Medium, CVSS 5.5
Python-Markdown has an Uncaught Exception
PyPI markdown · Upgrade to 3.8.1 or later · < 3.8.1 · CVE-2025-69534 · GHSA-5wmx-573v-2qwq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9551–9575 of 31,071 matching · newest first
- Medium, CVSS 5.1
django-allauth has an open redirect vulnerability
PyPI django-allauth · Upgrade to 65.14.1 or later · < 65.14.1 · CVE-2026-27982 · GHSA-2jpr-83rg-v67j · amended
- Medium, CVSS 4.9
Agentgateway is missing parameter sanitization in MCP to OpenAPI conversion
Go github.com/agentgateway/agentgateway · Upgrade to 0.12.0 or later · < 0.12.0 · CVE-2026-29791 · GHSA-v2x6-wwfw-r2rq
- Low, CVSS 2.0
dbt-common's commonprefix() doesn't protect against path traversal
PyPI dbt-common · Upgrade to 1.37.3 or 1.34.2 by release line · < 1.34.2; >= 1.35.0, < 1.37.3 · CVE-2026-29790 · GHSA-w75w-9qv4-j5xj · amended
- High, CVSS 7.7
OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint
npm @opennextjs/cloudflare · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2025-6087 · GHSA-c7mq-gh6q-6q7c · amended
- High, CVSS 8.2
tar has Hardlink Path Traversal via Drive-Relative Linkpath
npm tar · Upgrade to 7.5.10 or later · <= 7.5.9 · CVE-2026-29786 · GHSA-qffp-2rhf-9h96 · amended
- High, CVSS 7.5
Ghost has incomplete CSRF protections around OTC use
npm ghost · Upgrade to 6.19.3 or later · >= 5.101.6, <= 6.19.2 · CVE-2026-29784 · GHSA-9m84-wc28-w895 · amended
- Critical, CVSS 10.0
zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
crates.io zeptoclaw · Upgrade to 0.6.2 or later · <= 0.6.1 · GHSA-5wp8-q9mx-8jx8
- High, CVSS 7.5
zeptoclaw has Android device shell blocklist bypass via argument permutation
crates.io zeptoclaw · Upgrade to 0.6.2 or later · <= 0.6.1 · GHSA-hhjv-jq77-cmvx
- High, CVSS 8.6
Parse Server's Cloud Hooks and Cloud Jobs bypass
readOnlyMasterKeywrite restrictionnpm parse-server · Upgrade to 9.4.1-alpha.3 (pre-release) or 8.6.4 by release line · >= 9.0.0, <= 9.4.1-alpha.2; <= 8.6.3 · CVE-2026-29182 · GHSA-vc89-5g3r-cmhh · amended
- High, CVSS 7.1
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
PyPI pyload-ng · Upgrade to 0.5.0b3.dev97 (pre-release) or later · >= 0.5.0b3.dev13, <= 0.5.0b3.dev96 · CVE-2026-29778 · GHSA-6px9-j4qr-xfjw · amended
- Critical, CVSS 10.0
pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT
Maven org.pac4j:pac4j-jwt · Upgrade to 6.3.3, 5.7.9 or 4.5.9 by release line · >= 6.0.4.1, < 6.3.3; >= 5.0.0-RC1, < 5.7.9; < 4.5.9 · CVE-2026-29000 · GHSA-pm7g-w2cf-q238
- High, CVSS 8.7
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
npm multer · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-3520 · GHSA-5528-5vmv-3xc2 · amended
- Low, CVSS 2.0
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
npm @backstage/plugin-scaffolder-backend · Upgrade to 3.1.4 or later · <= 3.1.3 · CVE-2026-29184 · GHSA-8qp7-fhr9-fw53 · amended
- Low, CVSS 2.7
Backstage vulnerable to potential reading of SCM URLs using built in token
npm @backstage/integration · Upgrade to 1.20.1 or later · <= 1.20.0 · CVE-2026-29185 · GHSA-95v5-prp4-5gv5 · amended
- Medium, CVSS 5.5
eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
PyPI eml-parser · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2026-29780 · GHSA-389r-rccm-h3h5 · amended
- High, CVSS 7.7
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
npm @backstage/plugin-techdocs-node · Upgrade to 1.14.3 or later · <= 1.14.2 · CVE-2026-29186 · GHSA-928r-fm4v-mvrw · amended
- High, CVSS 7.5
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
npm svgo · Upgrade to 4.0.1, 3.3.3 or 2.8.1 by release line · >= 2.1.0, < 2.8.1; >= 3.0.0, < 3.3.3; >= 4.0.0, <= 4.0.0 · CVE-2026-29074 · GHSA-xpqw-6gx7-v673 · amended
- High, CVSS 7.7
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover
Go github.com/zitadel/zitadel +1 · Upgrade all 2 to 4.12.0 or later · >= 4.0.0, < 4.12.0 · CVE-2026-29192 · GHSA-6rx5-m2rc-hmf7
- High, CVSS 8.2
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication
Go github.com/zitadel/zitadel +1 · Upgrade all 2 to 4.12.1 or later · >= 4.0.0, <= 4.12.0 · CVE-2026-29193 · GHSA-25rw-g6ff-fmg8
- Critical, CVSS 9.3
ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint
Go github.com/zitadel/zitadel +1 · Upgrade all 2 to 4.12.0 or later · >= 4.0.0, < 4.12.0 · CVE-2026-29191 · GHSA-pr34-2v5x-6qjq
- Critical, CVSS 9.1
File Browser's TUS Delete Endpoint Bypasses Delete Permission Check
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.61.1 or later · <= 2.61.0 · CVE-2026-29188 · GHSA-79pf-vx4x-7jmm
- High, CVSS 8.7
Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint
Go github.com/gravitl/netmaker · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2026-29771 · GHSA-rhr9-hgcm-x289
- Critical, CVSS 9.3
SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260304034809-d68bd5a79391 (pre-release) or later · < 0.0.0-20260304034809-d68bd5a79391 · CVE-2026-29183 · GHSA-6865-qjcf-286f
- High, CVSS 8.6
NLTK has a Path Traversal issue
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-0847 · GHSA-68j8-pq59-fqgm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.