Critical, CVSS 9.3
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71871 · GHSA-8j6p-r8jg-mxqh · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2251–2275 of 30,910 matching · newest first
- Critical, CVSS 9.3
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71867 · GHSA-2w86-xfrc-g85r · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71868 · GHSA-3575-w9fc-c2j6 · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71865 · GHSA-653q-5476-x79g · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71864 · GHSA-6437-gxhq-pqv8 · amended
- Medium, CVSS 6.8
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root
Go github.com/VictoriaMetrics/VictoriaMetrics · Upgrade to 1.146.0, 1.136.12 or 1.122.25 by release line · >= 1.137.0, < 1.146.0; >= 1.123.0, < 1.136.12; < 1.122.25 · CVE-2026-61625 · GHSA-8q3c-rjr9-xxrp · amended
- High, CVSS 8.7
LiquidJS has an infinite loop vulnerability in its
strip_htmlfilternpm liquidjs · Upgrade to 10.27.1 or later · >= 10.26.0, < 10.27.1 · CVE-2026-61556 · GHSA-m7fp-h3p4-hr49
- High, CVSS 8.1
OpenClaw Feishu tools could ignore per-account disablement
npm @openclaw/feishu · Upgrade to 2026.6.9 or later · < 2026.6.9 · CVE-2026-62187 · GHSA-2q7j-2vhx-56g8
- Medium, CVSS 5.4
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
Go github.com/cilium/cilium · Upgrade to 1.19.5 or later · >= 1.19.0, < 1.19.5 · CVE-2026-56743 · GHSA-fm8w-2m5w-9j7r · amended
- Critical, CVSS 9.3
unstructured: Server-Side Request Forgery in the URL-based partitioning
PyPI unstructured · Upgrade to 0.24.0 or later · >= 0.4.7, < 0.24.0 · CVE-2026-71428 · GHSA-4mvj-m6j5-pmf7 · amended
- Medium, CVSS 6.5
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260510110132-b763d787d1f2 (pre-release) or later · < 0.0.0-20260510110132-b763d787d1f2 · CVE-2026-65607 · GHSA-gw25-m53r-qh88 · amended
- High, CVSS 8.7
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260714095344-f08dee71ba8e (pre-release) or later · < 0.0.0-20260714095344-f08dee71ba8e · CVE-2026-66394 · GHSA-99rq-75j6-5j9f · amended
- Medium, CVSS 6.5
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.112 or later · < 0.4.112 · CVE-2026-73846 · GHSA-78x9-fhhx-v2g6
- Low, CVSS 3.7
CKAN MCP Server: Information disclosure via verbose error reflection
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.112 or later · < 0.4.112 · CVE-2026-73844 · GHSA-6f9w-9hf2-5rg3
- High, CVSS 8.8
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Go github.com/openchoreo/openchoreo · Upgrade to 1.2.0-rc.2 (pre-release), 1.1.4 or 1.0.4 by release line · < 1.0.4; >= 1.1.0, < 1.1.4; >= 1.2.0-rc.1, < 1.2.0-rc.2 · CVE-2026-73667 · GHSA-2mw5-23gm-pccq · amended
- Medium, CVSS 5.3
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Go github.com/openchoreo/openchoreo · Upgrade to 1.2.0-rc.2 (pre-release), 1.1.3 or 1.0.3 by release line · < 1.0.3; >= 1.1.0, < 1.1.3; >= 1.2.0-rc.1, < 1.2.0-rc.2 · CVE-2026-73840 · GHSA-c5f6-2rm9-2w8g · amended
- High, CVSS 8.8
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Go github.com/openchoreo/openchoreo · Upgrade to 1.2.3 or 1.1.6 by release line · >= 1.2.0-m.1, < 1.2.3; < 1.1.6 · CVE-2026-73841 · GHSA-52gf-6rpq-fgmx · amended
- Critical, CVSS 9.6
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Go github.com/openchoreo/openchoreo · Upgrade to 1.1.2 or 1.0.2 by release line · < 1.0.2; >= 1.1.0, < 1.1.2 · CVE-2026-73843 · GHSA-qh9r-j7rp-4x2m · amended
- High, CVSS 7.5
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Go github.com/axllent/mailpit · Upgrade to 1.30.4 or later · <= 1.30.3 · CVE-2026-67445 · GHSA-w878-pj84-3j5v · amended
- High, CVSS 8.1
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171048-05ed5c9ae8a2 (pre-release) or later · < 0.0.0-20260512171048-05ed5c9ae8a2 · CVE-2026-72921 · GHSA-gv5w-hfx8-8cwq · amended
- High, CVSS 7.5
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
Go github.com/axllent/mailpit · Upgrade to 1.30.4 or later · <= 1.30.3 · CVE-2026-67446 · GHSA-75mr-qw9x-3r39 · amended
- Medium, CVSS 4.7
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
npm @dicebear/initials +1 · Upgrade all 2 to 9.4.3 or later · <= 9.4.2 · CVE-2026-68921 · GHSA-gcr2-9v8m-gq45
- High, CVSS 7.1
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
PyPI omnigent · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-62676 · GHSA-7mqg-cx4g-x2rf
- High, CVSS 8.2
Plate: SSRF with response disclosure in DOCX image embedding
npm @platejs/docx-io · Upgrade to 53.3.2 or later · < 53.3.2 · CVE-2026-65842 · GHSA-4q39-2jhr-7qx8
- High, CVSS 7.5
Handlebars.java: Arbitrary file read in
SpringTemplateLoadervia URL-fragment suffix bypassMaven com.github.jknack:handlebars-springmvc · Upgrade to 4.5.3 or later · < 4.5.3 · CVE-2026-63490 · GHSA-g29j-rwfv-h99w · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.