High, CVSS 7.5
Outgoing datagram buffer accounting can panic the sender in quinn-proto
crates.io quinn-proto · Upgrade to 0.11.18 or later · >= 0.11.17, < 0.11.18 · GHSA-ppcp-v39w-8jq2
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2001–2025 of 30,910 matching · newest first
- Medium, CVSS 6.3
joi messages compilation allows prototype replacement through __proto__ error codes
npm joi · Upgrade to 18.2.9 or 17.13.8 by release line · < 17.13.8; >= 18.0.0, < 18.2.9 · CVE-2026-90771 · GHSA-wr44-6hxh-3jwq · amended
- Unrated
Use-after-free when a future's
Droppanics while the container is droppedcrates.io unicycle · Upgrade to 0.10.3 or later · >= 0.0.0-0, < 0.10.3 · GHSA-8gw6-724c-9h38
- Medium, CVSS 4.8
ZITADEL: Auto-linking by email: IdP-side email verification is not checked
Go github.com/zitadel/zitadel · Upgrade to 4.15.3 or later · < 4.15.3 · CVE-2026-56666 · GHSA-992q-9gwp-7r79 · amended
- Critical, CVSS 9.1
yayson: Prototype pollution in Store/LegacyStore deserialization
npm yayson · Upgrade to 4.3.0 or later · <= 4.2.0 · CVE-2026-61534 · GHSA-325j-mg25-8q58 · amended
- High, CVSS 8.8
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
npm @mockoon/commons-server +1 · Upgrade all 2 to 9.7.0 or later · < 9.7.0 · CVE-2026-59148 · GHSA-rqx4-3f6q-3x2v · amended
- Medium, CVSS 6.5
@Mockoon/commons-server: Path traversal in templated
filePathlets a request escape the served directory (prefix-only base check)npm @mockoon/commons-server +1 · Upgrade all 2 to 9.7.0 or later · <= 9.6.1 · CVE-2026-59149 · GHSA-8wqc-v2q8-vff2 · amended
- High, CVSS 8.5
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
npm mcp-from-openapi · Upgrade to 2.5.0 or later · >= 2.3.0, < 2.5.0 · +2 more packages · CVE-2026-59973 · GHSA-65h7-9wrw-629c · amended
- Critical, CVSS 9.6
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
PyPI prowler-cloud · Upgrade to 5.30.3 or later · < 5.30.3 · CVE-2026-59151 · GHSA-h8m9-jgf8-vwvp · amended
- Medium, CVSS 4.2
ZITADEL: Missing Token Expiration (
exp) Validation in JWT IdP ProviderGo github.com/zitadel/zitadel · Upgrade to 4.15.2 or 3.4.12 by release line · >= 4.0.0-rc.1, < 4.15.2; < 3.4.12 · CVE-2026-56665 · GHSA-v77h-2w3m-94hx · amended
- High, CVSS 8.1
Shopper: Missing authorization on product removal actions in CollectionProducts component
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56825 · GHSA-2cg9-97gq-9mqp · amended
- Medium, CVSS 6.5
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56830 · GHSA-99h5-jhh7-v3r3 · amended
- High, CVSS 8.1
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56829 · GHSA-g3f9-g5vj-p62f · amended
- High, CVSS 8.8
Shopper: privilege escalation via improper Livewire admin component authorization
Packagist shopper/framework · Upgrade to 2.9.2 or later · >= 2.8.0, < 2.9.2 · CVE-2026-56828 · GHSA-j328-xmgp-j4q3 · amended
- Medium, CVSS 5.4
Shopping privilege escalation through missing authorization in Settings components
Packagist shopper/framework · Upgrade to 2.9.2 or later · >= 2.0.0, < 2.9.2 · CVE-2026-56826 · GHSA-f7h9-qv4x-9x57 · amended
- Medium, CVSS 6.5
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Packagist shopper/framework · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2026-56831 · GHSA-5vf4-452p-jjhf · amended
- High, CVSS 8.1
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Packagist shopper/framework · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-56827 · GHSA-243p-f3cv-c5wh · amended
- High, CVSS 8.8
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
Maven com.linecorp.centraldogma:centraldogma-server-mirror-git · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11745 · GHSA-vjfw-cpmh-xwv3 · amended
- Critical, CVSS 9.4
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
Maven com.linecorp.centraldogma:centraldogma-server · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11746 · GHSA-2j95-gqxf-v3vg · amended
- Medium, CVSS 6.9
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
Maven com.linecorp.centraldogma:centraldogma-server-auth-shiro · Upgrade to 0.84.0 or later · < 0.84.0 · CVE-2026-11748 · GHSA-98q5-5qh2-7w75 · amended
- Critical, CVSS 10.0
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
PyPI mysql-mcp-server · Upgrade to 0.4.2 or later · < 0.4.2 · CVE-2026-59971 · GHSA-rqfv-2mw9-78g2 · amended
- Medium, CVSS 6.5
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
PyPI open-webui · Upgrade to 0.11.1 or later · >= 0.8.0, < 0.11.1 · CVE-2026-88006 · GHSA-wvm9-9g5j-623f · amended
- Medium, CVSS 6.3
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.72.0, < 1.75.1 · CVE-2026-88014 · GHSA-66hp-wgxq-6f5q · amended
- Low, CVSS 3.7
rclone: http backend forwards custom/auth headers to a different host on redirect
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · >= 1.49.0, <= 1.75.0 · CVE-2026-88013 · GHSA-486v-q2wf-fp2r · amended
- Medium, CVSS 6.5
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
Go github.com/rclone/rclone · Upgrade to 1.75.1 or later · <= 1.75.0 · CVE-2026-88016 · GHSA-f8g7-2xjc-7mfh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.