Medium, CVSS 6.6
openssl-encrypt silently skips schema validation when jsonschema library is not installed
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74875 · GHSA-425g-fjhq-5h92 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8501–8525 of 31,057 matching · newest first
- Medium, CVSS 6.6
openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74874 · GHSA-vfgx-5q85-58q3 · amended
- Medium, CVSS 6.6
openssl-encrypt has visible password in process list via --password CLI argument
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74873 · GHSA-h3m5-p59h-x88p · amended
- Critical, CVSS 9.1
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74878 · GHSA-h45m-mgcp-q388 · amended
- Medium, CVSS 6.6
openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74872 · GHSA-j48q-4c78-rhf9 · amended
- High, CVSS 7.5
SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · <= 3.6.1 · CVE-2026-34453 · GHSA-c77m-r996-jr3q
- Critical, CVSS 9.6
SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · <= 3.6.1 · CVE-2026-34449 · GHSA-68p4-j234-43mv
- Critical, CVSS 9.0
SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · <= 3.6.1 · CVE-2026-34448 · GHSA-rx4h-526q-4458
- Medium, CVSS 6.1
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes
npm nuxt-og-image · Upgrade to 6.2.5 or later · < 6.2.5 · CVE-2026-34405 · GHSA-mg36-wvcr-m75h · amended
- Medium, CVSS 5.3
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters
npm nuxt-og-image · Upgrade to 6.2.5 or later · < 6.2.5 · GHSA-pqhr-mp3f-hrpp · amended
- Medium, CVSS 6.9
Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions
npm nuxt-og-image · Upgrade to 6.2.5 or later · < 6.2.5 · CVE-2026-34404 · GHSA-c7xp-q6q8-hg76 · amended
- Medium, CVSS 6.9
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
PyPI alerta-server · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-34400 · GHSA-8prr-286p-4w7j · amended
- Low, CVSS 2.1
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Packagist j0k3r/graby · Upgrade to 2.5.1 or later · <= 2.5.0 · GHSA-3h6j-9x8m-rg3g
- Medium, CVSS 4.3
Admidio has CSRF and Form Validation Bypass in Inventory Item Save via
importedParameterPackagist admidio/admidio · Upgrade to 5.0.8 or later · <= 5.0.7 · CVE-2026-34383 · GHSA-4rwm-c5mj-wh7x
- Medium, CVSS 4.5
Admidio has Missing CSRF Protection on Registration Approval Actions
Packagist admidio/admidio · Upgrade to 5.0.8 or later · < 5.0.8 · CVE-2026-34384 · GHSA-ph84-r98x-2j22
- Medium, CVSS 4.6
Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php
Packagist admidio/admidio · Upgrade to 5.0.8 or later · >= 5.0.0, <= 5.0.7 · CVE-2026-34382 · GHSA-g3mx-8jm6-rc85
- High, CVSS 7.5
Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
Packagist admidio/admidio · Upgrade to 5.0.8 or later · >= 5.0.0, < 5.0.8 · CVE-2026-34381 · GHSA-7fh7-8xqm-3g88
- Medium, CVSS 5.9
Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
Go github.com/bishopfox/sliver · Upgrade to 1.7.4 or later · <= 1.7.3 · CVE-2026-34227 · GHSA-6fpf-248c-m7wm
- Low, CVSS 2.7
Nautobot: Management of users via REST API does not apply configured password validators
PyPI nautobot · Upgrade to 3.0.10 or 2.4.30 by release line · < 2.4.30; >= 3.0.0, < 3.0.10 · CVE-2026-34203 · GHSA-xmpv-j7p2-j873 · amended
- Critical, CVSS 10.0
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
PyPI fastmcp · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-32871 · GHSA-vv7q-7jx5-f767 · amended
- High, CVSS 7.1
baserCMS is Vulnerable to Cross-site Scripting
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-32734 · GHSA-677c-xv24-crgx
- High, CVSS 8.1
SciTokens has an Authorization Bypass via Path Traversal in Scope Validation
PyPI scitokens · Upgrade to 1.9.7 or later · < 1.9.7 · CVE-2026-32727 · GHSA-3x2w-63fp-3qvw · amended
- High, CVSS 8.1
SciTokens has an Authorization Bypass via Incorrect Scope Path Prefix Checking
PyPI scitokens · Upgrade to 1.9.6 or later · < 1.9.6 · CVE-2026-32716 · GHSA-w8fp-g9rh-34jh · amended
- Critical, CVSS 9.8
SciTokens is vulnerable to SQL Injection in KeyCache
PyPI scitokens · Upgrade to 1.9.6 or later · < 1.9.6 · CVE-2026-32714 · GHSA-rh5m-2482-966c · amended
- Medium, CVSS 5.4
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.1 or later · <= 4.1.0 · CVE-2026-32629 · GHSA-98gw-w575-h2ph
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.