High, CVSS 7.5
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
npm nuxt · Upgrade to 4.5.1 or later · >= 4.4.0, <= 4.5.0 · CVE-2026-71316 · GHSA-wm8w-6qjm-cv43
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 · CVE-2026-71315 · GHSA-hxvh-4h3w-prp9
- High, CVSS 7.5
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 · CVE-2026-71314 · GHSA-hxcr-hm88-mpq6
- Critical, CVSS 9.3
rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79782 · GHSA-gx4c-2hqx-cw2r · amended
- High, CVSS 8.8
rclone
serve restic --private-reposauthorization bypass:..in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesGo github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-59733 · GHSA-fqj9-69pf-6pjg · amended
- High, CVSS 8.0
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.4 · CVE-2026-71312 · GHSA-2m8m-jhrm-w6j2 · amended
- High, CVSS 7.5
rclone: Unvalidated symlink target in local
--links— arbitrary file write from an untrusted remoteGo github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-54572 · GHSA-cf44-9pgv-m4xc · amended
- High, CVSS 8.6
rclone: Incomplete path validation allows backend root escape in serve restic
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · >= 1.40.0, < 1.75.0 · CVE-2026-71309 · GHSA-45pq-889g-fcgh · amended
- High, CVSS 7.2
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
npm electron · Upgrade to 42.0.1, 41.10.3 or 39.8.10 by release line · >= 42.0.0-alpha.1, < 42.0.1; >= 40.0.0-alpha.1, < 41.10.3; < 39.8.10 · CVE-2026-70608 · GHSA-9f4c-93c8-jc8g
- High, CVSS 7.4
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
npm electron · Upgrade to 42.0.0, 41.4.0, 40.9.3 or 39.8.10 by release line · >= 42.0.0-alpha.1, < 42.0.0; >= 41.0.0-alpha.1, < 41.4.0; >= 40.0.0-alpha.1, < 40.9.3; < 39.8.10 · CVE-2026-70604 · GHSA-v3j7-r9gq-3gjw
- High, CVSS 7.5
Electron: Context isolation bypass via Function.prototype.bind hijack
npm electron · Upgrade to 42.0.0-beta.5 (pre-release), 41.2.2, 40.9.2 or 39.8.9 by release line · < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.2; >= 42.0.0-alpha.1, < 42.0.0-beta.5 · CVE-2026-70601 · GHSA-h7rp-cf8h-j98x
- High, CVSS 7.5
Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
Maven org.apache.qpid:proton-j · Upgrade to 0.35.0 or later · < 0.35.0 · CVE-2026-66274 · GHSA-p2gc-fm5w-94jj · amended
- High, CVSS 7.5
XSS in Ghost's ActivityPub client
npm @tryghost/activitypub · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-53950 · GHSA-xpp7-93x6-v29m
- High, CVSS 8.1
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
PyPI open-webui · Upgrade to 0.11.0 or later · >= 0.10.0, < 0.11.0 · CVE-2026-70494 · GHSA-3cg5-48j3-v4gv
- High, CVSS 8.7
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
PyPI open-webui · Upgrade to 0.11.0 or later · >= 0.10.0, < 0.11.0 · CVE-2026-70492 · GHSA-pwxh-7358-jq2x
- High, CVSS 8.2
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
PyPI open-webui · Upgrade to 0.11.0 or later · >= 0.9.0, <= 0.10.2 · CVE-2026-70486 · GHSA-3xpf-xq7r-v8c5
- High, CVSS 7.1
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
PyPI open-webui · Upgrade to 0.11.0 or later · >= 0.9.0, < 0.11.0 · CVE-2026-70485 · GHSA-8x5v-cpv7-8jjp
- High, CVSS 8.1
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
PyPI open-webui · Upgrade to 0.11.0 or later · >= 0.8.0, < 0.11.0 · CVE-2026-70482 · GHSA-rq84-p6rr-vf89
- High, CVSS 7.7
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
PyPI open-webui · Upgrade to 0.11.0 or later · >= 0.9.6, < 0.11.0 · CVE-2026-70479 · GHSA-w2rx-84hp-gg95
- Critical, CVSS 9.2
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-70478 · GHSA-qgvm-j2hm-6m38 · amended
- Critical, CVSS 9.5
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-70477 · GHSA-5xvg-pmgg-3mxr · amended
- High, CVSS 8.3
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-70476 · GHSA-gmmw-qg98-6j6p
- High, CVSS 7.1
Flowise: Missing Authorization on Execution Update Endpoint
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-70475 · GHSA-fm2f-4339-4p2f
- High, CVSS 8.7
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
PyPI django · Upgrade to 6.0.8 or 5.2.17 by release line · < 5.2.17; >= 6.0a1, < 6.0.8 · CVE-2026-15307 · GHSA-wvqv-fj8w-qmhm
- High, CVSS 7.6
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-70474 · GHSA-wch5-xp77-fxg4
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.