High, CVSS 8.1
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
npm @mobilenext/mobile-mcp · Upgrade to 0.0.49 or later · < 0.0.49 · CVE-2026-33989 · GHSA-3p2m-h2v6-g9mx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8626–8650 of 31,057 matching · newest first
- High, CVSS 8.3
Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
PyPI changedetection-io · Upgrade to 0.54.7 or later · <= 0.54.6 · CVE-2026-33981 · GHSA-58r7-4wr5-hfx8 · amended
- High, CVSS 8.2
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
RubyGems mcp · Upgrade to 0.9.2 or later · <= 0.9.1 · CVE-2026-33946 · GHSA-qvqr-5cv7-wh35
- High, CVSS 8.1
Saloon has insecure deserialization in AccessTokenAuthenticator
Packagist saloonphp/saloon · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-33942 · GHSA-rf88-776r-rcq9
- High, CVSS 8.2
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33941 · GHSA-xjpj-3mr7-gcpf · amended
- High, CVSS 8.1
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33940 · GHSA-xhpv-hc6g-r9c6 · amended
- High, CVSS 7.5
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33939 · GHSA-9cx6-37pm-9jff · amended
- High, CVSS 8.1
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33938 · GHSA-3mfm-83xf-c92r · amended
- Critical, CVSS 9.8
Handlebars.js has JavaScript Injection via AST Type Confusion
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · CVE-2026-33937 · GHSA-2w6w-674q-4c4q · amended
- Medium, CVSS 5.9
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
npm serialize-javascript · Upgrade to 7.0.5 or later · >= 5.0.0, < 7.0.5 · CVE-2026-34043 · GHSA-qj8w-gfj5-8c6v · amended
- High, CVSS 8.7
Fleet's unbounded request body read allows remote Denial of Service
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.43.5-0.20260113202849-bbc1aef2987d (pre-release) or later · < 4.43.5-0.20260113202849-bbc1aef2987d · CVE-2026-26061 · GHSA-99hj-44vg-hfcp
- Medium, CVSS 6.0
Fleet: Password reset tokens remain valid after password change for 24 hours
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.43.5-0.20260113202849-bbc1aef2987d (pre-release) or later · < 4.43.5-0.20260113202849-bbc1aef2987d · CVE-2026-26060 · GHSA-3458-r943-hmx4
- Medium, CVSS 4.8
n8n has XSS in its Credential Management Flow
npm n8n · Upgrade to 2.8.0 or 2.6.4 by release line · >= 2.7.0, < 2.8.0; < 2.6.4 · CVE-2026-56359 · GHSA-364x-8g5j-x2pr · amended
- Medium, CVSS 5.1
n8n has XSS in Chat Trigger Node through Custom CSS
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.27 by release line · < 1.123.27; >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3 · CVE-2026-56356 · GHSA-3c7f-5hgj-h279 · amended
- Medium, CVSS 5.1
n8n: Authenticated XSS and Open Redirect via Form Node
npm n8n · Upgrade to 2.12.0, 2.10.4 or 1.123.24 by release line · >= 2.11.0, < 2.12.0; >= 2.0.0-rc.0, < 2.10.4; < 1.123.24 · CVE-2026-56354 · GHSA-w673-8fjw-457c · amended
- Medium, CVSS 5.1
n8n has a Stored XSS Vulnerability in its Form Trigger
npm n8n · Upgrade to 2.11.2 or 1.123.25 by release line · >= 2.0.0-rc.0, < 2.11.2; < 1.123.25 · CVE-2026-56358 · GHSA-q4fm-pjq6-m63g · amended
- Medium, CVSS 6.5
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
Packagist dolibarr/dolibarr · Upgrade to 23.0.0 or later · < 23.0.0 · CVE-2026-34036 · GHSA-2mfj-r695-5h9r · amended
- Medium, CVSS 6.3
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
npm locutus · Upgrade to 3.0.25 or later · >= 2.0.39, < 3.0.25 · CVE-2026-33994 · GHSA-vc8f-x9pp-wf5p · amended
- Medium, CVSS 6.9
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
npm locutus · Upgrade to 3.0.25 or later · < 3.0.25 · CVE-2026-33993 · GHSA-4mph-v827-f877 · amended
- High, CVSS 8.2
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
npm express-xss-sanitizer · Upgrade to 2.0.2 or later · < 2.0.2 · CVE-2026-33979 · GHSA-3843-rr4g-m8jq · amended
- High, CVSS 8.8
Moby has AuthZ plugin bypass when provided oversized request bodies
Go github.com/moby/moby · Upgrade to 29.3.1 or later · < 29.3.1 · +1 more package · CVE-2026-34040 · GHSA-x744-4wpc-v9h2
- Critical, CVSS 9.9
Incus has an abitrary file write through its systemd-creds options
Go github.com/lxc/incus/v6 · Upgrade to 6.23.0 or later · < 6.23.0 · CVE-2026-33945 · GHSA-q4q8-7f2j-9h9f
- High, CVSS 8.8
Local Incus UI web server vulnerable to nuthentication bypass
Go github.com/lxc/incus/v6/cmd/incus · Upgrade to 6.23.0 or later · < 6.23.0 · CVE-2026-33898 · GHSA-453r-g2pg-cxxq
- Medium, CVSS 4.7
Incus vulnerable to local privilege escalation through VM screenshot path
Go github.com/lxc/incus/v6 · Upgrade to 6.23.0 or later · < 6.23.0 · CVE-2026-33711 · GHSA-q9vp-3wcg-8p4x
- High, CVSS 7.0
Incus does not verify combined fingerprint when downloading images from simplestreams servers
Go github.com/lxc/incus/v6/client · Upgrade to 6.23.0 or later · < 6.23.0 · CVE-2026-33542 · GHSA-p8mm-23gg-jc9r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.