High, CVSS 7.5
Qwik City has array method pollution in FormData processing allows type confusion and DoS
npm @builder.io/qwik-city · Upgrade to 1.19.2 or later · < 1.19.2 · CVE-2026-32701 · GHSA-whhv-gg5v-864r · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8926–8950 of 31,057 matching · newest first
- High, CVSS 8.2
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
Maven org.springframework.boot:spring-boot-starter-actuator · Upgrade to 4.0.4 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0-M1, < 4.0.4; >= 3.5.0, < 3.5.12; >= 3.4.0, <= 3.4.13; >= 3.0.0, <= 3.3.13; <= 2.7.18 · CVE-2026-22733 · GHSA-mgvc-8q2h-5pgc
- High, CVSS 8.2
Spring Boot has an Authentication Bypass under Actuator Health groups paths
Maven org.springframework.boot:spring-boot-starter-actuator · Upgrade to 4.0.4 or 3.5.12 by release line; some affected versions have no fix yet · >= 3.4.0, <= 3.4.13; >= 3.5.0, < 3.5.12; >= 4.0.0-M1, < 4.0.4 · CVE-2026-22731 · GHSA-8hfc-fq58-r658
- Medium, CVSS 5.9
Spring Framework Improper Path Limitation with Script View Templates
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 7.0.6 or 6.2.17 by release line; some affected versions have no fix yet · >= 7.0.0-M1, < 7.0.6; >= 6.2.0, < 6.2.17; >= 6.0.0, <= 6.1.21; >= 5.3.0, <= 5.3.39 · CVE-2026-22737 · GHSA-4773-3jfm-qmx3
- High, CVSS 8.8
ingress-nginx comment-based nginx configuration injection
Go k8s.io/ingress-nginx · Upgrade to 0.0.0-20260319175635-5183b7d86137 (pre-release) or later · < 0.0.0-20260319175635-5183b7d86137 · CVE-2026-4342 · GHSA-f53h-mxv9-cp98
- Low, CVSS 2.6
Spring MVC and WebFlux has Server Sent Event stream corruption
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 7.0.6 or 6.2.17 by release line; some affected versions have no fix yet · >= 7.0.0-M1, < 7.0.6; >= 6.2.0, < 6.2.17; >= 6.0.0, <= 6.1.21; >= 5.3.0, <= 5.3.39 · CVE-2026-22735 · GHSA-6hcq-hmm3-jj3c
- Critical, CVSS 9.1
Spring Security HTTP Headers Are not Written Under Some Conditions
Maven org.springframework.security:spring-security-web · Upgrade to 7.0.4 or 6.5.9 by release line; some affected versions have no fix yet · <= 5.7.14; >= 5.8.0, <= 5.8.16; >= 6.0.0, <= 6.3.10; >= 6.4.0, <= 6.4.13; >= 6.5.0, < 6.5.9; >= 7.0.0, < 7.0.4 · CVE-2026-22732 · GHSA-mf92-479x-3373
- High, CVSS 7.0
Parse Server has an auth provider validation bypass on login via partial authData
npm parse-server · Upgrade to 9.6.0-alpha.41 (pre-release) or 8.6.52 by release line · >= 9.0.0, < 9.6.0-alpha.41; < 8.6.52 · CVE-2026-33409 · GHSA-pfj7-wv7c-22pr · amended
- Medium, CVSS 5.3
Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)
NuGet scriban +1 · Upgrade all 2 to 6.6.0 or later · <= 6.5.8 · GHSA-5rpf-x9jg-8j5p
- High, CVSS 7.5
Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)
NuGet scriban +1 · Upgrade all 2 to 6.6.0 or later · <= 6.5.8 · GHSA-grr9-747v-xvcp
- High, CVSS 7.5
Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)
NuGet scriban +1 · Upgrade all 2 to 6.6.0 or later · <= 6.5.8 · GHSA-wgh7-7m3c-fx25
- Medium, CVSS 6.9
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
npm @angular/ssr · Upgrade to 22.0.0-next.2 (pre-release), 21.2.3 or 20.3.21 by release line · >= 22.0.0-next.0, < 22.0.0-next.2; >= 21.0.0-next.0, < 21.2.3; >= 20.0.0-next.0, < 20.3.21 · CVE-2026-33397 · GHSA-vfx2-hv2g-xj5f · amended
- Medium, CVSS 6.1
The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI
Packagist johnbillion/query-monitor · Upgrade to 3.20.4 or later · < 3.20.4 · CVE-2026-4267 · GHSA-2xr4-chcf-vmvf
- High, CVSS 7.1
In Soft Serve, an authenticated repo import can clone server-local private repositories
Go github.com/charmbracelet/soft-serve · Upgrade to 0.11.6 or later · >= 0.6.0, < 0.11.6 · CVE-2026-33353 · GHSA-xgxp-f695-6vrp
- High, CVSS 8.1
Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG
Go github.com/dagu-org/dagu · Upgrade to 1.30.4-0.20260319093346-7d07fda8f9de (pre-release) or later · >= 1.30.4-0.20260221021317-e2ed589105d7, < 1.30.4-0.20260319093346-7d07fda8f9de · CVE-2026-33344 · GHSA-ph8x-4jfv-v9v8
- Medium, CVSS 5.9
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
npm fast-xml-parser · Upgrade to 5.5.7 or 4.5.5 by release line · >= 4.0.0-beta.3, < 4.5.5; >= 5.0.0, < 5.5.7 · CVE-2026-33349 · GHSA-jp2q-39xq-3w4g · amended
- Medium, CVSS 6.3
league/commonmark has an embed extension allowed_domains bypass
Packagist league/commonmark · Upgrade to 2.8.2 or later · >= 2.3.0, <= 2.8.1 · CVE-2026-33347 · GHSA-hh8v-hgvp-g3f5
- Medium, CVSS 6.9
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
PyPI nicegui · Upgrade to 3.9.0 or later · <= 3.8.0 · CVE-2026-33332 · GHSA-w5g8-5849-vj76 · amended
- Medium, CVSS 4.3
@keystone-6/core:
isFilterablebypass viacursorparameter in findMany (CVE-2025-46720 incomplete fix)npm @keystone-6/core · Upgrade to 6.5.2 or later · <= 6.5.1 · CVE-2026-33326 · GHSA-cgcg-q9jh-5pr2 · amended
- Medium, CVSS 5.7
Packetbeat does not properly validate an array index in multiple protocol parser components
Go github.com/elastic/beats/v7 · Upgrade to 7.0.0-alpha2.0.20260126223743-dec1b31111ec (pre-release) or later · < 7.0.0-alpha2.0.20260126223743-dec1b31111ec · CVE-2026-26933 · GHSA-27qj-9gvp-8rh9
- Medium, CVSS 5.7
Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service
Go github.com/elastic/beats/v7 · Upgrade to 7.0.0-alpha2.0.20260112100137-de072c4e371e (pre-release) or later · < 7.0.0-alpha2.0.20260112100137-de072c4e371e · CVE-2026-26931 · GHSA-5vrw-qjxw-89r5
- Medium, CVSS 6.9
PyMuPDF has a path traversal in _main_.py
PyPI pymupdf · Upgrade to 1.26.7 or later · >= 1.26.5, < 1.26.7 · CVE-2026-3029 · GHSA-cxqh-p2w9-fmr7 · amended
- Medium, CVSS 6.3
Parse Server email verification resend page leaks user existence
npm parse-server · Upgrade to 9.6.0-alpha.40 (pre-release) or 8.6.51 by release line · >= 9.0.0, < 9.6.0-alpha.40; < 8.6.51 · CVE-2026-33323 · GHSA-h29g-q5c2-9h4f · amended
- High, CVSS 8.1
skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version
PyPI skia-python · Upgrade to 144.0.post1; some affected versions have no fix yet · >= 144.0, <= 144.0; <= 138.0 · GHSA-2mhw-8qcg-gr96 · amended
- Medium, CVSS 6.5
Improper Authentication and Origin Validation Error in pyload-ng
PyPI pyload-ng · Upgrade to 0.5.0b3.dev97 (pre-release) or later · <= 0.5.0b3.dev96 · CVE-2026-33314 · GHSA-q485-cg9q-xq2r · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.