Medium, CVSS 6.3
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.1 or later · < 0.91.1 · CVE-2026-63342 · GHSA-g26x-m427-f48f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1801–1825 of 30,910 matching · newest first
- Low, CVSS 2.3
wlc may disclose API tokens to project-configured URLs
PyPI wlc · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2026-62364 · GHSA-3mqq-hv9c-85hc · amended
- High, CVSS 7.5
SIPGO: DoS via unvalidated Content-Length in the stream parser
Go github.com/emiago/sipgo · Upgrade to 1.4.1 or later · <= 1.4.0 · CVE-2026-58268 · GHSA-pg59-5vwg-4jxq · amended
- High, CVSS 8.8
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
npm @deepstream/server · Upgrade to 10.1.1 or later · >= 10.1.0, <= 10.1.0 · CVE-2026-63116 · GHSA-89vx-jh4q-vg3w · amended
- High, CVSS 7.5
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
npm request-filtering-agent · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2026-62985 · GHSA-r3r9-wp5j-pq5g · amended
- Medium, CVSS 6.5
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
PyPI opencve · Upgrade to 3.0.0 or later · <= 1.5.0 · CVE-2026-62282 · GHSA-ch3g-4xvr-674q · amended
- High, CVSS 7.5
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry
PyPI psd-tools · Upgrade to 1.17.4 or later · < 1.17.4 · CVE-2026-59991 · GHSA-8q6g-vjhf-jp8m · amended
- Medium, CVSS 6.5
microsandbox: Secret values exposed in world-readable process arguments
crates.io microsandbox · Upgrade to 0.5.10 or later · < 0.5.10 · CVE-2026-61670 · GHSA-m8f5-rh7h-vgg3 · amended
- Medium, CVSS 5.3
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
npm 9router · Upgrade to 0.5.8 or later · <= 0.5.4 · CVE-2026-56682 · GHSA-32gc-64m7-hj7v · amended
- High, CVSS 7.3
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
npm 9router · Upgrade to 0.5.8 or later · <= 0.5.4 · CVE-2026-56681 · GHSA-5mj8-gf6m-fhw8 · amended
- Medium, CVSS 5.7
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.108 or later · <= 0.4.107 · CVE-2026-61612 · GHSA-798p-78g2-v556 · amended
- Medium, CVSS 5.3
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
npm @sync-in/server · Upgrade to 2.4.1 or later · <= 2.4.0 · CVE-2026-58272 · GHSA-29hq-23m2-2j47 · amended
- Medium, CVSS 6.5
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff
pathFiltersnpm @sync-in/server · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-58270 · GHSA-jx63-h26r-8cph · amended
- High, CVSS 8.1
Sync-in Server has a complete 2FA Bypass via
POST /api/auth/tokennpm @sync-in/server · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-58269 · GHSA-92cr-jxw4-5wjg · amended
- Medium, CVSS 6.8
@sync-in/server vulnerable to TOTP Brute-Force via
POST /api/app/sync/registernpm @sync-in/server · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-58271 · GHSA-274f-6w77-8qm9 · amended
- High, CVSS 7.1
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
npm @roomi-fields/notebooklm-mcp · Upgrade to 2.0.3 or later · >= 1.6.0, < 2.0.3 · CVE-2026-61647 · GHSA-jjhp-8crj-mppq · amended
- Unrated
Double free in
StackVec::retainwhen a predicate or elementDroppanicscrates.io stack_collections · Upgrade to 0.3.3 or later · >= 0.3.0, < 0.3.3
- High, CVSS 8.1
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
Go github.com/lucasdillmann/nginx-ignition · Upgrade to 0.0.0-20260621194639-0586b4e55ab (pre-release) or later · < 0.0.0-20260621194639-0586b4e55ab · CVE-2026-61628 · GHSA-pxcx-fv34-x9p5 · amended
- High, CVSS 7.5
nginx ignition has ParseAcceptLanguage
_separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddlewareGo github.com/lucasdillmann/nginx-ignition · Upgrade to 0.0.0-20260526022344-0c988fc1277c (pre-release) or later · >= 0.0.0-20260126024607-cbaf0fc16ed8, < 0.0.0-20260526022344-0c988fc1277c · CVE-2026-61629 · GHSA-jr34-h97m-9hpx · amended
- Medium, CVSS 4.2
nginx ignition has TOTP Reuse During Validity Window
Go github.com/lucasdillmann/nginx-ignition · Upgrade to 0.0.0-20260328015550-8d35e1eb5dd6 (pre-release) or later · >= 0.0.0-20260217145239-1cbfae0296f1, < 0.0.0-20260328015550-8d35e1eb5dd6 · CVE-2026-61630 · GHSA-hf33-q6cf-c66f · amended
- Medium, CVSS 4.3
k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers
Go github.com/falcosecurity/plugins/plugins/k8saudit · Upgrade to 0.18.0 or later · <= 0.17.0 · +4 more packages · GHSA-jhjp-4c2q-xmx4 · amended
- Medium, CVSS 6.3
Finished streaming calls keep reading a stalled request body indefinitely
crates.io connectrpc · Upgrade to 0.9.1 or 0.8.2 by release line · >= 0.2.0, < 0.8.2; >= 0.9.0, < 0.9.1 · GHSA-jx5x-3mcr-qp8r · amended
- Unrated
SinglyLinkedList::removedereferences a null linkcrates.io bun_collections · Upgrade to 0.2.1 or later · >= 0.0.0-0, < 0.2.1
- Unrated
hex_decode_uncheckedAVX2 path reads pastsrccrates.io faster-hex · Upgrade to 0.10.1 or later · >= 0.3.0, < 0.10.1
- High, CVSS 8.7
source-map-js allows event-loop denial of service through indexed source-map section offsets
npm source-map-js · Upgrade to 1.2.2 or later · >= 1.0.0, < 1.2.2 · CVE-2026-93749 · GHSA-68fv-2mgg-jv7q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.