High, CVSS 8.3
PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution
PyPI pyspector · Upgrade to 0.1.7 or later · <= 0.1.6 · CVE-2026-33139 · GHSA-v3xv-8vc3-h2m6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9026–9050 of 31,057 matching · newest first
- Medium, CVSS 5.9
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
npm h3 · Upgrade to 2.0.1-rc.15 (pre-release) or 1.15.6 by release line · >= 2.0.0, <= 2.0.1-rc.14; < 1.15.6 · CVE-2026-86253 · GHSA-wr4h-v87w-p3r7 · amended
- High, CVSS 7.4
h3 has a middleware bypass with one gadget
npm h3 · Upgrade to 2.0.1-rc.15 (pre-release) or later · >= 2.0.0-0, < 2.0.1-rc.15 · CVE-2026-33131 · GHSA-3vj8-jmxq-cgj5 · amended
- Medium, CVSS 5.9
h3 has an observable timing discrepancy in basic auth utils
npm h3 · Upgrade to 2.0.1-rc.9 (pre-release) or later · >= 2.0.0-beta.0, <= 2.0.0-rc.8 · CVE-2026-33129 · GHSA-26f5-8h2x-34xh · amended
- High, CVSS 7.5
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
npm h3 · Upgrade to 2.0.1-rc.15 (pre-release) or 1.15.6 by release line · >= 2.0.0, <= 2.0.1-rc.14; < 1.15.6 · CVE-2026-33128 · GHSA-22cc-p3c6-wpvm · amended
- Medium, CVSS 5.1
pypdf has inefficient decoding of array-based streams
PyPI pypdf · Upgrade to 6.9.1 or later · < 6.9.1 · CVE-2026-33123 · GHSA-qpxp-75px-xjcp · amended
- Medium, CVSS 5.2
The mailqueue TYPO3 extension has Insecure Deserialization in
TransportFailureclassPackagist cpsit/typo3-mailqueue · Upgrade to 0.5.2 or 0.4.5 by release line · < 0.4.5; >= 0.5.0, < 0.5.2 · CVE-2026-1323 · GHSA-2pm6-9fhx-vvg3
- Medium, CVSS 6.1
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
npm @pdfme/schemas · Upgrade to 5.5.9 or later · <= 5.5.8 · CVE-2026-82868 · GHSA-87v3-4cfp-cm76 · amended
- Medium, CVSS 6.1
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
npm @pdfme/schemas · Upgrade to 5.5.9 or later · <= 5.5.8 · CVE-2026-82867 · GHSA-qq9g-96v4-m3cj · amended
- High, CVSS 8.6
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
npm @capgo/cli · Upgrade to 7.84.6 or later · < 7.84.6 · CVE-2026-56236 · GHSA-8mpm-q7mh-8fvh · amended
- Medium, CVSS 5.3
SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260317012524-fe4523fff2c8 (pre-release) or later · < 0.0.0-20260317012524-fe4523fff2c8 · CVE-2026-33067 · GHSA-mvpm-v6q4-m2pf
- Medium, CVSS 5.3
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260314111550-b382f50e1880 (pre-release) or later · < 0.0.0-20260314111550-b382f50e1880 · CVE-2026-33066 · GHSA-4663-4mpg-879v
- High, CVSS 7.5
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
PyPI ujson · Upgrade to 5.12.0 or later · >= 5.1.0, <= 5.11.0 · CVE-2026-32875 · GHSA-c8rr-9gxc-jprv · amended
- High, CVSS 7.5
UltraJSON has a Memory Leak parsing large integers allows DoS
PyPI ujson · Upgrade to 5.12.0 or later · >= 5.4.0, <= 5.11.0 · CVE-2026-32874 · GHSA-wgvc-ghv9-3pmm · amended
- High, CVSS 8.2
Heimdall: Path received via Envoy gRPC corrupted when containing query string
Go github.com/dadrus/heimdall · Upgrade to 0.17.11 or later · >= 0.7.0-alpha, <= 0.17.10 · CVE-2026-32811 · GHSA-r8x2-fhmf-6mxp
- High, CVSS 7.5
github.com/buger/jsonparser has a denial of service vulnerability
Go github.com/buger/jsonparser · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-32285 · GHSA-6g7g-w4f8-9c9x
- Medium, CVSS 5.7
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.85 or later · < 0.4.85 · CVE-2026-33060 · GHSA-3xm7-qw7j-qc8v · amended
- High, CVSS 8.2
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using
Kysely.npm kysely · Upgrade to 0.28.12 or later · >= 0.26.0, <= 0.28.11 · CVE-2026-32763 · GHSA-wmrf-hv6w-mr66 · amended
- Medium, CVSS 4.8
Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121
Go github.com/argoproj-labs/terraform-provider-argocd · Upgrade to 1.2.3-0.20260316182343-b3364f3f32e7 (pre-release) or later · < 1.2.3-0.20260316182343-b3364f3f32e7 · GHSA-594f-3595-c47v
- High, CVSS 7.1
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
PyPI langflow · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-33053 · GHSA-rf6x-r45m-xv3w · amended
- Medium, CVSS 5.3
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Packagist craftcms/cms · Upgrade to 5.9.11 or later · >= 5.9.0-beta.1, <= 5.9.10 · CVE-2026-33051 · GHSA-3x4w-mxpf-fhqq
- Medium, CVSS 5.4
Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite
Packagist yoast/duplicate-post · Upgrade to 4.6 or later · <= 4.5 · CVE-2026-1217 · GHSA-g9w4-m5fx-x3wv
- High, CVSS 8.8
SQL Injection in Spring AI MariaDBFilterExpressionConverter
Maven org.springframework.ai:spring-ai-mariadb-store · Upgrade to 1.1.3 or 1.0.4 by release line · >= 1.1.0-M1, < 1.1.3; < 1.0.4 · CVE-2026-22730 · GHSA-c267-rfvc-mvpm
- High, CVSS 8.6
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
Maven org.springframework.ai:spring-ai-vector-store · Upgrade to 1.1.3 or 1.0.4 by release line · >= 1.1.0-M1, < 1.1.3; < 1.0.4 · CVE-2026-22729 · GHSA-rp9g-qx29-88cp
- Medium, CVSS 5.3
Keycloak: Denial of Service due to excessive SAMLRequest decompression
Maven org.keycloak:keycloak-services +2 · Upgrade all 3 to 26.5.4 or later · < 26.5.4 · CVE-2026-2575 · GHSA-xv6h-r36f-3gp5
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.