High, CVSS 7.8
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61433 · GHSA-79fv-7hq9-w7xg · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1101–1125 of 30,910 matching · newest first
- High, CVSS 8.2
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61435 · GHSA-2gpf-2492-q9jh · amended
- Medium, CVSS 5.5
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61431 · GHSA-q7m5-3jmv-vm48 · amended
- High, CVSS 7.5
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
PyPI datamodel-code-generator · Upgrade to 0.81.0 or later · >= 0.59.0, <= 0.80.0 · CVE-2026-107377 · GHSA-77xj-x4rm-935c · amended
- Medium, CVSS 5.5
PraisonAI: Project custom command templates can read outside-workspace files into model prompts
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60088 · GHSA-xpx6-x8c2-mw5w · amended
- Medium, CVSS 4.7
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
npm handlebars · Upgrade to 4.7.10 or later · >= 4.0.0, <= 4.7.9 · CVE-2026-106444 · GHSA-xw65-4hp5-5hc7 · amended
- Critical, CVSS 9.8
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
npm handlebars · Upgrade to 4.7.10 or later · >= 4.0.0, <= 4.7.9 · CVE-2026-106446 · GHSA-8r5x-fm3f-whwj · amended
- Critical, CVSS 9.2
Handlebars: JavaScript Injection via Own Property Check Bypass
npm handlebars · Upgrade to 4.7.10 or later · >= 3.0.0, <= 4.7.9 · CVE-2026-106445 · GHSA-p8wg-vrv2-v86f · amended
- Medium, CVSS 6.0
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
npm @langchain/mongodb · Upgrade to 1.3.1 or later · <= 1.3.0 · CVE-2026-106119 · GHSA-m6rx-h84q-8r95 · amended
- High, CVSS 8.7
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 (pre-release) or later · >= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2 · CVE-2026-107211 · GHSA-mx22-3794-2vpv · amended
- Medium, CVSS 6.5
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
PyPI pydantic-ai +1 · Upgrade all 2 to 2.52.0 or 1.107.7 by release line · >= 1.77.0, < 1.107.7; >= 2.0.0b1, < 2.52.0 · CVE-2026-107287 · GHSA-v36g-jcw9-x7cw · amended
- High, CVSS 8.8
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
npm generator-jhipster · Upgrade to 9.4.0 or later · >= 7.0.0, < 9.4.0 · CVE-2026-107375 · GHSA-r223-96jv-q533 · amended
- High, CVSS 7.6
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
npm generator-jhipster · Upgrade to 9.4.0 or later · < 9.4.0 · +1 more package · CVE-2026-107303 · GHSA-9ffp-22j7-56r2 · amended
- High, CVSS 7.5
msgpack5: Truncated map32 headers throw an unexpected error
npm msgpack5 · Upgrade to 6.1.0 or later · >= 4.1.0, < 6.1.0 · CVE-2026-107302 · GHSA-8f34-f56x-9xph · amended
- High, CVSS 7.5
msgpack5: Many buffered values can exhaust the streaming decoder stack
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107300 · GHSA-5x5g-h9x8-2fh9 · amended
- Medium, CVSS 5.9
msgpack5: Reserved byte can cause unbounded stream buffering
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107299 · GHSA-26wq-p25c-j6fv · amended
- Medium, CVSS 6.5
msgpack5: Partial options disable prototype protection
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107301 · GHSA-8hq7-ggx2-cc6m · amended
- Medium, CVSS 5.3
msgpack5: Deeply nested input can exhaust the decoder stack
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107298 · GHSA-24ch-f2g6-9hhh · amended
- Medium, CVSS 5.9
msgpack5: Quadratic parsing in the streaming decoder
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107297 · GHSA-gcx5-hxj7-gpqq · amended
- Low, CVSS 3.7
msgpack5: Decoding negative int64 values mutates the input buffer
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107296 · GHSA-qw35-55vc-rhgj · amended
- Unrated
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60090 · GHSA-wf65-4jjx-q444 · amended
- Medium, CVSS 6.4
Pydantic AI Web chat UI (
Agent.to_web(),clai web): the local chat endpoint does not validate theHostheaderPyPI pydantic-ai +1 · Upgrade all 2 to 2.30.0 or 1.107.5 by release line · >= 1.34.0, < 1.107.5; >= 2.0.0b1, < 2.30.0 · CVE-2026-107292 · GHSA-q2xc-rrxj-58x9 · amended
- High, CVSS 7.6
Pydantic AI Web chat UI (
Agent.to_web(),clai web): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointPyPI pydantic-ai +1 · Upgrade all 2 to 2.28.0 or 1.107.4 by release line · >= 1.34.0, < 1.107.4; >= 2.0.0b1, < 2.28.0 · CVE-2026-107295 · GHSA-h4xc-3qfq-jf93 · amended
- Low, CVSS 2.3
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when
include_content=FalsePyPI pydantic-ai +1 · Upgrade all 2 to 2.27.1 or 1.107.4 by release line · >= 0.3.4, < 1.107.4; >= 2.0.0b1, < 2.27.1 · CVE-2026-107293 · GHSA-3gh4-cghq-f8v4 · amended
- Medium, CVSS 6.5
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
PyPI pydantic-ai +1 · Upgrade all 2 to 2.24.0 or 1.107.2 by release line · >= 1.77.0, < 1.107.2; >= 2.0.0b1, <= 2.23.0 · CVE-2026-107294 · GHSA-v2xh-2vp8-57h8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.