High, CVSS 7.7
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
PyPI langgraph-store-mongodb · Upgrade to 0.4.0 or later · < 0.4.0 · +1 more package · CVE-2026-55253 · GHSA-533j-2v4q-mw5h
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
Go github.com/vouch/vouch-proxy · Upgrade to 0.48.0 or later · <= 0.47.2 · CVE-2026-55149 · GHSA-qqff-5854-px68 · amended
- High, CVSS 8.8
Filesystem sandbox escape when paths or symlinks contain trailing slashes
crates.io wasmtime · Upgrade to 47.0.4, 46.0.3, 36.0.14 or 24.0.13 by release line · >= 0.0.0-0, < 24.0.13; >= 25.0.0, < 36.0.14; >= 37.0.0, < 46.0.3; >= 47.0.0, < 47.0.4 · CVE-2026-115392 · GHSA-vqjp-4c8c-hfgg · amended
- High, CVSS 8.7
logto-tunnel serves files outside
--experience-pathvia path traversalnpm @logto/tunnel · Upgrade to 0.3.9 or later · < 0.3.9 · CVE-2026-63188 · GHSA-rxjr-6c9q-h67x · amended
- High, CVSS 8.2
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Packagist getgrav/grav · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2026-62230 · GHSA-vwg3-w8w3-pc79 · amended
- High, CVSS 7.1
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
Packagist snipe/snipe-it · Upgrade to 8.6.3 or later · < 8.6.3 · CVE-2026-55694 · GHSA-3hgv-jr5j-cg9x
- High, CVSS 7.6
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
Packagist snipe/snipe-it · Upgrade to 8.6.3 or later · < 8.6.3 · CVE-2026-55643 · GHSA-c6w2-j4wq-mvwg
- High, CVSS 7.2
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
Maven org.geoserver:gs-main +2 · Upgrade all 3 to 2.27.0 or later · < 2.27.0 · CVE-2024-45747 · GHSA-wf6j-gr27-g7ch · amended
- High, CVSS 7.1
XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing
Maven org.xwiki.platform:xwiki-platform-livedata-livetable · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.4, 17.4.10 or 16.10.17 by release line · >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-53966 · GHSA-45ph-gxxr-gwgw · amended
- High, CVSS 8.7
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
Packagist mcp/sdk · Upgrade to 0.7.1 or later · >= 0.5.0, < 0.7.1 · CVE-2026-53965 · GHSA-7m52-jw36-44r3 · amended
- High, CVSS 7.2
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
PyPI document-merge-service · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-53964 · GHSA-w47q-945m-q9pc
- High, CVSS 7.7
Contentful MCP Server: export_space/import_space tools pass LLM-controlled
host/proxyargs to CMA client, redirecting server PAT to attacker-controlled endpointnpm @contentful/mcp-tools · Upgrade to 0.4.5 or later · < 0.4.5 · +1 more package · CVE-2026-53957 · GHSA-2xhg-73j7-rrgx · amended
- High, CVSS 8.8
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
PyPI copier · Upgrade to 9.15.2 or later · >= 9.5.0, <= 9.15.1 · CVE-2026-53951 · GHSA-9gmc-jqmh-3rvm
- High, CVSS 7.5
claude-faf-mcp has an arbitrary local file read/write via unconfined
pathargument in FAF toolsnpm claude-faf-mcp · Upgrade to 5.7.2 or later · <= 5.7.1 · GHSA-rr55-jp92-8wp2
- High, CVSS 7.5
faf-mcp has an arbitrary local file read/write via unconfined
pathargument in FAF toolsnpm faf-mcp · Upgrade to 2.1.3 or later · <= 2.1.2 · GHSA-j4r7-8ph4-43g3
- High, CVSS 7.5
grok-faf-mcp has an arbitrary local file read via unconfined
pathargument in FAF toolsnpm grok-faf-mcp · Upgrade to 1.5.3 or later · <= 1.5.2 · GHSA-cc2g-gq8c-r332
- High, CVSS 7.1
moby/go-archive: Crafted tar archive can write outside the extraction directory
Go github.com/moby/go-archive · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-17106 · GHSA-hfg8-hc9c-6c3h · amended
- High, CVSS 8.1
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Packagist librenms/librenms · Upgrade to 26.7.0 or later · < 26.7.0 · CVE-2026-84189 · GHSA-7gww-x7fh-jf9j · amended
- High, CVSS 7.3
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
PyPI lemur · Upgrade to 1.9.3 or later · <= 1.9.2 · CVE-2026-71417 · GHSA-pxmc-2ffp-8j67
- High, CVSS 8.1
Lemur: Unchecked
replaces[]lets any user silence notifications and hijack auto-rotation for arbitrary certificatesPyPI lemur · Upgrade to 1.9.3 or later · >= 0.5.0, <= 1.9.2 · CVE-2026-71308 · GHSA-cfh6-pv5c-38jv
- High, CVSS 7.7
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
PyPI lemur · Upgrade to 1.9.3 or later · < 1.9.3 · CVE-2026-71307 · GHSA-6c8m-q6g9-vrw3
- High, CVSS 7.7
Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace
acme_urlwith internal IP, bypassing allowlistPyPI lemur · Upgrade to 1.9.3 or later · <= 1.9.2 · CVE-2026-71303 · GHSA-v5rc-cpwc-cfpr
- High, CVSS 7.4
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
PyPI lemur · Upgrade to 1.9.3 or later · <= 1.9.2 · CVE-2026-70666 · GHSA-xpmj-wjcp-6pww
- Critical, CVSS 9.0
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
Packagist froxlor/froxlor · Upgrade to 2.3.8 or later · < 2.3.8 · CVE-2026-62988 · GHSA-7788-ghfq-c6mh · amended
- High, CVSS 7.2
Froxlor: Second-Order SQL Injection via
Admins.addipaddressParameter Allows Full Database ExfiltrationPackagist froxlor/froxlor · Upgrade to 2.3.8 or later · < 2.3.8 · CVE-2026-54348 · GHSA-w27m-rmmf-g5w4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.