Critical, CVSS 9.3
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
npm @feathersjs/mongodb · Upgrade to 5.0.42 or later · >= 5.0.0, <= 5.0.41 · CVE-2026-29793 · GHSA-p9xr-7p9p-gpqx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9401–9425 of 31,071 matching · newest first
- Critical, CVSS 9.3
Feathers has an OAuth Callback Account Takeover issue
npm @feathersjs/authentication-oauth · Upgrade to 5.0.42 or later · >= 5.0.0, <= 5.0.41 · CVE-2026-29792 · GHSA-wg9x-qfgw-pxhj · amended
- Medium, CVSS 4.8
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.4 or later · < 14.10.4 · CVE-2026-28692 · GHSA-mrmj-x24c-wwcv
- Medium, CVSS 6.3
ImageMagick has a Path Policy TOCTOU symlink race bypass
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.4 or later · < 14.10.4 · CVE-2026-28689 · GHSA-493f-jh8w-qhx3
- Critical, CVSS 9.0
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
PyPI mcp-atlassian · Upgrade to 0.17.0 or later · < 0.17.0 · CVE-2026-27825 · GHSA-xjgw-4wvw-rgm4 · amended
- High, CVSS 8.2
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
PyPI mcp-atlassian · Upgrade to 0.17.0 or later · < 0.17.0 · CVE-2026-27826 · GHSA-7r34-79r5-rcc9 · amended
- Critical, CVSS 9.8
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
npm simple-git · Upgrade to 3.32.3 or later · >= 3.15.0, < 3.32.3 · CVE-2026-28292 · GHSA-r275-fr43-pm7q · amended
- Medium, CVSS 5.3
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
Maven com.vaadin:vaadin +1 · Upgrade all 2 to 25.0.2, 24.9.8, 23.6.7 or 14.14.1 by release line · >= 25.0.0, < 25.0.2; >= 24.0.0, < 24.9.8; >= 23.0.0, < 23.6.7; < 14.14.1 · CVE-2026-2742 · GHSA-rjgh-wgc7-m37j
- High, CVSS 8.8
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
npm @azure/mcp · Upgrade to 2.0.0-beta.17 (pre-release) or 1.0.2 by release line · >= 2.0.0-beta.1, < 2.0.0-beta.17; >= 1.0.0, < 1.0.2 · +2 more packages · CVE-2026-26118 · GHSA-hhfx-wfvq-7g9c · amended
- Medium, CVSS 5.3
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
Maven org.apache.pdfbox:pdfbox-examples · Upgrade to 3.0.7 or later · >= 2.0.24, < 3.0.7 · CVE-2026-23907 · GHSA-jjwr-xmw6-gf78
- High, CVSS 7.5
LimeSurvey is vulnerable to SQL injection
Packagist limesurvey/limesurvey · Upgrade to 6.15.4 or later · < 6.15.4 · CVE-2025-56421 · GHSA-rccq-2fxq-7x3h
- High, CVSS 7.5
Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation
Go github.com/envoyproxy/envoy · Upgrade to 1.37.1, 1.36.5, 1.35.9 or 1.34.13 by release line · >= 1.37.0, <= 1.37.0; >= 1.36.0, <= 1.36.4; >= 1.35.0, <= 1.35.8; <= 1.34.12 · CVE-2026-26308 · GHSA-ghc4-35x6-crw5
- Critical, CVSS 9.3
Parse Server: SQL injection via dot-notation field name in PostgreSQL
npm parse-server · Upgrade to 9.6.0-alpha.2 (pre-release) or 8.6.28 by release line · >= 9.0.0, < 9.6.0-alpha.2; < 8.6.28 · CVE-2026-31840 · GHSA-qpr4-jrj4-6f27 · amended
- Medium, CVSS 6.3
Craft Commerce: Potential IDOR in Commerce carts
Packagist craftcms/commerce · Upgrade to 5.6.0 or 4.11.0 by release line · >= 5.0.0, < 5.6.0; >= 4.0.0, < 4.11.0 · CVE-2026-31867 · GHSA-vff3-pqq8-4cpq
- Low, CVSS 1.9
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Packagist craftcms/commerce · Upgrade to 5.5.3 or 4.10.2 by release line · >= 4.0.0, <= 4.10.1; >= 5.0.0, <= 5.5.2 · CVE-2026-29177 · GHSA-mj32-r678-7mvp
- Medium, CVSS 4.8
Craft Commerce has stored XSS in Inventory Location Name
Packagist craftcms/commerce · Upgrade to 5.5.3 or later · >= 5.0.0, <= 5.5.2 · CVE-2026-29176 · GHSA-wj89-2385-gpx3
- High, CVSS 8.6
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
Packagist craftcms/commerce · Upgrade to 5.5.3 or later · >= 5.0.0, <= 5.5.2 · CVE-2026-29175 · GHSA-cfpv-rmpf-f624
- High, CVSS 8.7
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Packagist craftcms/commerce · Upgrade to 5.5.3 or later · >= 5.0.0, <= 5.5.2 · CVE-2026-29174 · GHSA-pmgj-gmm4-jh6j
- Low, CVSS 1.9
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
Packagist craftcms/commerce · Upgrade to 5.5.3 or 4.10.2 by release line · >= 4.0.0, <= 4.10.1; >= 5.0.0, <= 5.5.2 · CVE-2026-29173 · GHSA-mqxf-2998-c6cp
- High, CVSS 8.7
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
Packagist craftcms/commerce · Upgrade to 5.5.3 or 4.10.2 by release line · >= 4.0.0, <= 4.10.1; >= 5.0.0, <= 5.5.2 · CVE-2026-29172 · GHSA-j3x5-mghf-xvfw
- Low, CVSS 2.3
Craft CMS has a potential information disclosure vulnerability in preview tokens
Packagist craftcms/cms · Upgrade to 5.9.7 or 4.17.3 by release line · >= 4.0.0-RC1, < 4.17.3; >= 5.0.0-RC1, < 5.9.7 · CVE-2026-29113 · GHSA-vg3j-hpm9-8v5v
- High, CVSS 8.8
StudioCMS has Privilege Escalation via Insecure API Token Generation
npm studiocms · Upgrade to 0.4.0 or later · <= 0.3.0 · CVE-2026-30944 · GHSA-667w-mmh7-mrr4 · amended
- Medium, CVSS 4.6
copyparty: volflag
nohtmldid not block javascript in svg filesPyPI copyparty · Upgrade to 1.20.11 or later · <= 1.20.10 · CVE-2026-30974 · GHSA-m6hv-x64c-27mm · amended
- Medium, CVSS 5.4
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
Packagist web-auth/webauthn-symfony-bundle +2 · Upgrade all 3 to 5.2.4 or later · >= 5.2.0, < 5.2.4 · CVE-2026-30964 · GHSA-f7pm-6hr8-7ggm
- Critical, CVSS 9.4
RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface
crates.io rssn · Upgrade to 0.2.9 or later · < 0.2.9 · CVE-2026-30960 · GHSA-9c4h-pwmf-m6fj
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.