High, CVSS 7.5
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
npm @tsparticles/mcp-server · Upgrade to 4.3.1 or later · < 4.3.1 · CVE-2026-63655 · GHSA-447x-qqwf-m7xq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
126–150 of 30,910 matching · newest first
- High, CVSS 7.5
ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
npm ag-psd · Upgrade to 31.0.1 or later · < 31.0.1 · CVE-2026-63501 · GHSA-6w3r-6hpr-hp6p · amended
- Medium, CVSS 6.9
zt-zip: ZipUtil.unpack can change file permissions of output directory
Maven org.zeroturnaround:zt-zip · Upgrade to 1.18.1 or later · < 1.18.1 · CVE-2026-63499 · GHSA-v2g6-7r9j-v6px · amended
- High, CVSS 7.3
traQ: Privilege escalation by OAuth prompt=none request
Go github.com/traPtitech/traQ · Upgrade to 1.0.0-rc.2.0.20260629134940-5510fe8aa9bb (pre-release) or later · < 1.0.0-rc.2.0.20260629134940-5510fe8aa9bb · CVE-2026-63198 · GHSA-8cfq-jgf7-8m27 · amended
- High, CVSS 7.3
traQ: XSS in the User Uploaded File Retrieval API
Go github.com/traPtitech/traQ · Upgrade to 1.0.0-rc.2.0.20260627142846-3db29e777166 (pre-release) or later · < 1.0.0-rc.2.0.20260627142846-3db29e777166 · CVE-2026-63197 · GHSA-p74g-f95m-7fx7 · amended
- Medium, CVSS 5.3
isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
npm isomorphic-git · Upgrade to 1.38.6 or later · < 1.38.6 · CVE-2026-63478 · GHSA-cw2g-2vwq-88w6 · amended
- Medium, CVSS 4.3
isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
npm isomorphic-git · Upgrade to 1.38.6 or later · < 1.38.6 · CVE-2026-63475 · GHSA-96wc-2m84-2cj7 · amended
- High, CVSS 8.8
isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)
npm isomorphic-git · Upgrade to 1.38.6 or later · < 1.38.6 · CVE-2026-63395 · GHSA-9qw7-j9xw-fv9c · amended
- Critical, CVSS 9.3
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
PyPI fastapi-code-generator · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-63471 · GHSA-p2mm-64f6-gmpp · amended
- Critical, CVSS 9.3
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
PyPI fastapi-code-generator · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-63469 · GHSA-6xmv-cjr5-w3q8 · amended
- Critical, CVSS 9.3
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
PyPI fastapi-code-generator · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-63470 · GHSA-h667-4jj2-cgv4 · amended
- High, CVSS 8.2
zt-zip: Path traversal in fluent API unpack
Maven org.zeroturnaround:zt-zip · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-63436 · GHSA-52c6-99qm-3hqr · amended
- High, CVSS 8.2
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
PyPI loggingredactor · Upgrade to 0.0.7 or later · < 0.0.7 · CVE-2026-63417 · GHSA-w7qv-268h-9h3f · amended
- Critical, CVSS 9.9
LXD has restricted project bypass leading to arbitrary command execution
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-47w9-6r3f-938g · amended
- High, CVSS 7.7
LXD has project restriction bypass for custom volume copy across projects
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-7mr3-28h5-m5vx · amended
- High, CVSS 7.7
LXD has project restriction bypass in instance copy across projects
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-qx75-2p3r-pwm5 · amended
- Medium, CVSS 6.3
GeoNode has Stored XSS in Documents metadata abstract field
PyPI geonode · Upgrade to 5.0.3 or later · < 5.0.3 · CVE-2026-55649 · GHSA-r4hm-p9f9-fj9v · amended
- Medium, CVSS 5.5
GeoNode has Unrestricted File Upload
PyPI geonode · Upgrade to 5.0.3 or later · < 5.0.3 · CVE-2026-46429 · GHSA-fqpv-mq26-pr4j · amended
- High, CVSS 8.8
GeoNode has OS command injection via uploaded file layer name
PyPI geonode · Upgrade to 5.1.0 or later · < 5.1.0 · CVE-2026-33050 · GHSA-9fpx-fr6j-2vh6 · amended
- Medium, CVSS 6.5
LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260622081844-85f897013ccd (pre-release) or later · < 0.0.0-20260622081844-85f897013ccd · CVE-2026-9639 · GHSA-j93m-3j9p-m5m8 · amended
- Critical, CVSS 9.9
LXD has arbitrary file write on client due to trusted image hash
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-pjff-c2wc-f6jm · amended
- Critical, CVSS 9.9
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-fmc8-p6q7-75cc · amended
- Critical, CVSS 9.9
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260630083100-c5184be310b1 (pre-release) or later · < 0.0.0-20260630083100-c5184be310b1 · GHSA-vghh-5rfx-xhq8 · amended
- Critical, CVSS 9.9
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260203144152-d1c8ba15d160 (pre-release) or later · < 0.0.0-20260203144152-d1c8ba15d160 · GHSA-jpf8-86f3-wp38 · amended
- Critical, CVSS 9.9
LXD has arbitrary file write on host via
exec-outputsymlink in crafted imageGo github.com/canonical/lxd · Upgrade to 0.0.0-20260626085134-124f90100640 (pre-release) or later · < 0.0.0-20260626085134-124f90100640 · GHSA-9j25-mm2h-2f76 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.