
- Low, CVSS 3.7
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
Packagist phpseclib/phpseclib · Upgrade to 3.0.51, 2.0.53 or 1.0.28 by release line · >= 2.0.0, < 2.0.53; >= 3.0.0, < 3.0.51; >= 0.1.1, < 1.0.28 · CVE-2026-40194 · GHSA-r854-jrxh-36qx
- High, CVSS 8.0
DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload
NuGet dotnetnuke.core · Upgrade to 10.2.2 or later · < 10.2.2 · CVE-2026-40321 · GHSA-ffq7-898w-9jc4
- High, CVSS 8.2
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
npm basic-ftp · Upgrade to 5.2.2 or later · <= 5.2.1 · GHSA-6v7q-wjvx-w8wg · amended
- Low, CVSS 3.1
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Go github.com/fluxcd/notification-controller · Upgrade to 1.8.3 or later · < 1.8.3 · CVE-2026-40109 · GHSA-h9cx-xjg6-5v2w
- Low, CVSS 3.7
Step CA affected by an index out of bounds panic in TPM attestation EKU validation
Go github.com/smallstep/certificates · Upgrade to 0.30.0 or later · >= 0.24.0, < 0.30.0 · CVE-2026-40097 · GHSA-9qq8-cgcv-qmc9
- Medium, CVSS 5.6
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete
__proto__Guard in Internal lodashset()npm langsmith · Upgrade to 0.5.18 or later · <= 0.5.17 · CVE-2026-40190 · GHSA-fw9q-39r9-c252 · amended
- Medium, CVSS 6.3
PYSEC-2026-2159
PyPI geonode · Upgrade to 5.0.2 or 4.4.5 by release line · >= 4.0.0, < 4.4.5; >= 5.0.0, < 5.0.2 · CVE-2026-39921
- Medium, CVSS 5.3
Rembg has a Path Traversal via Custom Model Loading
PyPI rembg · Upgrade to 2.0.75 or later · < 2.0.75 · CVE-2026-40086 · GHSA-3wqj-33cg-xc48 · amended
- Medium, CVSS 6.9
ajenti.plugin.core has race conditions in 2FA
PyPI ajenti-plugin-core · Upgrade to 0.112 or later · <= 0.111 · CVE-2026-40178 · GHSA-8647-755q-fw9p · amended
- Medium, CVSS 5.3
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
PyPI xrootd · Upgrade to 5.9.2 or later · < 5.9.2 · CVE-2026-125113 · GHSA-vj8v-p5vw-m6v5 · amended
- Medium, CVSS 4.8
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload
Go github.com/lin-snow/ech0 · Upgrade to 4.4.3 or later · < 4.4.3 · GHSA-69hx-63pv-f8f4
- Medium, CVSS 5.5
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation
Go github.com/lin-snow/ech0 · Upgrade to 4.4.3 or later · < 4.4.3 · GHSA-r2x7-427f-rq69
- Medium, CVSS 4.3
Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure
Go github.com/lin-snow/ech0 · Upgrade to 4.4.3 or later · < 4.4.3 · GHSA-w8jj-cwmc-wgq2
- Medium, CVSS 5.5
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass
Go github.com/lin-snow/ech0 · Upgrade to 4.4.3 or later · < 4.4.3 · GHSA-fwg7-53p4-g33c
- Medium, CVSS 6.5
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session
Go github.com/lin-snow/ech0 · Upgrade to 4.4.3 or later · < 4.4.3 · GHSA-hm2h-wwwh-g49x
- Critical, CVSS 9.1
ajenti.plugin.core has password bypass when 2FA is activated
PyPI ajenti-plugin-core · Upgrade to 0.112 or later · < 0.112 · CVE-2026-40177 · GHSA-3mcx-6wxm-qr8v · amended
- Medium, CVSS 4.8
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
npm axios · Upgrade to 1.15.0 or 0.31.0 by release line · >= 1.0.0, < 1.15.0; < 0.31.0 · CVE-2026-40175 · GHSA-fvcv-3m26-pcqx · amended
- Low, CVSS 2.1
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Packagist redaxo/source · Upgrade to 5.21.0 or later · < 5.21.0 · CVE-2026-117538 · GHSA-xq4j-g85q-wf97 · amended
- Low, CVSS 2.1
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
Packagist redaxo/source · Upgrade to 5.21.0 or later · < 5.21.0 · CVE-2026-117537 · GHSA-m662-8jrj-cw6v · amended
- Medium, CVSS 6.5
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs
Go github.com/lin-snow/ech0 · Upgrade to 4.3.5 or later · < 4.3.5 · GHSA-cp79-9mwr-wr49
- High, CVSS 7.6
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export
Go github.com/lin-snow/ech0 · Upgrade to 4.3.5 or later · < 4.3.5 · GHSA-4h9q-p5j4-xvvh
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.