High, CVSS 8.1
Koillection has an authenticated Server-Side Request Forgery issue
Packagist koillection/koillection · Upgrade to 1.8.4 or later · < 1.8.4 · CVE-2026-50888 · GHSA-gmxh-hjfv-qc2w
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
Maven org.springframework.ai:spring-ai-gemfire-store +2 · Upgrade all 3 to 1.1.8 or 1.0.9 by release line · >= 1.0.0, <= 1.0.8; >= 1.1.0, <= 1.1.7 · CVE-2026-47835 · GHSA-cmwh-w62w-r2mf
- Critical, CVSS 9.8
Remotion: remote code execution (RCE) vulnerability
npm remotion · Upgrade to 4.0.410 or later · < 4.0.410 · CVE-2026-30120 · GHSA-2jqp-f4gr-44fr · amended
- Critical, CVSS 9.1
Remotion: arbitrary file write vulnerability
npm remotion · Upgrade to 4.0.410 or later · < 4.0.410 · CVE-2026-30121 · GHSA-g6pc-6676-c23j · amended
- High, CVSS 7.0
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
npm aws-cdk-lib · Upgrade to 2.246.0 or later · < 2.246.0 · CVE-2026-11417 · GHSA-999r-qq7v-r334 · amended
- High, CVSS 7.5
Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-50011 · GHSA-5w86-c3rq-vjj7
- High, CVSS 7.5
Netty: Wrapping plain trust manager silently disables hostname verification
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, < 4.2.15.Final; <= 4.1.134.Final · CVE-2026-50010 · GHSA-c653-97m9-rcg9
- High, CVSS 7.5
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-48748 · GHSA-4grm-h2qv-h6w6
- High, CVSS 7.5
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
PyPI starlette · Upgrade to 1.3.1 or later · >= 0.4.1, < 1.3.1 · CVE-2026-54283 · GHSA-82w8-qh3p-5jfq · amended
- High, CVSS 8.7
Nest: Middleware Bypass on Fastify via Trailing Slash
npm @nestjs/platform-fastify · Upgrade to 11.1.24 or later · <= 11.1.23 · CVE-2026-54281 · GHSA-6v32-fjc9-9qf6 · amended
- High, CVSS 7.5
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
PyPI python-multipart · Upgrade to 0.0.30 or later · < 0.0.30 · CVE-2026-53539 · GHSA-5rvq-cxj2-64vf · amended
- Critical, CVSS 9.3
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
npm electron · Upgrade to 42.3.3 or later · >= 42.3.1, < 42.3.3 · CVE-2026-54257 · GHSA-q6m5-f73j-m9mc · amended
- High, CVSS 7.7
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
PyPI tornado · Upgrade to 6.5.6 or later · < 6.5.6 · CVE-2026-49853 · GHSA-3x9g-8vmp-wqvf · amended
- High, CVSS 7.5
tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
PyPI tornado · Upgrade to 6.5.6 or later · < 6.5.6 · CVE-2026-49855 · GHSA-mgf9-4vpg-hj56 · amended
- High, CVSS 7.5
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
PyPI starlette · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-48818 · GHSA-wqp7-x3pw-xc5r · amended
- High, CVSS 8.2
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
npm protobufjs-cli · Upgrade to 2.5.0 or 1.3.2 by release line · <= 1.3.1; >= 2.0.0, <= 2.4.2 · CVE-2026-54271 · GHSA-pr59-h9ph-3fr8 · amended
- High, CVSS 7.5
Vulnerable OpenSSL included in cryptography wheels
PyPI cryptography · Upgrade to 48.0.1 or later · >= 0.5.0, < 48.0.1 · GHSA-537c-gmf6-5ccf · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.signalr.protocols.messagepack +3 · Upgrade all 4 to 10.0.9, 9.0.17 or 8.0.28 by release line · >= 8.0.0, <= 8.0.27; >= 9.0.0, <= 9.0.16; >= 10.0.0, <= 10.0.8 · CVE-2026-45591 · GHSA-f8h2-vmm9-qhj6
- Critical, CVSS 9.8
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
npm @vitest/browser · Upgrade to 5.0.0-beta.4 (pre-release), 4.1.8 or 3.2.5 by release line · >= 5.0.0-beta.0, <= 5.0.0-beta.3; >= 4.0.0, <= 4.1.7; >= 3.0.0, <= 3.2.4 · +1 more package · CVE-2026-53633 · GHSA-g8mr-85jm-7xhm · amended
- High, CVSS 7.4
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
PyPI pyjwt · Upgrade to 2.13.0 or later · < 2.13.0 · CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx · amended
- High, CVSS 8.3
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
npm nodemailer · Upgrade to 8.0.8 or later · <= 8.0.7 · CVE-2026-82662 · GHSA-r7g4-qg5f-qqm2 · amended
- High, CVSS 7.5
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
npm protobufjs · Upgrade to 8.4.1 or 7.6.1 by release line · <= 7.6.0; >= 8.0.0, <= 8.4.0 · CVE-2026-48712 · GHSA-wcpc-wj8m-hjx6 · amended
- High, CVSS 8.7
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
npm form-data · Upgrade to 4.0.6, 3.0.5 or 2.5.6 by release line · < 2.5.6; >= 3.0.0, < 3.0.5; >= 4.0.0, < 4.0.6 · CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx · amended
- High, CVSS 8.3
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
npm @angular/service-worker · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54264 · GHSA-qxh6-94w6-9r5p · amended
- High, CVSS 8.2
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
npm @angular/common · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54268 · GHSA-48r7-hpm6-gfxm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.