High, CVSS 8.8
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
npm knowns · Upgrade to 0.30.0 or later · <= 0.29.1 · CVE-2026-86439 · GHSA-9gfj-28hw-jchp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1651–1675 of 30,910 matching · newest first
- High, CVSS 7.1
OpenZeppelin Confidential Contracts
VestingWalletConfidential: a malicious ERC-7984 token is able to extract private data from the vesting walletnpm @openzeppelin/confidential-contracts · Upgrade to 0.5.2, 0.4.2 or 0.3.2 by release line · < 0.3.2; >= 0.4.0-rc.0, < 0.4.2; >= 0.5.0-rc.0, < 0.5.2 · GHSA-29h2-jr22-frmh · amended
- Medium, CVSS 6.9
Containerd has image-pull DoS via crafted OCI index graph amplification
Go github.com/containerd/containerd · Upgrade to 1.7.36 or later · <= 1.7.35 · +1 more package · CVE-2026-53493 · GHSA-pg57-6jwg-q645 · amended
- Critical, CVSS 9.8
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
Packagist fof/oauth · Upgrade to 2.0.0-beta.4 (pre-release) or 1.7.4 by release line · < 1.7.4; >= 2.0.0-beta.1, < 2.0.0-beta.4 · CVE-2026-92161 · GHSA-g7vj-c29h-3h5m · amended
- High, CVSS 7.5
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-57440 · GHSA-v65j-hff3-753c · amended
- High, CVSS 7.3
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
Packagist code16/sharp · Upgrade to 9.22.5 or later · < 9.22.5 · CVE-2026-61823 · GHSA-qxg3-46rw-79j8 · amended
- High, CVSS 8.7
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Packagist code16/sharp · Upgrade to 9.22.5 or later · < 9.22.5 · CVE-2026-61825 · GHSA-vj3q-vp3g-j9c8 · amended
- Unrated
Various panics, soundness and resource exhaustion issues
crates.io domain · Upgrade to 0.12.3 or later · >= 0.0.0-0, < 0.12.3
- Low, CVSS 3.1
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Packagist contao/contao +1 · Upgrade all 2 to 5.7.9 or 5.3.48 by release line · >= 5.3.35, < 5.3.48; >= 5.4.0, < 5.7.9 · CVE-2026-57232 · GHSA-87mg-5grr-rhwh · amended
- Medium, CVSS 4.2
social-auth-core has a Session Fixation issue
PyPI social-auth-core · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-57179 · GHSA-vqg6-3fw6-j9jg · amended
- High, CVSS 7.4
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
PyPI social-auth-core · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-57178 · GHSA-3c93-f73f-qc9h · amended
- Medium, CVSS 4.3
social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
PyPI social-auth-core · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-57177 · GHSA-x7qq-23vw-7pfg · amended
- Medium, CVSS 6.8
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
PyPI social-auth-core · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-57176 · GHSA-fp7w-m676-w7gc · amended
- Medium, CVSS 6.4
social-auth-core has an Improper Authentication issue
PyPI social-auth-core · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-57175 · GHSA-vq6g-g6c7-5f2j · amended
- High, CVSS 8.4
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
PyPI compliance-trestle · Upgrade to 4.1.0 or 3.12.4 by release line · < 3.12.4; >= 4.0.0, < 4.1.0 · CVE-2026-57171 · GHSA-r4vp-3vw6-r2x5 · amended
- High, CVSS 7.8
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
PyPI compliance-trestle · Upgrade to 4.1.0 or 3.12.4 by release line · < 3.12.4; >= 4.0.0, < 4.1.0 · CVE-2026-57170 · GHSA-mr95-65j8-9mxp · amended
- High, CVSS 8.8
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (
/browserendpoint)npm cline · Upgrade to 3.0.30 or later · < 3.0.30 · CVE-2026-59723 · GHSA-3cj3-hqcr-g934 · amended
- High, CVSS 7.2
zbateson/mail-mime-parser has CRLF header injection via attachment filename
Packagist zbateson/mail-mime-parser · Upgrade to 4.0.2 or 3.0.6 by release line · < 3.0.6; >= 4.0.0, < 4.0.2 · CVE-2026-61815 · GHSA-36h5-qg4p-q2qf · amended
- High, CVSS 7.5
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
Packagist zbateson/mail-mime-parser · Upgrade to 4.0.2 or 3.0.6 by release line · >= 2.0.0, < 3.0.6; >= 4.0.0, < 4.0.2 · CVE-2026-61816 · GHSA-f6v3-2qmr-vfjx · amended
- Medium, CVSS 6.3
hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
PyPI hpack · Upgrade to 4.2.0 or later · <= 4.1.0 · CVE-2026-59980 · GHSA-8v8h-hg4w-mvq2 · amended
- High, CVSS 7.5
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
npm @rsdoctor/rspack-plugin · Upgrade to 1.5.16 or later · <= 1.5.15 · CVE-2026-61782 · GHSA-jmg2-rcxh-w8q3 · amended
- Medium, CVSS 5.9
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
Go github.com/cilium/cilium · Upgrade to 1.19.5 or 1.17.17 by release line · < 1.17.17; >= 1.19.0, < 1.19.5 · +1 more package · CVE-2026-56742 · GHSA-w7c2-w76w-5hmj · amended
- High, CVSS 7.4
@bytebase/dbhub's read-only mode does not prevent database writes
npm @bytebase/dbhub · Upgrade to 0.22.6 or later · < 0.22.6 · CVE-2026-61788 · GHSA-mwwr-p57h-56pf · amended
- Critical, CVSS 9.3
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
npm @bytebase/dbhub · Upgrade to 0.22.5 or later · <= 0.22.4 · CVE-2026-61742 · GHSA-fm8p-53ww-hf6w · amended
- Critical, CVSS 9.3
http4s-scala-xml has an XML External Entity (XXE) processing issue
Maven org.http4s:http4s-scala-xml_2.12 · Upgrade to 0.24.1 or later · <= 0.24.0 · +2 more packages · CVE-2026-61741 · GHSA-cjx3-73hr-rpw7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.