Medium, CVSS 6.5
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt
npm lodash · Upgrade to 4.18.1 or later · >= 4.17.23, < 4.18.1 · +4 more packages · CVE-2026-2950 · GHSA-f23m-r3pf-42rh · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8376–8400 of 31,057 matching · newest first
- High, CVSS 7.1
listmonk's active sessions remain valid after password reset and password change
Go github.com/knadh/listmonk · Upgrade to 1.1.1-0.20260329113754-1b5e8d38c778 (pre-release) or later · >= 1.1.1-0.20241028090858-319053dd7a90, < 1.1.1-0.20260329113754-1b5e8d38c778 · CVE-2026-34828 · GHSA-h5j9-cvrw-v5qh
- High, CVSS 8.5
NocoBase Has SQL Injection via template variable substitution in workflow SQL node
npm @nocobase/plugin-workflow-sql · Upgrade to 2.0.30 or later · <= 2.0.29 · CVE-2026-34825 · GHSA-vx58-fwwq-5g8j · amended
- Medium, CVSS 5.4
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation
Packagist thorsten/phpmyfaq · Upgrade to 4.1.1 or later · <= 4.1.0 · CVE-2026-34974 · GHSA-5crx-pfhq-4hgg
- Medium, CVSS 6.9
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
Packagist thorsten/phpmyfaq · Upgrade to 4.1.1 or later · < 4.1.1 · CVE-2026-34973 · GHSA-gcp9-5jc8-976x
- High, CVSS 7.1
ONNX: TOCTOU arbitrary file read/write in save_external_dat
PyPI onnx · Upgrade to 1.21.0 or later · <= 1.20.1 · CVE-2026-49114 · GHSA-q56x-g2fj-4rj6 · amended
- Low, CVSS 2.3
Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback
Go github.com/nhost/nhost · Upgrade to 0.0.0-20260330133707-294954e0fc3a (pre-release) or later · < 0.0.0-20260330133707-294954e0fc3a · CVE-2026-34969 · GHSA-g2qj-prgh-4g9r
- Critical, CVSS 9.1
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
PyPI praisonai · Upgrade to 4.5.97 or later · <= 4.5.96 · CVE-2026-34953 · GHSA-98f9-fqg5-hvq5 · amended
- Critical, CVSS 9.1
PraisonAI Has Missing Authentication in WebSocket Gateway
PyPI praisonai · Upgrade to 4.5.97 or later · <= 4.5.96 · CVE-2026-34952 · GHSA-cfh6-vr3j-qc3g · amended
- High, CVSS 8.6
PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
PyPI praisonaiagents · Upgrade to 1.5.95 or later · <= 1.5.94 · CVE-2026-34954 · GHSA-44c2-3rw4-5gvh · amended
- High, CVSS 8.8
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
PyPI praisonai · Upgrade to 4.5.97 or later · <= 4.5.96 · CVE-2026-34955 · GHSA-r4f2-3m54-pp7q · amended
- High, CVSS 8.7
KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods
Go github.com/kubeai-project/kubeai · Upgrade to 0.23.2 or later · <= 0.23.1 · CVE-2026-34940 · GHSA-324q-cwx9-7crr
- High, CVSS 7.7
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
PyPI praisonai · Upgrade to 4.5.90 or later · <= 4.5.89 · CVE-2026-34936 · GHSA-x6m9-gxvr-7jpv · amended
- Medium, CVSS 6.5
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
PyPI praisonai · Upgrade to 4.5.90 or later · <= 4.5.89 · CVE-2026-34939 · GHSA-8w9j-hc3g-3g7f · amended
- Critical, CVSS 9.8
PraisonAI Has Second-Order SQL Injection in
get_all_user_threadsPyPI praisonai · Upgrade to 4.5.90 or later · <= 4.5.89 · CVE-2026-34934 · GHSA-9cq8-3v94-434g · amended
- Critical, CVSS 9.8
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
PyPI praisonai · Upgrade to 4.5.69 or later · >= 4.5.15, <= 4.5.68 · CVE-2026-34935 · GHSA-9gm9-c8mq-vq7m · amended
- High, CVSS 7.8
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
PyPI praisonaiagents · Upgrade to 1.5.90 or later · <= 1.5.89 · CVE-2026-34937 · GHSA-w37c-qqfp-c67f · amended
- Critical, CVSS 10.0
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
PyPI praisonaiagents · Upgrade to 1.5.90 or later · <= 1.5.89 · CVE-2026-34938 · GHSA-6vh2-h83c-9294 · amended
- High, CVSS 8.2
Parser Server's streaming file download bypasses afterFind file trigger authorization
npm parse-server · Upgrade to 9.7.1-alpha.1 (pre-release) or 8.6.71 by release line · >= 9.0.0, < 9.7.1-alpha.1; < 8.6.71 · CVE-2026-34784 · GHSA-hpm8-9qx6-jvwv · amended
- Medium, CVSS 5.9
Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials
Go github.com/teslamotors/fleet-telemetry · Upgrade to 0.9.0 or later · <= 0.8.0 · GHSA-prxj-3gcv-cqrh
- Low, CVSS 2.7
Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber
Go github.com/ellanetworks/core · Upgrade to 1.8.0 or later · <= 1.7.0 · CVE-2026-34762 · GHSA-xw45-cc32-442f
- Medium, CVSS 5.8
Ella Core Panics Upon NGAP handover failure
Go github.com/ellanetworks/core · Upgrade to 1.8.0 or later · <= 1.7.0 · CVE-2026-34761 · GHSA-6gm8-3g4h-w82m
- Medium, CVSS 5.5
Copier
_external_dataallows path traversal and absolute-path local file read without unsafe modePyPI copier · Upgrade to 9.14.1 or later · <= 9.14.0 · CVE-2026-34730 · GHSA-hgjq-p8cr-gg4h · amended
- Medium, CVSS 6.1
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
Packagist phpmyfaq/phpmyfaq · Upgrade to 4.1.1 or later · <= 4.1.0 · CVE-2026-34729 · GHSA-cv2g-8cj8-vgc7
- High, CVSS 8.7
phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController
Packagist phpmyfaq/phpmyfaq · Upgrade to 4.1.1 or later · <= 4.1.0 · CVE-2026-34728 · GHSA-38m8-xrfj-v38x
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.