Medium, CVSS 5.3
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
npm @grackle-ai/server · Upgrade to 0.70.4 or later · <= 0.70.3 · GHSA-3mjm-x6gw-2x42 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8801–8825 of 31,057 matching · newest first
- Medium, CVSS 6.3
@grackle-ai/powerline Runs Without Authentication by Default
npm @grackle-ai/powerline · Upgrade to 0.70.1 or later · <= 0.70.0 · GHSA-xq7h-vwjp-5vrh · amended
- High, CVSS 7.1
@grackle-ai/server has Missing WebSocket Origin Header Validation
npm @grackle-ai/server · Upgrade to 0.70.3 or later · <= 0.70.2 · GHSA-w3hv-x4fp-6h6j · amended
- High, CVSS 8.6
@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool
npm @grackle-ai/mcp · Upgrade to 0.70.2 or later · <= 0.70.1 · GHSA-647h-p824-99w7 · amended
- Low, CVSS 2.3
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
npm @grackle-ai/server · Upgrade to 0.70.1 or later · <= 0.70.0 · GHSA-7q9x-8g6p-3x75 · amended
- High, CVSS 7.2
Modoboa has OS Command Injection
PyPI modoboa · Upgrade to 2.7.1 or later · <= 2.7.0 · CVE-2026-27602 · GHSA-wwv8-cqpr-vx3m · amended
- High, CVSS 7.1
n8n has In-Process Memory Disclosure in its Task Runner
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.10.0, < 2.10.1; >= 2.0.0-rc.0, < 2.9.3 · CVE-2026-27496 · GHSA-xvh5-5qg4-x9qp · amended
- Medium, CVSS 4.4
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
PyPI requests · Upgrade to 2.33.0 or later · < 2.33.0 · CVE-2026-25645 · GHSA-gc5v-m9x4-r6x2 · amended
- Medium, CVSS 5.3
Ech0 authenticated user-list exposed data via public
/api/allusersendpointGo github.com/lin-snow/ech0 · Upgrade to 1.4.8-0.20260322121226-acbf1fd71011 (pre-release) or later · < 1.4.8-0.20260322121226-acbf1fd71011 · CVE-2026-33638 · GHSA-m983-7426-5hrj
- Medium, CVSS 6.5
Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation
NuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-xw6w-9jjh-p9cr
- Medium, CVSS 6.5
Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString
NuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-m2p3-hwv5-xpqw
- High, CVSS 7.5
Scriban has Uncontrolled Recursion in
object.to_jsonCausing Unrecoverable Process Crash via StackOverflowExceptionNuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-xcx6-vp38-8hr5
- High, CVSS 7.5
Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service
NuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-v66j-x4hw-fv9g
- High, CVSS 7.5
Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service
NuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-c875-h985-hvrc
- Critical, CVSS 9.1
Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse
NuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-5wr9-m6jw-xx44
- High, CVSS 8.6
Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()
NuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-x6m9-38vm-2xhf
- High, CVSS 7.5
Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix
NuGet scriban +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · GHSA-p6q4-fgr8-vx4p
- Medium, CVSS 6.5
NATS is vulnerable to MQTT hijacking via Client ID
Go github.com/nats-io/nats-server/v2 · Upgrade to 2.12.6 or 2.11.15 by release line · < 2.11.15; >= 2.12.0-RC.1, < 2.12.6 · CVE-2026-33215 · GHSA-fcjp-h8cc-6879
- High, CVSS 7.8
NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution
PyPI nemo-toolkit · Upgrade to 2.6.2 or later · < 2.6.2 · CVE-2026-24159 · GHSA-v7v2-m736-cf3c · amended
- High, CVSS 7.8
NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading
PyPI nemo-toolkit · Upgrade to 2.6.2 or later · < 2.6.2 · CVE-2026-24157 · GHSA-m4jw-wgmf-889x · amended
- High, CVSS 7.4
NATS credentials are exposed in monitoring port via command-line argv
Go github.com/nats-io/nats-server/v2 · Upgrade to 2.12.6 or 2.11.15 by release line · < 2.11.15; >= 2.12.0-RC.1, < 2.12.6 · CVE-2026-33247 · GHSA-x6g4-f6q3-fqvv
- Medium, CVSS 5.4
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
Packagist invoiceninja/invoiceninja · Upgrade to 5.13.4 or later · < 5.13.4 · CVE-2026-33628 · GHSA-98wm-cxpw-847p
- Medium, CVSS 4.3
NATS: Message tracing can be redirected to arbitrary subject
Go github.com/nats-io/nats-server/v2 · Upgrade to 2.12.6 or 2.11.15 by release line · >= 2.11.0, < 2.11.15; >= 2.12.0-preview.1, < 2.12.6 · CVE-2026-33249 · GHSA-8m2x-3m6q-6w8j
- High, CVSS 7.1
Parse Server exposes auth data via /users/me endpoint
npm parse-server · Upgrade to 9.6.0-alpha.55 (pre-release) or 8.6.61 by release line · >= 9.0.0, < 9.6.0-alpha.55; < 8.6.61 · CVE-2026-33627 · GHSA-37mj-c2wf-cx96 · amended
- Low, CVSS 2.1
Parse Server: MFA recovery code single-use bypass via concurrent requests
npm parse-server · Upgrade to 9.6.0-alpha.54 (pre-release) or 8.6.60 by release line · >= 9.0.0, < 9.6.0-alpha.54; < 8.6.60 · CVE-2026-33624 · GHSA-2299-ghjr-6vjp · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.