Critical, CVSS 9.1
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
npm fast-jwt · Upgrade to 6.2.0 or later · <= 6.1.0 · CVE-2026-34950 · GHSA-mvf2-f6gm-w987 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8351–8375 of 31,057 matching · newest first
- Medium, CVSS 4.8
Rack::Request accepts invalid Host characters, enabling host allowlist bypass
RubyGems rack · Upgrade to 3.2.6 or 3.1.21 by release line · >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34835 · GHSA-g2pf-xv49-m2h5
- Medium, CVSS 4.8
Rack has Content-Length mismatch in Rack::Files error responses
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34831 · GHSA-q2ww-5357-x388
- Medium, CVSS 5.9
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34830 · GHSA-qv7j-4883-hwh7
- High, CVSS 7.5
Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34829 · GHSA-8vqr-qjwx-82mw
- Medium, CVSS 5.3
Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34763 · GHSA-7mqq-6cf9-v2qp
- High, CVSS 7.5
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34230 · GHSA-v569-hp3g-36wr
- Medium, CVSS 4.8
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing
RubyGems rack · Upgrade to 3.2.6 or 3.1.21 by release line · >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-32762 · GHSA-qfgr-crr9-7r49
- Medium, CVSS 4.8
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values
RubyGems rack · Upgrade to 3.2.6 or later · >= 3.2.0, < 3.2.6 · CVE-2026-26962 · GHSA-rx22-g9mx-qrhv
- Medium, CVSS 5.3
Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-26961 · GHSA-vgpv-f759-9wx3
- High, CVSS 7.5
Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters
RubyGems rack · Upgrade to 3.2.6 or 3.1.21 by release line · >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34827 · GHSA-v6x5-cg8r-vv6x
- Medium, CVSS 5.3
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34826 · GHSA-x8cg-fq8g-mxfx
- Medium, CVSS 5.3
Rack:: Static header_rules bypass via URL-encoded paths
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34786 · GHSA-q4qf-9j86-f5mh
- High, CVSS 7.5
Rack::Static prefix matching can expose unintended files under the static root
RubyGems rack · Upgrade to 3.2.6, 3.1.21 or 2.2.23 by release line · < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 · CVE-2026-34785 · GHSA-h2jq-g4cq-5ppq
- Critical, CVSS 9.6
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions
npm @lightdash/cli · Upgrade to 0.2695.1 or later · >= 0.1800.0, < 0.2695.1 · GHSA-3hfp-gqgh-xc5g · amended
- Critical, CVSS 9.8
Axios npm Supply Chain Incident Impacting @usebruno/cli
npm @usebruno/cli · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2026-34841 · GHSA-658g-p7jg-wx5g
- Medium, CVSS 5.3
Keycloak: Replay of action tokens via improper handling of single-use entries
Maven org.keycloak:keycloak-services · Upgrade to 26.5.7 or later · < 26.5.7 · CVE-2026-4325 · GHSA-rx66-hj7g-28h7
- High, CVSS 7.4
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
Maven org.keycloak:keycloak-services · Upgrade to 26.5.7 or later · < 26.5.7 · CVE-2026-4282 · GHSA-hj93-h7pg-fh6v
- High, CVSS 7.5
Keycloak: Application-Level DoS via Scope Processing
Maven org.keycloak:keycloak-services · Upgrade to 26.5.7 or later · < 26.5.7 · CVE-2026-4634 · GHSA-h4wv-g838-66g3
- High, CVSS 8.1
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
Maven org.keycloak:keycloak-services · Upgrade to 26.5.7 or later · < 26.5.7 · CVE-2026-4636 · GHSA-f2hx-5fx3-hmcv
- High, CVSS 7.3
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
Maven org.keycloak:keycloak-services · Upgrade to 26.5.7 or later · < 26.5.7 · CVE-2026-3872 · GHSA-cjm2-j6cm-6p6m
- Low, CVSS 1.9
a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function
npm a11y-mcp · Upgrade to 1.0.5 or later · < 1.0.5 · CVE-2026-5323 · GHSA-prmx-7v35-7q82 · amended
- High, CVSS 7.1
mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')
npm mcp-handler · Upgrade to 1.1.0 or later · < 1.1.0 · GHSA-w2fm-25vw-vh7f · amended
- High, CVSS 7.5
EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory
NuGet enhancedlinq.async · Upgrade to 1.0.0-beta.3 (pre-release) or later · >= 1.0.0-beta.1, < 1.0.0-beta.3 · GHSA-32wq-ppwg-3w4m
- High, CVSS 8.1
lodash vulnerable to Code Injection via
_.templateimports key namesnpm lodash +3 · Upgrade all 4 to 4.18.0 or later · >= 4.0.0, <= 4.17.23 · CVE-2026-4800 · GHSA-r5fr-rjxr-66jc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.