High, CVSS 8.7
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-62388 · GHSA-p3m8-78j2-g5p3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2301–2325 of 30,910 matching · newest first
- Medium, CVSS 6.9
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-63311 · GHSA-3gqm-fcw5-w839 · amended
- High, CVSS 7.5
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
PyPI mistune · Upgrade to 3.3.3 or later · >= 3.3.0, < 3.3.3 · CVE-2026-76098 · GHSA-6m44-fpc8-c3rq
- Medium, CVSS 6.1
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
npm fastify · Upgrade to 5.12.1 or later · >= 5.8.3, < 5.12.1 · CVE-2026-16732 · GHSA-3m5p-2c4r-xxw2
- Medium, CVSS 5.4
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
npm fastify · Upgrade to 5.12.1 or later · < 5.12.1 · CVE-2026-18504 · GHSA-w2qp-rph6-63g4
- High, CVSS 7.1
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
npm apostrophe · Upgrade to 4.32.1 or later · < 4.32.1 · CVE-2026-71553 · GHSA-vmg4-6gfg-83qx · amended
- Medium, CVSS 5.4
Sulu: Stored XSS via media download inline-disposition override
Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · <= 2.6.24; >= 3.0.0-alpha1, < 3.0.8 · CVE-2026-82396 · GHSA-pp4x-ccxq-6r33 · amended
- Medium, CVSS 5.3
Sulu: Fix authorization bypass when creating preview links
Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · <= 2.6.24; >= 3.0.0-alpha1, < 3.0.8 · CVE-2026-82394 · GHSA-65cv-w493-7vhq · amended
- Medium, CVSS 5.3
Sulu: Media move/update authorization bypass (IDOR)
Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · <= 2.6.24; >= 3.0.0-alpha1, < 3.0.8 · CVE-2026-82395 · GHSA-h6cx-gjxx-v25c · amended
- Medium, CVSS 6.5
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
npm @apostrophecms/import-export · Upgrade to 3.6.2 or later · < 3.6.2 · CVE-2026-63667 · GHSA-79qf-vqgc-7xx3 · amended
- Medium, CVSS 6.9
Kirby: Access to image files outside of the site root via path traversal in the media handling
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · < 4.9.5; >= 5.0.0, < 5.5.2 · CVE-2026-75592 · GHSA-6j4c-mgqr-qv76 · amended
- High, CVSS 7.1
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
npm orval · Upgrade to 8.22.0 or later · < 8.22.0 · CVE-2026-62680 · GHSA-cxq5-97v7-87j8
- Critical, CVSS 9.3
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72716 · GHSA-p4cg-3328-rvfg · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71866 · GHSA-6mr6-jvcr-2f25 · amended
- Medium, CVSS 5.3
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (
isValidMqaServer)npm @aborruso/ckan-mcp-server · Upgrade to 0.4.112 or later · < 0.4.112 · CVE-2026-73845 · GHSA-83x6-42hr-jc76
- Critical, CVSS 9.8
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171108-5e8f99f40a8a (pre-release) or later · < 0.0.0-20260512171108-5e8f99f40a8a · CVE-2026-72920 · GHSA-2v6v-25fm-p4fg · amended
- High, CVSS 8.7
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Packagist getgrav/grav · Upgrade to 2.0.7 or later · < 2.0.7 · CVE-2026-64850 · GHSA-fj2p-qj2f-74v5 · amended
- Medium, CVSS 6.0
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Packagist getgrav/grav · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2026-62237 · GHSA-37f3-6p89-6qr9 · amended
- Medium, CVSS 6.3
qs array-limit bypass via bracket-key comma parsing
npm qs · Upgrade to 6.16.0 or later · >= 6.14.2, <= 6.15.3 · CVE-2026-82562 · GHSA-x5fp-wj9c-mxmx
- Medium, CVSS 6.3
qs: Denial of Service via Attacker Controlled isBuffer
npm qs · Upgrade to 6.16.0 or later · >= 2.2.5, < 6.16.0 · CVE-2026-82417 · GHSA-4mjr-xmp4-gh2g
- Medium, CVSS 6.4
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
npm @tiptap/core · Upgrade to 3.30.4 or later · >= 2.0.0-alpha.0, < 3.30.4 · GHSA-cp6q-959q-f8rh
- High, CVSS 8.1
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Packagist easycorp/easyadmin-bundle · Upgrade to 5.5.1 or 4.29.16 by release line · >= 4.0.0, < 4.29.16; >= 5.0.0, < 5.5.1 · CVE-2026-81892 · GHSA-g2fm-8hr4-j82h · amended
- Medium, CVSS 5.1
Livewire DOM-based cross-site scripting during client-side state handling
Packagist livewire/livewire · Upgrade to 4.3.4 or 3.8.3 by release line · >= 3.0.0-beta.1, <= 3.8.2; >= 4.0.0-beta.1, <= 4.3.3 · CVE-2026-81887 · GHSA-g3hc-697w-wm82 · amended
- High, CVSS 7.5
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
PyPI tornado · Upgrade to 6.5.8 or later · <= 6.5.7 · CVE-2026-82397 · GHSA-mpf4-983q-p7j4
- Medium, CVSS 6.0
Banks: Path traversal in
DirectoryPromptRegistry.set()allows arbitrary file write outside the registry rootPyPI banks · Upgrade to 2.4.5 or later · < 2.4.5 · CVE-2026-71492 · GHSA-x8wg-4xgc-vr54
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.