Critical, CVSS 9.8
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
PyPI praisonai · Upgrade to 4.5.115 or later · <= 4.5.114 · CVE-2026-39890 · GHSA-32vr-5gcf-3pw2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8051–8075 of 31,057 matching · newest first
- High, CVSS 8.1
CI4MS Vulnerable to .env CRLF Injection via Unvalidated
hostParameter in Install ControllerPackagist ci4-cms-erp/ci4ms · Upgrade to 0.31.4.0 or later · <= 0.31.3.0 · CVE-2026-39394 · GHSA-vfhx-5459-qhqh
- High, CVSS 8.1
CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.4.0 or later · <= 0.31.3.0 · CVE-2026-39393 · GHSA-8rh5-4mvx-xj7j
- Medium, CVSS 5.5
CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.4.0 or later · <= 0.31.3.0 · CVE-2026-39392 · GHSA-fjpj-6qcq-6pw2
- Medium, CVSS 4.8
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.4.0 or later · <= 0.31.3.0 · CVE-2026-39391 · GHSA-7cm9-v848-cfh2
- Medium, CVSS 5.5
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.4.0 or later · <= 0.31.3.0 · CVE-2026-39390 · GHSA-x3hr-cp7x-44r2
- Medium, CVSS 6.7
CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.4.0 or later · <= 0.31.3.0 · CVE-2026-39389 · GHSA-9rxp-f27p-wv3h
- Medium, CVSS 6.3
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Maven io.quarkiverse.openapi.generator:quarkus-openapi-generator · Upgrade to 2.16.0 or later · <= 2.15.0 · CVE-2026-40180 · GHSA-jx2w-vp7f-456q
- High, CVSS 8.7
stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution
PyPI stata-mcp · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-31040 · GHSA-jpcj-7wfg-mqxv · amended
- High, CVSS 7.8
Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.81.1 or later · < 4.81.1 · CVE-2026-27806 · GHSA-rphv-h674-5hp2
- Medium, CVSS 5.9
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
npm axios · Upgrade to 1.13.2 or later · >= 1.13.0, < 1.13.2 · CVE-2026-39865 · GHSA-qj83-cq47-w5f8 · amended
- Medium, CVSS 5.5
pretix: API leaks check-in data between events of the same organizer
PyPI pretix · Upgrade to 2026.3.1, 2026.2.1 or 2026.1.2 by release line · >= 2026.3.0, < 2026.3.1; >= 2026.2.0, < 2026.2.1; >= 2025.10.0, < 2026.1.2 · CVE-2026-5600 · GHSA-wr8q-c73g-m7gp · amended
- High, CVSS 8.4
OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
PyPI openexr · Upgrade to 3.4.9, 3.3.9 or 3.2.7 by release line · >= 3.2.0, < 3.2.7; >= 3.3.0, < 3.3.9; >= 3.4.0, < 3.4.9 · CVE-2026-34589 · GHSA-p8xc-w3q4-h64x · amended
- High, CVSS 8.6
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
PyPI openexr · Upgrade to 3.4.9, 3.3.9 or 3.2.7 by release line · >= 3.1.0, < 3.2.7; >= 3.3.0, < 3.3.9; >= 3.4.0, < 3.4.9 · CVE-2026-34588 · GHSA-588r-cr5c-w6hf · amended
- Medium, CVSS 4.9
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
npm nodemailer · Upgrade to 8.0.5 or later · <= 8.0.4 · CVE-2026-82853 · GHSA-vvjj-xcjg-gr5g · amended
- Medium, CVSS 6.5
kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution
Go github.com/platform-mesh/kubernetes-graphql-gateway · Upgrade to 1.2.9 or later · <= 1.2.8 · GHSA-h9mw-h4qc-f5jf
- Medium, CVSS 6.3
LiquidJS:
renderFile()/parseFile()bypass configuredrootand allow arbitrary file readnpm liquidjs · Upgrade to 10.25.5 or later · <= 10.25.4 · CVE-2026-39859 · GHSA-v273-448j-v4qj · amended
- Medium, CVSS 5.3
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
npm liquidjs · Upgrade to 10.25.4 or later · <= 10.25.3 · CVE-2026-39412 · GHSA-rv5g-f82m-qrvv · amended
- Medium, CVSS 5.0
LobeHub: Unauthenticated authentication bypass on
webapiroutes via forgeableX-lobe-chat-authheadernpm @lobehub/lobehub · Upgrade to 2.1.48 or later · <= 2.1.47 · CVE-2026-39411 · GHSA-5mwj-v5jw-5c97 · amended
- High, CVSS 8.2
kcp's cache server is accessible without authentication or authorization checks
Go github.com/kcp-dev/kcp · Upgrade to 0.30.3 or 0.29.3 by release line · >= 0.30.0, < 0.30.3; < 0.29.3 · CVE-2026-39429 · GHSA-3j3q-wp9x-585p
- Medium, CVSS 5.9
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
PyPI nicegui · Upgrade to 3.10.0 or later · <= 3.9.0 · CVE-2026-39844 · GHSA-w8wv-vfpc-hw2w · amended
- Critical, CVSS 9.0
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260407035653-2f416e5253f1 (pre-release) or later · < 0.0.0-20260407035653-2f416e5253f1 · CVE-2026-39846 · GHSA-phhp-9rm9-6gr2
- High, CVSS 8.2
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
npm liquidjs · Upgrade to 10.25.3 or later · <= 10.25.2 · CVE-2026-35525 · GHSA-56p5-8mhr-2fph · amended
- Low, CVSS 3.7
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in
replaceFilternpm liquidjs · Upgrade to 10.25.3 or later · <= 10.25.2 · CVE-2026-34166 · GHSA-mmg9-6m6j-jqqx · amended
- Medium, CVSS 6.2
rfc3161-client Has Improper Certificate Validation
PyPI rfc3161-client · Upgrade to 1.0.6 or later · <= 1.0.5 · CVE-2026-33753 · GHSA-3xxc-pwj6-jgrj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.