High, CVSS 8.1
Koillection has an authenticated Server-Side Request Forgery issue
Packagist koillection/koillection · Upgrade to 1.8.4 or later · < 1.8.4 · CVE-2026-50888 · GHSA-gmxh-hjfv-qc2w
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 88 matching · newest first
- High, CVSS 8.6
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
Maven org.springframework.ai:spring-ai-gemfire-store +2 · Upgrade all 3 to 1.1.8 or 1.0.9 by release line · >= 1.0.0, <= 1.0.8; >= 1.1.0, <= 1.1.7 · CVE-2026-47835 · GHSA-cmwh-w62w-r2mf
- Critical, CVSS 9.8
Remotion: remote code execution (RCE) vulnerability
npm remotion · Upgrade to 4.0.410 or later · < 4.0.410 · CVE-2026-30120 · GHSA-2jqp-f4gr-44fr · amended
- Critical, CVSS 9.1
Remotion: arbitrary file write vulnerability
npm remotion · Upgrade to 4.0.410 or later · < 4.0.410 · CVE-2026-30121 · GHSA-g6pc-6676-c23j · amended
- Low, CVSS 2.3
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via
/.well-known/appspecific/com.chrome.devtools.jsonnpm nuxt · Upgrade to 4.4.7 or later · >= 4.0.0-alpha.1, < 4.4.7 · GHSA-rq7w-g337-39qq · amended
- High, CVSS 7.0
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
npm aws-cdk-lib · Upgrade to 2.246.0 or later · < 2.246.0 · CVE-2026-11417 · GHSA-999r-qq7v-r334 · amended
- Medium, CVSS 6.9
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-50560 · GHSA-563q-j3cm-6jxm
- Medium, CVSS 5.3
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
Maven io.netty:netty-codec-http · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-50020 · GHSA-hvcg-qmg6-jm4c
- High, CVSS 7.5
Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-50011 · GHSA-5w86-c3rq-vjj7
- High, CVSS 7.5
Netty: Wrapping plain trust manager silently disables hostname verification
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, < 4.2.15.Final; <= 4.1.134.Final · CVE-2026-50010 · GHSA-c653-97m9-rcg9
- Medium, CVSS 4.8
Netty: QUIC stateless reset token material exposed through header-visible connection IDs
Maven io.netty:netty-codec-classes-quic · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-50009 · GHSA-cq4q-cv5g-r8q5
- High, CVSS 7.5
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-48748 · GHSA-4grm-h2qv-h6w6
- Medium, CVSS 5.3
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
npm markdown-it · Upgrade to 14.2.0 or later · <= 14.1.1 · CVE-2026-48988 · GHSA-6v5v-wf23-fmfq · amended
- High, CVSS 7.5
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
PyPI starlette · Upgrade to 1.3.1 or later · >= 0.4.1, < 1.3.1 · CVE-2026-54283 · GHSA-82w8-qh3p-5jfq · amended
- Medium, CVSS 5.3
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
npm @opentelemetry/core · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-54285 · GHSA-8988-4f7v-96qf · amended
- Low, CVSS 3.7
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
PyPI starlette · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-54282 · GHSA-jp82-jpqv-5vv3 · amended
- Medium, CVSS 5.9
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
PyPI tornado · Upgrade to 6.5.7 or later · <= 6.5.6 · CVE-2026-91992 · GHSA-pw6j-qg29-8w7f · amended
- High, CVSS 8.7
Nest: Middleware Bypass on Fastify via Trailing Slash
npm @nestjs/platform-fastify · Upgrade to 11.1.24 or later · <= 11.1.23 · CVE-2026-54281 · GHSA-6v32-fjc9-9qf6 · amended
- High, CVSS 7.5
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
PyPI python-multipart · Upgrade to 0.0.30 or later · < 0.0.30 · CVE-2026-53539 · GHSA-5rvq-cxj2-64vf · amended
- Low, CVSS 3.7
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
PyPI python-multipart · Upgrade to 0.0.31 or later · < 0.0.31 · CVE-2026-53540 · GHSA-v9pg-7xvm-68hf · amended
- Low, CVSS 3.7
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
PyPI python-multipart · Upgrade to 0.0.30 or later · < 0.0.30 · CVE-2026-53538 · GHSA-6jv3-5f52-599m · amended
- Low, CVSS 3.7
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
PyPI python-multipart · Upgrade to 0.0.30 or later · < 0.0.30 · CVE-2026-53537 · GHSA-vffw-93wf-4j4q · amended
- Critical, CVSS 9.3
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
npm electron · Upgrade to 42.3.3 or later · >= 42.3.1, < 42.3.3 · CVE-2026-54257 · GHSA-q6m5-f73j-m9mc · amended
- High, CVSS 7.7
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
PyPI tornado · Upgrade to 6.5.6 or later · < 6.5.6 · CVE-2026-49853 · GHSA-3x9g-8vmp-wqvf · amended
- High, CVSS 7.5
tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
PyPI tornado · Upgrade to 6.5.6 or later · < 6.5.6 · CVE-2026-49855 · GHSA-mgf9-4vpg-hj56 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.