High, CVSS 8.7
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
Packagist froxlor/froxlor · Upgrade to 2.3.8 or later · <= 2.3.7 · CVE-2026-54347 · GHSA-43gm-9rr3-cx7g · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Packagist mineadmin/mineadmin · Upgrade to 3.2.0-alpha.2 (pre-release) or later · < 3.2.0-alpha.2 · CVE-2026-55224 · GHSA-59xm-4m8c-g3xj · amended
- High, CVSS 7.8
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
PyPI monai · Upgrade to 1.6.0 or later · < 1.6.0 · GHSA-wg9g-w2j2-8pgr
- High, CVSS 8.6
MONAI vulnerable to OS command injection
PyPI monai · Upgrade to 1.6.0 or later · < 1.6.0 · GHSA-rghg-q7wp-9767
- High, CVSS 7.8
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
PyPI monai · Upgrade to 1.6.0 or later · < 1.6.0 · GHSA-qxq5-qhx6-94qw
- Critical, CVSS 9.8
jmespath.php has CompilerRuntime code injection via unescaped function names
Packagist mtdowling/jmespath.php · Upgrade to 2.9.1 or later · < 2.9.1 · CVE-2026-54133 · GHSA-pcw8-m77r-2528 · amended
- Critical, CVSS 9.8
surfio has an out-of-bounds read
PyPI surfio · Upgrade to 0.0.19 or later · < 0.0.19 · CVE-2026-55211 · GHSA-rcr2-hggw-43wm · amended
- Critical, CVSS 9.8
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
PyPI resdata · Upgrade to 6.2.9 or later · < 6.2.9 · CVE-2026-55209 · GHSA-pr85-w493-9w3x · amended
- Critical, CVSS 10.0
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
RubyGems kobako · Upgrade to 0.9.1 or later · >= 0.1.0, < 0.9.1 · CVE-2026-55107 · GHSA-7pwq-q9jf-539h · amended
- High, CVSS 8.3
MeshCentral has unsanitized data fields
npm meshcentral · Upgrade to 1.1.60 or later · < 1.1.60 · GHSA-c7hr-448w-65px
- Critical, CVSS 9.1
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
Maven org.keycloak:keycloak-services · Upgrade to 26.7.2, 26.6.6 or 26.4.15 by release line · >= 26.0.0, < 26.4.15; >= 26.5.0, < 26.6.6; >= 26.7.0, < 26.7.2 · CVE-2026-18963 · GHSA-4gv3-mc9p-5wqc · amended
- High, CVSS 7.5
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
PyPI geolens +2 · Upgrade all 3 to 1.2.3 or later · < 1.2.3 · CVE-2026-55178 · GHSA-p23g-mvhj-jh3j
- High, CVSS 8.6
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
Packagist librenms/librenms · Upgrade to 26.5.0 or later · >= 21.6.0, < 26.5.0 · CVE-2026-55182 · GHSA-c9fv-cgmm-2wg7 · amended
- High, CVSS 7.1
etcd: Watch API authorization bypass via open-ended range requests
Go go.etcd.io/etcd/v3 +1 · Upgrade all 2 to 3.7.1, 3.6.14 or 3.5.33 by release line · >= 3.7.0-alpha.0, < 3.7.1; >= 3.6.0, < 3.6.14; < 3.5.33 · CVE-2026-73499 · GHSA-xg4h-6gfc-h4m8 · amended
- High, CVSS 8.7
etcd:
tlsListener.acceptLoopspawns unbounded handshake goroutines with no deadlineGo go.etcd.io/etcd/v3 +1 · Upgrade all 2 to 3.7.1, 3.6.14 or 3.5.33 by release line · >= 3.7.0-alpha.0, < 3.7.1; >= 3.6.0, < 3.6.14; < 3.5.33 · CVE-2026-73500 · GHSA-6vch-q96h-7gc3 · amended
- Critical, CVSS 9.1
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
Go github.com/getkin/kin-openapi · Upgrade to 0.144.0 or later · <= 0.143.0 · CVE-2026-73501 · GHSA-r277-6w6q-xmqw · amended
- High, CVSS 7.5
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.0 or later · < 5.33.0 · CVE-2026-63337 · GHSA-6g32-pxv4-2wfj · amended
- High, CVSS 8.7
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.1 or later · <= 5.33.0 · CVE-2026-69219 · GHSA-68mj-5wr7-6fgg · amended
- High, CVSS 8.7
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
Maven com.rabbitmq:amqp-client · Upgrade to 5.33.1 or later · <= 5.33.0 · CVE-2026-69220 · GHSA-93j5-89vc-pph4 · amended
- High, CVSS 8.7
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Maven io.kestra:kestra · Upgrade to 1.3.24 or later · < 1.3.24 · CVE-2026-55839 · GHSA-34pm-923j-7wf8 · amended
- High, CVSS 7.5
@rhinostone/swig: arbitrary local file read via include/extends path traversal
npm @rhinostone/swig +4 · Upgrade all 5 to 2.7.1 or later · < 2.7.1 · GHSA-2mf3-mr2r-r4vf · amended
- Critical, CVSS 9.6
Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53470 · GHSA-v5m8-5455-qw2x · amended
- High, CVSS 8.2
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
Go github.com/fatedier/frp · Upgrade to 0.70.1 or later · >= 0.53.0, <= 0.70.0 · CVE-2026-73564 · GHSA-26gq-p25f-99cp · amended
- Critical, CVSS 9.6
Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53474 · GHSA-vf2h-7x3w-97fr · amended
- High, CVSS 7.8
Oh My Posh: Arbitrary command execution via template injection in the path segment
Go github.com/jandedobbeleer/oh-my-posh · Upgrade to 29.35.1 or later · <= 29.35.0 · CVE-2026-73505 · GHSA-6xj8-qv9j-xcjq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.