n8n has SQL Injection in Data Table Node via orderByColumn Expression
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.26 by release line · < 1.123.26; >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3 · CVE-2026-33713 · GHSA-98c2-4cr3-4jc3 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
8751–8775 of 31,057 matching · newest first
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.26 by release line · < 1.123.26; >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3 · CVE-2026-33713 · GHSA-98c2-4cr3-4jc3 · amended
npm n8n · Upgrade to 2.14.1, 2.13.3 or 1.123.27 by release line · >= 2.14.0, <= 2.14.0; >= 2.0.0-rc.0, < 2.13.3; < 1.123.27 · CVE-2026-33696 · GHSA-mxrg-77hm-89hv · amended
Maven org.keycloak:keycloak-services · Upgrade to 26.6.3 or 26.4.13 by release line · >= 26.5.0, < 26.6.3; < 26.4.13 · CVE-2026-4874 · GHSA-22rm-wp4x-v5cx
PyPI bentoml · Upgrade to 1.4.37 or later · <= 1.4.36 · CVE-2026-33744 · GHSA-jfjg-vc52-wqvf · amended
npm n8n · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2026-33724 · GHSA-43v7-fp2v-68f6 · amended
npm n8n · Upgrade to 2.6.4 or 1.123.23 by release line · < 1.123.23; >= 2.0.0-rc.0, < 2.6.4 · CVE-2026-33722 · GHSA-fxcw-h3qj-8m8p · amended
Packagist saloonphp/saloon · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-33183 · GHSA-f7xc-5852-fj99
Packagist saloonphp/saloon · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-33182 · GHSA-c83f-3xp6-hfcp
npm n8n · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-33720 · GHSA-vpgc-2f6g-7w7x · amended
PyPI openhands-ai · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-33718 · GHSA-7h8w-hj9j-8rjw · amended
Go golang.org/x/image · Upgrade to 0.38.0 or later · < 0.38.0 · CVE-2026-33809 · GHSA-44p7-9xx4-hf2g
Maven org.pf4j:pf4j · Upgrade to 3.14.1 or later · < 3.14.1 · CVE-2025-70952 · GHSA-5458-7hh9-v7p4
PyPI signify · Upgrade to 0.9.2 or later · < 0.9.2 · CVE-2025-70887 · GHSA-p4hh-mq57-gq8x · amended
Maven io.opentelemetry.javaagent:opentelemetry-javaagent · Upgrade to 2.26.1 or later · < 2.26.1 · CVE-2026-33701 · GHSA-xw7x-h9fj-p2c7
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · < 2.2.1 · CVE-2026-33700 · GHSA-f95f-77jx-fcjc
PyPI streamlit · Upgrade to 1.54.0 or later · < 1.54.0 · CVE-2026-33682 · GHSA-7p48-42j8-8846 · amended
Go code.vikunja.io/api · Upgrade to 2.2.2 or later · < 2.2.2 · CVE-2026-33680 · GHSA-8hp8-9fhr-pfm9
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · <= 2.2.0 · CVE-2026-33679 · GHSA-g9xj-752q-xh63
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · <= 2.2.0 · CVE-2026-33678 · GHSA-jfmm-mjcp-8wq2
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · <= 2.2.0 · CVE-2026-33677 · GHSA-7c2g-p23p-4jg3
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · <= 2.2.0 · CVE-2026-33676 · GHSA-8cmm-j6c4-rr8v
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · <= 2.2.0 · CVE-2026-33675 · GHSA-g66v-54v9-52pr
npm picomatch · Upgrade to 4.0.4, 3.0.2 or 2.3.2 by release line · >= 4.0.0, < 4.0.4; >= 3.0.0, < 3.0.2; < 2.3.2 · CVE-2026-33672 · GHSA-3v7f-55p6-f55p · amended
npm picomatch · Upgrade to 4.0.4, 3.0.2 or 2.3.2 by release line · >= 4.0.0, < 4.0.4; >= 3.0.0, < 3.0.2; < 2.3.2 · CVE-2026-33671 · GHSA-c2c7-rcm5-vvqj · amended
Go code.vikunja.io/api · Upgrade to 2.2.1 or later · >= 0.18.0, <= 2.2.0 · CVE-2026-33668 · GHSA-94xm-jj8x-3cr4
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.