High, CVSS 7.2
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
npm jodit · Upgrade to 4.12.28 or later · < 4.12.28 · CVE-2026-58263 · GHSA-rxcw-mc6f-6hr3
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53502 · GHSA-cj54-hpcc-gj6h
- High, CVSS 7.5
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53505 · GHSA-phj3-59pf-cp83
- High, CVSS 7.5
Thumbor has Regex Denial of Service (ReDoS) in
convolutionfilterPyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53504 · GHSA-5vjc-7cxw-4w6j
- High, CVSS 7.5
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53503 · GHSA-cqjp-jf4r-h5q9
- High, CVSS 8.2
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53501 · GHSA-mw3h-qjxj-6xg9
- High, CVSS 8.2
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53500 · GHSA-6x26-6r6f-m537
- High, CVSS 7.3
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
npm @phun-ky/defaults-deep · Upgrade to 2.0.5 or later · < 2.0.5 · CVE-2026-54737 · GHSA-mj3g-7xcc-x4vh
- Critical, CVSS 9.6
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
Go github.com/bank-vaults/vault-secrets-webhook · Upgrade to 1.23.1 or later · <= 1.22.2 · CVE-2026-54725 · GHSA-r2v3-8gwf-7ghm · amended
- High, CVSS 8.7
hashi-vault-js has a path traversal and query parameter injection
npm hashi-vault-js · Upgrade to 0.5.2 or later · <= 0.5.1 · CVE-2026-55100 · GHSA-g956-2f74-rmv7
- High, CVSS 8.7
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
npm dssrf · Upgrade to 1.0.5 or later · <= 1.0.4 · CVE-2026-54729 · GHSA-5846-7qm3-r52j
- High, CVSS 7.5
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
Packagist sylius/mollie-plugin · Upgrade to 3.3.1, 3.2.4 or 2.2.8 by release line · < 2.2.8; >= 3.0.0, < 3.2.4; >= 3.3.0, < 3.3.1 · CVE-2026-68500 · GHSA-rc52-c4hv-w89p · amended
- High, CVSS 7.5
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-56819 · GHSA-93wv-jw9v-4972 · amended
- High, CVSS 8.6
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12075 · GHSA-qvv7-cg9c-w4x3
- High, CVSS 7.5
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12061 · GHSA-fg7f-2386-8897
- High, CVSS 7.5
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12072 · GHSA-6hm5-jgcp-p838
- High, CVSS 7.5
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12074 · GHSA-xh95-f55m-82fw
- High, CVSS 7.5
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
Maven org.springframework.data:spring-data-commons · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.13 · CVE-2026-41695 · GHSA-88fw-v6x4-3f58 · amended
- High, CVSS 7.5
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
Go github.com/pterodactyl/wings · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-52856 · GHSA-ghrq-5wpp-hxx5 · amended
- Critical, CVSS 9.9
Wings exposes node configuration secrets through egg configuration-file templating
Go github.com/pterodactyl/wings · Upgrade to 1.12.3 or later · < 1.12.3 · CVE-2026-52855 · GHSA-pfvc-3p5h-x7h6 · amended
- High, CVSS 7.5
@dynatrace-oss/dynatrace-mcp-serverhas Unauthenticated HTTP MCP Tool Invocationnpm @dynatrace-oss/dynatrace-mcp-server · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2026-123811 · GHSA-p7w7-4929-vpj5 · amended
- Critical, CVSS 9.5
AWS Amplify Studio UI Component Properties Has an Input Validation Issue
npm @aws-amplify/codegen-ui-react · Upgrade to 2.20.3 or later · <= 2.20.2 · CVE-2025-4318 · GHSA-hf3j-86p7-mfw8 · amended
- Critical, CVSS 9.5
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
RubyGems activestorage · Upgrade to 8.1.3.1, 8.0.5.1 or 7.2.3.2 by release line · < 7.2.3.2; >= 8.0.0.beta1, < 8.0.5.1; >= 8.1.0.beta1, < 8.1.3.1 · CVE-2026-66066 · GHSA-xr9x-r78c-5hrm · amended
- High, CVSS 8.7
dssrf has an SSRF bypass with remove_at_symbol_in_string
npm dssrf · Upgrade to 1.0.4 or later · <= 1.0.3 · CVE-2026-54722 · GHSA-cg4g-m8jx-vjv2
- High, CVSS 8.5
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
PyPI flyto-core · Upgrade to 2.26.7 or later · <= 2.26.6 · CVE-2026-67424 · GHSA-c9hr-64h3-gxpc
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.