High, CVSS 8.1
FUXA has a hardcoded fallback JWT signing secret
npm @frangoteam/fuxa · Upgrade to 1.3.0 or later · <= 1.2.11 · CVE-2025-69971 · GHSA-c8m8-3jcr-6rj5 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9476–9500 of 31,071 matching · newest first
- Critical, CVSS 9.9
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
npm @oneuptime/common · Upgrade to 10.0.18 or later · < 10.0.18 · CVE-2026-30887 · GHSA-h343-gg57-2q67 · amended
- Medium, CVSS 5.5
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
Packagist wwbn/avideo · Upgrade to 25.0 or later · < 25.0 · CVE-2026-30885 · GHSA-6w2r-cfpc-23r5
- Medium, CVSS 6.5
PowerSync: Some sync filters ignored on 1.20.0 using
config.edition: 3npm @powersync/service-core · Upgrade to 1.20.1 or later · >= 1.20.0, <= 1.20.0 · +1 more package · CVE-2026-30870 · GHSA-q6wc-xx4m-92fj · amended
- Critical, CVSS 9.3
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.5.10 or later · < 3.5.10 · CVE-2026-30869 · GHSA-2h2p-mvfx-868w · amended
- High, CVSS 8.1
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
PyPI mcp-memory-service · Upgrade to 10.25.1 or later · < 10.25.1 · CVE-2026-33010 · GHSA-g9rg-8vq5-mpwm · amended
- Medium, CVSS 5.7
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
Packagist grumpydictator/firefly-iii · Upgrade to 6.5.1 or later · >= 6.4.23, <= 6.5.0 · GHSA-5q8v-j673-m5v4
- Critical, CVSS 10.0
WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
Go github.com/Tencent/WeKnora · Upgrade to 0.2.10 or later · >= 0.2.5, < 0.2.10 · CVE-2026-30861 · GHSA-r55h-3rwj-hcmg
- Critical, CVSS 10.0
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
Go github.com/Tencent/WeKnora · Upgrade to 0.2.12 or later · <= 0.2.11 · CVE-2026-30860 · GHSA-8w32-6mrw-q5wv
- High, CVSS 7.5
WeKnora has Broken Access Control - Cross-Tenant Data Exposure
Go github.com/Tencent/WeKnora · Upgrade to 0.2.12 or later · <= 0.2.11 · CVE-2026-30859 · GHSA-2f4c-vrjq-rcgv
- High, CVSS 7.5
WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources
Go github.com/Tencent/WeKnora · Upgrade to 0.3.0 or later · <= 0.2.14 · CVE-2026-30858 · GHSA-h6gw-8f77-mmmp
- Medium, CVSS 5.9
WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning
Go github.com/Tencent/WeKnora · Upgrade to 0.3.0 or later · <= 0.2.14 · CVE-2026-30857 · GHSA-8rf9-c59g-f82f
- Medium, CVSS 5.4
WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection
Go github.com/Tencent/WeKnora · Upgrade to 0.3.0 or later · <= 0.2.14 · CVE-2026-30856 · GHSA-67q9-58vj-32qx
- Critical, CVSS 9.8
WeKnora Vulnerable to Broken Access Control in Tenant Management
Go github.com/Tencent/WeKnora · Upgrade to 0.3.2 or later · <= 0.3.1 · CVE-2026-30855 · GHSA-ccj6-79j6-cq5q
- Medium, CVSS 5.5
Caddy's vars_regexp double-expands user input, leaking env vars and files
Go github.com/caddyserver/caddy/v2/modules/caddyhttp · Upgrade to 2.11.2 or later · >= 2.7.5, <= 2.11.1 · CVE-2026-30852 · GHSA-m2w3-8f23-hxxf
- High, CVSS 8.1
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Go github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy · Upgrade to 2.11.2 or later · >= 2.10.0, < 2.11.2 · CVE-2026-30851 · GHSA-7r4p-vjf4-gxv4
- Medium, CVSS 5.1
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
Packagist league/commonmark · Upgrade to 2.8.1 or later · >= 2.0.0, <= 2.8.0 · CVE-2026-30838 · GHSA-4v6x-c7xx-hw9f
- Medium, CVSS 6.9
parse-server: Malformed
$regexquery leaks database error details in API responsenpm parse-server · Upgrade to 9.5.0-alpha.6 (pre-release) or 8.6.7 by release line · >= 9.0.0, < 9.5.0-alpha.6; < 8.6.7 · CVE-2026-30835 · GHSA-9cp7-3q5w-j92g · amended
- High, CVSS 7.7
Flowise Missing Authentication on NVIDIA NIM Endpoints
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30824 · GHSA-5f53-522j-j454 · amended
- High, CVSS 8.8
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30823 · GHSA-cwc3-p92j-g7qm · amended
- High, CVSS 7.7
Flowise Allows Mass Assignment in
/api/v1/leadsEndpointnpm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30822 · GHSA-mq4r-h2gh-qv7x · amended
- Critical, CVSS 9.1
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
Go github.com/charmbracelet/soft-serve · Upgrade to 0.11.4 or later · >= 0.6.0, < 0.11.4 · CVE-2026-30832 · GHSA-3fvx-xrxq-8jvv
- High, CVSS 8.2
Zarf's symlink targets in archives are not validated against destination directory
Go github.com/zarf-dev/zarf/src/pkg/archive · Upgrade to 0.73.1 or later · >= 0.54.0, < 0.73.1 · CVE-2026-29064 · GHSA-hcm4-6hpj-vghm
- High, CVSS 7.5
CoreDNS Loop Detection Denial of Service Vulnerability
Go github.com/coredns/coredns · Upgrade to 1.14.2 or later · < 1.14.2 · CVE-2026-26018 · GHSA-h75p-j8xm-m278
- Unrated
Incorrect enforcement of email constraints in crypto/x509
Go stdlib · Upgrade to 1.26.1 or later · >= 1.26.0-0, < 1.26.1 · CVE-2026-27137 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.