Medium, CVSS 6.1
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
npm xhtml-purifier · Upgrade to 0.4.3 or later · <= 0.4.1 · CVE-2026-61784 · GHSA-j8r4-32c5-33rc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1676–1700 of 30,910 matching · newest first
- High, CVSS 8.7
@bsv/wallet-toolbox/-client/-mobiledon't verify storage-supplied recipient output scripts against caller-requested outputs in createActionnpm @bsv/wallet-toolbox +2 · Upgrade all 3 to 2.4.0 or later · >= 1.1.47, < 2.4.0 · CVE-2026-56744 · GHSA-36f9-7rg5-cpf8 · amended
- High, CVSS 8.5
phpMyFAQ has SQL Injection in
StopWords::add()— Unescaped Stop Word InsertionPackagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.6 or later · <= 4.1.5 · CVE-2026-56738 · GHSA-rw77-vq4g-x3hp · amended
- High, CVSS 8.1
phpMyFAQ's two-factor authentication login bypasses the password factor
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.6 or later · >= 3.2.0, < 4.1.6 · CVE-2026-56737 · GHSA-8gpw-xvpf-hvx5 · amended
- High, CVSS 8.2
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.2.0-alpha (pre-release) or later · < 4.2.0-alpha · CVE-2026-56736 · GHSA-pgwp-vc7q-cvj3 · amended
- High, CVSS 7.5
langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
PyPI langchain-nvidia-ai-endpoints · Upgrade to 1.4.2 or later · <= 1.4.1 · GHSA-g28h-2cmm-rj9x · amended
- Medium, CVSS 5.0
CyberChef: Prototype pollution in Series Chart operation
npm cyberchef · Upgrade to 11.2.0 or later · < 11.2.0 · CVE-2026-57439 · GHSA-fx6f-382r-j72c · amended
- Critical, CVSS 10.0
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
PyPI decepticon +2 · Upgrade all 3 to 1.1.17 or later · <= 1.1.16 · CVE-2026-61732 · GHSA-g5f9-3xfg-p9mf · amended
- High, CVSS 8.5
Language Servers for AWS vulnerable to arbitrary file write
npm @aws/lsp-codewhisperer · Upgrade to 0.0.117 or later · < 0.0.117 · CVE-2026-12958 · GHSA-6v3r-4p5c-mrp5 · amended
- High, CVSS 8.5
Language Servers for AWS Vulnerable to Arbitrary Code Execution
npm @aws/lsp-codewhisperer · Upgrade to 0.0.113 or later · < 0.0.113 · CVE-2026-12957 · GHSA-xhcr-j4j9-3gh7 · amended
- Medium, CVSS 4.8
yara-x: Unvalidated deserialization in safe
Rules::deserializeallows memory corruption and UBcrates.io yara-x · Upgrade to 1.19.0 or later · <= 1.18.0 · GHSA-2jx3-ff3v-j7jj · amended
- High, CVSS 8.7
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-63498 · GHSA-396x-xmvh-p563
- High, CVSS 8.2
ZITADEL: MFA bypass via session reuse in Login V2
Go github.com/zitadel/zitadel · Upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f (pre-release) or later · < 1.80.0-v2.20.0.20260717062356-56f4798ed31f · CVE-2026-85056 · GHSA-9993-rfwp-rhwf · amended
- High, CVSS 8.7
ZITADEL: Actions V1 sandbox escape: host file read via require()
Go github.com/zitadel/zitadel · Upgrade to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 (pre-release) or later · < 1.80.0-v2.20.0.20260717062331-baf6ed501b68 · CVE-2026-85057 · GHSA-fgmf-7rf8-m6vf · amended
- High, CVSS 8.1
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-62368 · GHSA-p9h3-gvpq-5539
- Medium, CVSS 4.3
Dozzle label filters do not restrict container event and statistics streams
Go github.com/amir20/dozzle · Upgrade to 1.29.1-0.20260622172006-19c01e0fb491 (pre-release) or later · < 1.29.1-0.20260622172006-19c01e0fb491 · CVE-2026-62286 · GHSA-xcw9-qmmf-vqxj · amended
- High, CVSS 8.6
Snipe-IT: 2FA bypass via the API token flow
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-63493 · GHSA-hxcx-9h4f-42xx
- Medium, CVSS 6.5
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
PyPI streamlink · Upgrade to 8.6.0 or later · <= 8.5.0 · CVE-2026-92164 · GHSA-vf2x-4v53-pm7v · amended
- Critical, CVSS 10.0
SunEditor: Critical XSS vulnerability - sanitizer bypass
npm suneditor · Upgrade to 2.47.11 or later · <= 2.47.10 · CVE-2026-59167 · GHSA-6rf4-v2fh-m6p4 · amended
- Medium, CVSS 4.3
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Packagist redaxo/source · Upgrade to 5.21.2 or later · <= 5.21.1 · CVE-2026-62998 · GHSA-4f5f-j737-pm58 · amended
- Medium, CVSS 6.2
Guest can panic host through filesystem datetime overflow
crates.io wasmtime-wasi · Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line · >= 0.0.0-0, < 36.0.16; >= 37.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115387 · GHSA-j2g9-4prp-pf6h
- Medium, CVSS 5.7
call_refand exceptioncatchcan drop some fuel accounting, leading to exponential fuel amplificationcrates.io wasmtime · Upgrade to 49.0.1 or 48.0.3 by release line · >= 47.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115390 · GHSA-m63x-6p34-q65x
- Unrated
Use-after-free in interned values and cached function results
crates.io salsa · Upgrade to 0.28.5 or later · >= 0.23.0, < 0.28.5 · GHSA-xc3w-55vh-cw3w
- Medium, CVSS 6.2
Outgoing HTTP body write allows guest-driven host memory exhaustion
crates.io wasmtime-wasi-http · Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line · >= 0.0.0-0, < 36.0.16; >= 37.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115388 · GHSA-c9gc-w9vx-w86p
- High, CVSS 7.4
Excluded iPAddress name constraints with an all-zero mask are not applied
crates.io x509-validator · Upgrade to 0.3.1 or later · >= 0.0.0-0, < 0.3.1 · GHSA-39mm-4q6x-3vrx
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.