Medium, CVSS 6.9
pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
PyPI pypdf · Upgrade to 6.13.0 or later · < 6.13.0 · CVE-2026-54530 · GHSA-52x6-gq3r-vpf4 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–84 of 84 matching · newest first
- High, CVSS 7.1
Astro: Reflected XSS via unescaped slot name
npm astro · Upgrade to 6.3.3 or later · < 6.3.3 · CVE-2026-50146 · GHSA-8hv8-536x-4wqp · amended
- Medium, CVSS 5.1
Nuxt: Reflected XSS in
javascript:ordata:URLnpm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.0.0, < 3.21.7 · CVE-2026-53722 · GHSA-934w-87qh-qr26 · amended
- Medium, CVSS 5.5
Nuxt dev server vite-node IPC socket is world-connectable on Linux
npm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.18.0, < 3.21.7 · CVE-2026-56301 · GHSA-534h-c3cw-v3h9 · amended
- High, CVSS 8.8
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
npm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.11.0, < 3.21.7 · CVE-2026-53721 · GHSA-mm7m-92g8-7m47 · amended
- Medium, CVSS 5.1
Nuxt: URL-handling weaknesses in
navigateToandreloadNuxtApp: SSR open redirect, client-side script execution via theopenoption, and protocol-relative bypass inreloadNuxtAppnpm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.5.0, < 3.21.7 · CVE-2026-56326 · GHSA-c9cv-mq2m-ppp3 · amended
- Medium, CVSS 6.9
pypdf: Possible large memory usage for form XObjects during text extraction
PyPI pypdf · Upgrade to 6.12.2 or later · < 6.12.2 · CVE-2026-49461 · GHSA-j543-4vmf-qm7v · amended
- Medium, CVSS 5.1
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
PyPI pypdf · Upgrade to 6.12.2 or later · < 6.12.2 · CVE-2026-49460 · GHSA-5hgr-hg42-57jg · amended
- Medium, CVSS 6.9
pypdf: Manipulated XMP metadata streams can exhaust RAM
PyPI pypdf · Upgrade to 6.12.1 or later · < 6.12.1 · CVE-2026-48735 · GHSA-wjqc-6w8f-h24c · amended
A vendor fix does not resolve your finding until you verify it in your own systems.