High, CVSS 7.3
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
PyPI praisonai · Upgrade to 4.5.113 or later · <= 4.5.112 · CVE-2026-39306 · GHSA-4rx4-4r3x-6534 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8176–8200 of 31,057 matching · newest first
- Critical, CVSS 9.0
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
PyPI praisonai · Upgrade to 4.5.113 or later · <= 4.5.112 · CVE-2026-39305 · GHSA-jfxc-v5g9-38xr · amended
- High, CVSS 8.1
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
PyPI praisonai · Upgrade to 4.5.113 or later · <= 4.5.112 · CVE-2026-39307 · GHSA-4ph2-f6pf-79wv · amended
- Medium, CVSS 6.2
go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers
Go github.com/ipld/go-ipld-prime · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-35480 · GHSA-378j-3jfj-8r9f
- Low, CVSS 3.7
PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state
Packagist pocketmine/pocketmine-mp · Upgrade to 5.39.2 or later · < 5.39.2 · GHSA-f9jp-856v-8642
- Medium, CVSS 4.3
PocketMine-MP: Network amplification vulnerability with
ActorEventPacketPackagist pocketmine/pocketmine-mp · Upgrade to 5.39.2 or later · < 5.39.2 · GHSA-7hmv-4j2j-pp6f
- High, CVSS 7.1
PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling
Packagist pocketmine/pocketmine-mp · Upgrade to 5.39.2 or later · < 5.39.2 · GHSA-788v-5pfp-93ff
- High, CVSS 7.5
PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket
Packagist pocketmine/pocketmine-mp · Upgrade to 5.41.1 or later · < 5.41.1 · GHSA-h6rj-3m53-887h
- Unrated
OpenClaw's complex interpreter pipelines could skip exec script preflight validation
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-34425 · GHSA-fvx6-pj3r-5q4q · amended
- Medium, CVSS 6.3
Vite Vulnerable to Path Traversal in Optimized Deps
.mapHandlingnpm vite · Upgrade to 8.0.5, 7.3.2 or 6.4.2 by release line · >= 8.0.0, <= 8.0.4; >= 7.0.0, <= 7.3.1; <= 6.4.1 · CVE-2026-39365 · GHSA-4w7w-66w2-5vf9 · amended
- High, CVSS 8.2
Vite:
server.fs.denybypassed with queriesnpm vite · Upgrade to 8.0.5 or 7.3.2 by release line · >= 8.0.0, <= 8.0.4; >= 7.1.0, <= 7.3.1 · CVE-2026-39364 · GHSA-v2wj-q39q-566r · amended
- High, CVSS 8.2
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
npm vite · Upgrade to 8.0.5, 7.3.2 or 6.4.2 by release line · >= 8.0.0, <= 8.0.4; >= 7.0.0, <= 7.3.1; >= 6.0.0, <= 6.4.1 · CVE-2026-39363 · GHSA-p9ff-h696-f583 · amended
- High, CVSS 7.5
strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions
PyPI strawberry-graphql · Upgrade to 0.312.3 or later · <= 0.312.2 · CVE-2026-35526 · GHSA-hv3w-m4g2-5x77 · amended
- High, CVSS 7.5
strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol
PyPI strawberry-graphql · Upgrade to 0.312.3 or later · <= 0.312.2 · CVE-2026-35523 · GHSA-vpwc-v33q-mq89 · amended
- Critical, CVSS 9.8
changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering
PyPI changedetection-io · Upgrade to 0.54.8 or later · <= 0.54.7 · CVE-2026-35490 · GHSA-jmrh-xmgh-x9j4 · amended
- Medium, CVSS 6.3
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
npm @nestjs/core · Upgrade to 11.1.18 or later · <= 11.1.17 · CVE-2026-35515 · GHSA-36xv-jgw5-4q75 · amended
- High, CVSS 8.6
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri
Go github.com/authorizerdev/authorizer · Upgrade to 0.0.0-20260329085140-6d9bef1aaba3 (pre-release) or later · < 0.0.0-20260329085140-6d9bef1aaba3 · GHSA-x3f4-v83f-7wp2
- High, CVSS 7.3
Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation
Go github.com/authorizerdev/authorizer · Upgrade to 0.0.0-20260327055742-73679faa53cd (pre-release) or later · < 0.0.0-20260327055742-73679faa53cd · GHSA-jfwg-rxf3-p7r9
- Medium, CVSS 6.5
kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write
PyPI kedro-datasets · Upgrade to 9.3.0 or later · < 9.3.0 · CVE-2026-111170 · GHSA-cjg8-h5qc-hrjv · amended
- Medium, CVSS 5.9
rdiscount has an Out-of-bounds Read
RubyGems rdiscount · Upgrade to 2.2.7.4 or later · >= 1.3.1.1, < 2.2.7.4 · CVE-2026-35201 · GHSA-6r34-94wq-jhrc
- Critical, CVSS 9.1
CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.2.0 or later · <= 0.31.1.0 · CVE-2026-35035 · GHSA-5ghq-42rg-769x
- Medium, CVSS 6.5
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
PyPI openexr · Upgrade to 3.4.5 or 3.3.7 by release line · >= 3.3.0, < 3.3.7; >= 3.4.0, < 3.4.5 · CVE-2026-26981 · GHSA-q6vj-wxvf-5m8c · amended
- Medium, CVSS 5.5
OpenEXR has use after free in PyObject_StealAttrString
PyPI openexr · Upgrade to 3.4.3, 3.3.6 or 3.2.5 by release line · >= 3.2.0, < 3.2.5; >= 3.3.0, < 3.3.6; >= 3.4.0, < 3.4.3 · CVE-2025-64183 · GHSA-57cw-j6vp-2p9m · amended
- Medium, CVSS 5.5
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
PyPI openexr · Upgrade to 3.4.3, 3.3.6 or 3.2.5 by release line · >= 3.2.0, < 3.2.5; >= 3.3.0, < 3.3.6; >= 3.4.0, < 3.4.3 · CVE-2025-64182 · GHSA-vh63-9mqx-wmjr · amended
- Low, CVSS 2.0
OpenEXR Makes Use of Uninitialized Memory
PyPI openexr · Upgrade to 3.4.3 or 3.3.6 by release line · >= 3.3.0, < 3.3.6; >= 3.4.0, < 3.4.3 · CVE-2025-64181 · GHSA-3h9h-qfvw-98hq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.