High, CVSS 8.7
rubyzip path traversal vulnerability
RubyGems rubyzip · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85396 · GHSA-47m2-wp7j-p9vc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2226–2250 of 30,910 matching · newest first
- Critical, CVSS 9.3
python-jose algorithm confusion with OpenSSH ECDSA keys
PyPI python-jose · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-85394 · GHSA-3qf3-8w2g-rqmx · amended
- High, CVSS 8.6
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721020826-2d069dce84a2 (pre-release) or later · < 0.0.0-20260721020826-2d069dce84a2 · CVE-2026-68584 · GHSA-7j72-f6wg-cxw6 · amended
- Medium, CVSS 5.8
SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721014951-ffde3b21eca4 (pre-release) or later · < 0.0.0-20260721014951-ffde3b21eca4 · CVE-2026-68585 · GHSA-pm3w-vxp9-ccwc · amended
- High, CVSS 8.6
SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721014413-f45749a7ef6e (pre-release) or later · < 0.0.0-20260721014413-f45749a7ef6e · CVE-2026-68586 · GHSA-36v8-mpjm-8j5r · amended
- High, CVSS 8.6
SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721013353-69db783b782a (pre-release) or later · < 0.0.0-20260721013353-69db783b782a · CVE-2026-68587 · GHSA-69mh-gvh4-8gp7 · amended
- Critical, CVSS 10.0
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write…
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721004815-cf42dd5680c8 (pre-release) or later · < 0.0.0-20260721004815-cf42dd5680c8 · CVE-2026-69083 · GHSA-fph3-ghq9-vw66 · amended
- High, CVSS 7.5
toml-node: Uncontrolled Recursion
npm toml · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-77465 · GHSA-82x6-q7mm-w9cf
- High, CVSS 8.2
toml-node: Prototype Pollution Leads to
Object.prototypeCorruption via__proto__Key-Path Desynchronizationnpm toml · Upgrade to 4.1.2 or later · < 4.1.2 · CVE-2026-63376 · GHSA-v5mp-jgw5-2x6j
- High, CVSS 7.7
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260720151813-0f5a0e7c67b0 (pre-release) or later · < 0.0.0-20260720151813-0f5a0e7c67b0 · CVE-2026-69086 · GHSA-7hm9-v7vf-7g4w · amended
- Medium, CVSS 6.3
Phoenix: Presence keys colliding with
Object.prototypemembers break existence checksnpm phoenix · Upgrade to 1.8.9, 1.7.24, 1.6.17 or 1.5.15 by release line · >= 1.2.0-rc.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9 · CVE-2026-56812 · GHSA-63mc-hw7g-86rr
- Medium, CVSS 6.2
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
npm stream-json · Upgrade to 3.5.0 or later · <= 3.4.0 · CVE-2026-71429 · GHSA-528h-pc64-c93x
- Critical, CVSS 10.0
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721002947-23a17d44b5f3 (pre-release) or later · < 0.0.0-20260721002947-23a17d44b5f3 · CVE-2026-69084 · GHSA-vh22-h7hf-www7 · amended
- High, CVSS 8.9
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-79921 · GHSA-6c5v-hqjr-5xxp · amended
- Medium, CVSS 6.1
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal
npm sanitize-html · Upgrade to 2.17.6 or later · <= 2.17.5 · CVE-2026-63670 · GHSA-jxwj-j7wr-gfrw
- Medium, CVSS 6.5
ApostropheCMS: Missing destination-parent authorization in page
move()allows a low-privileged editor to move and re-rank pages inside a restricted subtreenpm apostrophe · Upgrade to 4.32.0 or later · <= 4.31.0 · CVE-2026-63669 · GHSA-wr5r-wqp2-x4fh
- Medium, CVSS 5.4
Material for MkDocs: DOM XSS in search suggestions via query parameter
PyPI mkdocs-material · Upgrade to 9.7.7 or later · >= 7.2.0, < 9.7.7 · CVE-2026-73295 · GHSA-xvg9-69gf-fjrf
- High, CVSS 8.3
TOON: Prototype pollution when decoding untrusted TOON input
npm @toon-format/toon · Upgrade to 2.3.1 or later · < 2.3.1 · CVE-2026-82404 · GHSA-p95v-992w-h6c3
- High, CVSS 8.8
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
npm claude-code-templates · Upgrade to 1.29.4 or later · <= 1.29.2 · CVE-2026-73222 · GHSA-79wm-x847-7cvg
- High, CVSS 8.8
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 (pre-release) or later · < 0.0.0-20260705182501-bb2a4e1f08c8 · CVE-2026-73293 · GHSA-cxvf-gvfq-36w2 · amended
- High, CVSS 7.6
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260707190631-c59c3dc9035b (pre-release) or later · < 0.0.0-20260707190631-c59c3dc9035b · CVE-2026-73292 · GHSA-8cj9-r88m-8945 · amended
- Critical, CVSS 9.3
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62681 · GHSA-fg9p-mrxr-hvq7 · amended
- Critical, CVSS 9.3
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62682 · GHSA-88f2-fpv8-89q2 · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via schema default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72717 · GHSA-w727-8j6c-2rj4 · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via array-items default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71869 · GHSA-2h9g-j24r-h63g · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.