Unrated
Incorrect parsing of IPv6 host literals in net/url
Go stdlib · Upgrade to 1.26.1 or 1.25.8 by release line · < 1.25.8; >= 1.26.0-0, < 1.26.1 · CVE-2026-25679 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9501–9525 of 31,071 matching · newest first
- High, CVSS 8.2
Flowise has Arbitrary File Upload via MIME Spoofing
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30821 · GHSA-j8g8-j7fc-43v6 · amended
- High, CVSS 8.7
Flowise has Authorization Bypass via Spoofed x-request-from Header
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-30820 · GHSA-wvhq-wp8g-c7vq · amended
- Low, CVSS 2.7
Mercurius's queryDepth limit bypassed for WebSocket subscriptions
npm mercurius · Upgrade to 16.8.0 or later · < 16.8.0 · CVE-2026-30241 · GHSA-m4h2-mjfm-mp55 · amended
- High, CVSS 8.5
parse-server's endpoint
/loginAsallowsreadOnlyMasterKeyto gain full read and write access as any usernpm parse-server · Upgrade to 9.5.0-alpha.4 (pre-release) or 8.6.6 by release line · < 8.6.6; >= 9.0.0, < 9.5.0-alpha.4 · CVE-2026-30229 · GHSA-79wj-8rqv-jvp5 · amended
- Medium, CVSS 6.9
parse-server's file creation and deletion bypasses
readOnlyMasterKeywrite restrictionnpm parse-server · Upgrade to 9.5.0-alpha.3 (pre-release) or 8.6.5 by release line · >= 9.0.0, < 9.5.0-alpha.3; < 8.6.5 · CVE-2026-30228 · GHSA-xfh7-phr7-gr2x · amended
- Medium, CVSS 5.3
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
npm workflow +1 · Upgrade all 2 to 4.2.0-beta.64 (pre-release) or later · <= 4.1.0-beta.63 · GHSA-9r75-g2cr-3h76 · amended
- High, CVSS 7.5
PinchTab has SSRF with Full Response Exfiltration via Download Handler
Go github.com/pinchtab/pinchtab/cmd/pinchtab · Upgrade to 0.7.7 or later · <= 0.7.6 · CVE-2026-30834 · GHSA-rw8p-c6hf-q3pg
- Low, CVSS 2.1
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
npm defuddle · Upgrade to 0.9.0 or later · <= 0.7.0 · CVE-2026-30830 · GHSA-5mq8-78gm-pjmq · amended
- High, CVSS 7.5
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
npm express-rate-limit · Upgrade to 8.2.2, 8.1.1 or 8.0.2 by release line · >= 8.2.0, < 8.2.2; >= 8.1.0, <= 8.1.0; >= 8.0.0, < 8.0.2 · CVE-2026-30827 · GHSA-46wh-pxpv-q5gq · amended
- High, CVSS 8.7
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
Packagist snipe/snipe-it · Upgrade to 8.3.7 or later · < 8.3.7 · CVE-2025-15602 · GHSA-5448-v74m-7mv7
- High, CVSS 7.7
CoreDNS ACL Bypass
Go github.com/coredns/coredns · Upgrade to 1.14.2 or later · < 1.14.2 · CVE-2026-26017 · GHSA-c9v3-4pv7-87pr
- High, CVSS 7.5
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
npm @github/copilot · Upgrade to 0.0.423 or later · <= 0.0.422 · CVE-2026-29783 · GHSA-g8r9-g2v8-jv6f · amended
- High, CVSS 8.4
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality
PyPI sagemaker · Upgrade to 3.4.0 or later · >= 3.0.0, < 3.4.0 · GHSA-5r2p-pjr8-7fh7 · amended
- Medium, CVSS 6.9
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-56267 · GHSA-jc5m-wrp2-qq38 · amended
- Medium, CVSS 5.6
Flowise has Insufficient Password Salt Rounds
npm flowise · Upgrade to 3.0.13 or later · <= 3.0.12 · CVE-2026-56272 · GHSA-x2g5-fvc2-gqvp · amended
- Medium, CVSS 6.9
MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery
NuGet mimekit · Upgrade to 4.15.1 or later · <= 4.15.0 · CVE-2026-30227 · GHSA-g7hc-96xr-gvvx
- Medium, CVSS 5.9
WeKnora is Vulnerable to SSRF via Redirection
Go github.com/Tencent/WeKnora · Upgrade to 0.2.12 or later · <= 0.2.11 · CVE-2026-30247 · GHSA-595m-wc8g-6qgc
- High, CVSS 8.5
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
PyPI plane · Upgrade to 1.2.3 or later · <= 1.2.1 · CVE-2026-30242 · GHSA-fpx8-73gf-7x73 · amended
- Medium, CVSS 5.3
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
PyPI mcp-memory-service · Upgrade to 10.21.0 or later · < 10.21.0 · CVE-2026-29787 · GHSA-73hc-m4hx-79pj · amended
- Low, CVSS 3.7
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
Maven org.eclipse.jetty:jetty-http · Upgrade to 12.1.5 or 12.0.31 by release line; some affected versions have no fix yet · >= 9.4.0, <= 9.4.58; >= 10.0.0, <= 10.0.26; >= 11.0.0, <= 11.0.26; >= 12.0.0, <= 12.0.30; >= 12.1.0, <= 12.1.4 · CVE-2025-11143 · GHSA-wjpw-4j6x-6rwh
- Medium, CVSS 6.5
Cloudfoundry UAA has logic error in the token revocation endpoint implementation
Maven org.cloudfoundry.identity:cloudfoundry-identity-server · Upgrade to 78.8.0 or later · >= 77.30.0, < 78.8.0 · CVE-2026-22723 · GHSA-6wcw-r64p-qrrw
- High, CVSS 8.1
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
Maven org.keycloak:keycloak-services · Upgrade to 26.5.5 or later · < 26.5.5 · CVE-2026-3009 · GHSA-m297-3jv9-m927
- Medium, CVSS 5.8
Fonoster is vulnerable to directory traversal
npm @fonoster/voice · Upgrade to 0.6.1 or later · >= 0.5.5, < 0.6.1 · CVE-2024-43035 · GHSA-9fv2-c7v6-p45w · amended
- High, CVSS 7.7
RAGAS has an Arbitrary File Read vulnerability
PyPI ragas · Upgrade to 0.3.0rc1 (pre-release) or later · >= 0.2.3, < 0.3.0rc1 · CVE-2025-45691 · GHSA-v2xr-wvrv-p969
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.