Medium, CVSS 6.3
n8n has a Guardrail Node Bypass
npm n8n · Upgrade to 2.10.0 or later · < 2.10.0 · CVE-2026-56349 · GHSA-fvfv-ppw4-7h2w · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9876–9900 of 31,071 matching · newest first
- Medium, CVSS 6.3
n8n has an Authentication Bypass in its Chat Trigger Node
npm n8n · Upgrade to 2.10.1, 2.9.3 or 1.123.22 by release line · < 1.123.22; >= 2.0.0, < 2.9.3; >= 2.10.0, < 2.10.1 · CVE-2026-56353 · GHSA-jh8h-6c9q-7gmw · amended
- Medium, CVSS 6.0
n8n has an SSO Enforcement Bypass in its Self-Service Settings API
npm n8n · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-56350 · GHSA-vjf3-2gpj-233v · amended
- High, CVSS 7.5
Koa has Host Header Injection via ctx.hostname
npm koa · Upgrade to 3.1.2 or 2.16.4 by release line · >= 3.0.0, < 3.1.2; < 2.16.4 · CVE-2026-27959 · GHSA-7gcc-r8m5-44qm · amended
- Medium, CVSS 5.4
Copyparty vulnerable to reflected XSS via setck parameter
PyPI copyparty · Upgrade to 1.20.9 or later · < 1.20.9 · CVE-2026-27948 · GHSA-62cr-6wp5-q43h · amended
- Low, CVSS 2.7
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
npm fast-xml-parser · Upgrade to 5.3.8 or 4.5.4 by release line · >= 5.0.0, < 5.3.8; >= 4.0.0-beta.0, < 4.5.4 · CVE-2026-27942 · GHSA-fj3w-jwp8-x2g3 · amended
- Medium, CVSS 5.3
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
npm svelte · Upgrade to 5.53.5 or later · >= 5.53.0, < 5.53.5 · CVE-2026-27902 · GHSA-qgvg-pr8v-6rr3 · amended
- Medium, CVSS 5.3
Svelte vulnerable to XSS during SSR with contenteditable
bind:innerTextandbind:textContentnpm svelte · Upgrade to 5.53.5 or later · <= 5.53.4 · CVE-2026-27901 · GHSA-phwv-c562-gvmh · amended
- High, CVSS 8.8
WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level
Go github.com/h44z/wg-portal · Upgrade to 2.1.3 or later · <= 2.1.2 · CVE-2026-27899 · GHSA-5rmx-256w-8mj9
- High, CVSS 7.0
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
Go github.com/modelcontextprotocol/go-sdk · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-27896 · GHSA-wvj2-96wp-fq3f
- High, CVSS 7.5
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
npm minimatch · Upgrade to 10.2.3, 9.0.7, 8.0.6 or 5 more by release line · >= 10.0.0, < 10.2.3; >= 9.0.0, < 9.0.7; >= 8.0.0, < 8.0.6; >= 7.0.0, < 7.4.8; >= 6.0.0, < 6.2.2; >= 5.0.0, < 5.1.8; >= 4.0.0, < 4.2.5; < 3.1.3 · CVE-2026-27903 · GHSA-7r86-cg39-jmmj · amended
- High, CVSS 7.5
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
npm minimatch · Upgrade to 10.2.3, 9.0.7, 8.0.6 or 5 more by release line · >= 10.0.0, < 10.2.3; >= 9.0.0, < 9.0.7; >= 8.0.0, < 8.0.6; >= 7.0.0, < 7.4.8; >= 6.0.0, < 6.2.2; >= 5.0.0, < 5.1.8; >= 4.0.0, < 4.2.5; < 3.1.4 · CVE-2026-27904 · GHSA-23c5-xmqv-rm74 · amended
- Medium, CVSS 6.6
pypdf: Manipulated FlateDecode XFA streams can exhaust RAM
PyPI pypdf · Upgrade to 6.7.3 or later · < 6.7.3 · CVE-2026-27888 · GHSA-x7hp-r3qg-r3cj · amended
- Medium, CVSS 6.3
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()
npm dottie · Upgrade to 2.0.7 or later · >= 2.0.4, <= 2.0.6 · CVE-2026-27837 · GHSA-r5mx-6wc6-7h9w · amended
- High, CVSS 7.1
Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.80.1 or later · < 4.80.1 · CVE-2026-27465 · GHSA-2v6m-6xw3-6467
- Medium, CVSS 4.3
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
PyPI weblate · Upgrade to 5.16.1 or later · < 5.16.1 · CVE-2026-27457 · GHSA-wppc-7cq7-cgfv · amended
- Medium, CVSS 5.0
Fleet: Authorization Bypass in certificate template batch deletion for team administrators
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.80.1 or later · < 4.80.1 · CVE-2026-25963 · GHSA-5jvp-m9h4-253h
- Medium, CVSS 6.3
Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.80.1 or later · < 4.80.1 · CVE-2026-24004 · GHSA-9pm7-6g36-6j78
- Medium, CVSS 4.1
Fleet: Device lock PIN can be predicted if lock time is known
Go github.com/fleetdm/fleet/v4 · Upgrade to 4.80.1 or later · < 4.80.1 · CVE-2026-23999 · GHSA-ppwx-5jq7-px2w
- Medium, CVSS 6.3
n8n: Webhook Forgery on Github Webhook Trigger
npm n8n · Upgrade to 2.5.0 or 1.123.15 by release line · < 1.123.15; >= 2.0.0, < 2.5.0 · CVE-2026-56357 · GHSA-mqpr-49jj-32rc · amended
- Medium, CVSS 5.3
n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes
npm n8n · Upgrade to 2.4.0 or later · < 2.4.0 · CVE-2026-56351 · GHSA-f3f2-mcxc-pwjx · amended
- High, CVSS 8.7
TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist
npm terriajs-server · Upgrade to 4.0.3 or later · < 4.0.3 · CVE-2026-27818 · GHSA-w789-49fc-v8hr · amended
- Medium, CVSS 6.8
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
PyPI psd-tools · Upgrade to 1.12.2 or later · < 1.12.2 · CVE-2026-27809 · GHSA-24p2-j2jr-386w · amended
- Medium, CVSS 5.8
Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API
Go github.com/axllent/mailpit · Upgrade to 1.29.2 or later · <= 1.29.1 · CVE-2026-27808 · GHSA-mpf7-p9x7-96r3
- Medium, CVSS 6.4
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
PyPI mcp-server-git · Upgrade to 2026.1.14 or later · < 2026.1.14 · CVE-2026-27735 · GHSA-vjqx-cfc4-9h6v · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.