Medium, CVSS 6.5
Backstage has sensitive information exposure in scaffolder task logs
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0 or later · < 4.1.0 · CVE-2026-106504 · GHSA-4xvq-3m68-h444 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1251–1275 of 30,910 matching · newest first
- Medium, CVSS 5.3
Backstage has improper input validation in scaffolder task list ordering
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0 or later · < 4.1.0 · CVE-2026-106506 · GHSA-vwp5-f99x-x3rq · amended
- High, CVSS 7.7
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106505 · GHSA-p75x-jh7p-ppcx · amended
- Medium, CVSS 5.3
Backstage has potential file exposure through local TechDocs publisher
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106508 · GHSA-cm77-ch27-6w6v · amended
- High, CVSS 7.7
Backstage: Improper validation of MkDocs theme configuration in TechDocs
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106509 · GHSA-8w7q-29mw-gf5c · amended
- High, CVSS 7.7
Backstage has improper input validation in TechDocs Markdown extension configuration
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106557 · GHSA-f7v3-xhm6-w245 · amended
- High, CVSS 7.1
Payload: Field-level write access bypass in Payload on MongoDB
npm @payloadcms/db-mongodb · Upgrade to 4.0.0-canary.20 (pre-release) or 3.87.0 by release line · < 3.87.0; >= 4.0.0-canary.0, < 4.0.0-canary.20 · CVE-2026-106100 · GHSA-4ww4-68q3-h7g5 · amended
- Medium, CVSS 5.7
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
Maven com.rabbitmq:amqp-client · Upgrade to 5.35.0 or later · <= 5.34.0 · CVE-2026-106123 · GHSA-h6w7-qmcm-q6xr · amended
- Medium, CVSS 6.0
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact,
.first/.last, negative index, and for-loop iterationnpm liquidjs · Upgrade to 10.27.2 or later · <= 10.27.1 · CVE-2026-106120 · GHSA-fwxr-j5w2-587m · amended
- High, CVSS 7.5
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
NuGet imagesharp +1 · Upgrade all 2 to 4.1.1 or 3.2.0 by release line · >= 3.0.0, < 3.2.0; >= 4.0.0, < 4.1.1 · CVE-2026-106118 · GHSA-v76p-62qx-wwq2 · amended
- High, CVSS 7.5
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
NuGet imagesharp · Upgrade to 4.1.1 or 3.2.0 by release line · >= 3.0.0, < 3.2.0; >= 4.0.0, < 4.1.1 · CVE-2026-106117 · GHSA-jj3q-cwqj-842r · amended
- High, CVSS 7.1
Langflow: IP Spoofing Bypass via
X-Forwarded-ForAllowing Remote Configuration WritePyPI langflow · Upgrade to 1.10.3 or later · >= 1.5.0, < 1.10.3 · CVE-2026-105741 · GHSA-4f6c-2vvp-gw82 · amended
- High, CVSS 7.1
Ghost: Authorization Bypass in Comments Feature
npm ghost · Upgrade to 6.44.1 or later · >= 5.9.0, < 6.44.1 · CVE-2026-105681 · GHSA-6q6j-f24j-p477 · amended
- Medium, CVSS 5.1
Ghost: Server-Side Request Forgery in Webhook Trigger
npm ghost · Upgrade to 6.27.0 or later · >= 1.18.0, < 6.27.0 · CVE-2026-105682 · GHSA-354h-gmhv-mr9c · amended
- Medium, CVSS 5.1
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
npm ghost · Upgrade to 6.27.0 or later · >= 6.14.0, < 6.27.0 · CVE-2026-105683 · GHSA-83rp-q473-j88c · amended
- Critical, CVSS 9.0
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-73487 · GHSA-w7x8-q2gp-5cgg · amended
- Critical, CVSS 9.4
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · < 3.1.3 · CVE-2026-73483 · GHSA-9gvv-qjj3-2p6g · amended
- High, CVSS 8.4
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
npm @quasar/cli · Upgrade to 5.0.4 or later · <= 5.0.3 · +2 more packages · CVE-2026-106105 · GHSA-fh39-c73x-5pjv · amended
- High, CVSS 7.1
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable
npm @quasar/render-ssr-error · Upgrade to 2.2.4 or later · <= 2.2.3 · +1 more package · CVE-2026-106106 · GHSA-r5mf-4r5x-q78f · amended
- High, CVSS 8.3
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
npm @quasar/app-vite · Upgrade to 3.3.0 or later · <= 3.2.0 · CVE-2026-106107 · GHSA-5m6h-8g35-p3m7 · amended
- Medium, CVSS 5.6
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
npm @quasar/app-vite · Upgrade to 3.3.0 or later · >= 3.1.0, < 3.3.0 · CVE-2026-106108 · GHSA-vhhq-m2gm-rwc9 · amended
- Medium, CVSS 4.1
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
npm @quasar/app-vite · Upgrade to 3.3.0 or later · >= 1.0.0, <= 3.2.0 · CVE-2026-106109 · GHSA-q9mq-245r-4g93 · amended
- High, CVSS 8.7
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
npm quasar · Upgrade to 2.23.3 or later · <= 2.23.2 · CVE-2026-106104 · GHSA-68jq-fhch-4xq4 · amended
- Critical, CVSS 10.0
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
npm quasar · Upgrade to 2.22.0 or later · < 2.22.0 · CVE-2026-106102 · GHSA-pq96-jpmf-w254 · amended
- High, CVSS 7.1
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
npm @quasar/icongenie · Upgrade to 6.1.1 or later · < 6.1.1 · CVE-2026-106103 · GHSA-wmpw-j6qv-mw88 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.