Medium, CVSS 6.9
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.8.5, <= 0.23.0 · CVE-2026-54235 · GHSA-7h4p-rffg-7823 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–68 of 68 matching · newest first
- Medium, CVSS 6.1
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
npm chrome-devtools-mcp · Upgrade to 1.1.0 or later · >= 0.20.0, <= 1.0.1 · CVE-2026-53765 · GHSA-3pvj-jv98-qhjq · amended
- Medium, CVSS 5.3
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
npm n8n · Upgrade to 2.26.2, 2.25.7 or 1.123.55 by release line · < 1.123.55; >= 2.26.0, < 2.26.2; >= 2.0.0-rc.0, < 2.25.7 · CVE-2026-56775 · GHSA-664h-gpgq-h6xx · amended
- Medium, CVSS 4.4
Pi Agent: Pi loads project-local extensions without approval
npm @earendil-works/pi-coding-agent · Upgrade to 0.79.0 or later · < 0.79.0 · CVE-2026-54325 · GHSA-mqxh-6gq7-558m · amended
- Medium, CVSS 4.2
Laravel Framework: Temporary Signed URL Path Confusion
Packagist laravel/framework · Upgrade to 13.12.0 or 12.61.1 by release line · >= 13.0.0, < 13.12.0; < 12.61.1 · GHSA-crmm-hgp2-wgrp
- High, CVSS 8.9
Laravel Framework: CRLF injection in default email rule
Packagist laravel/framework · Upgrade to 13.10.0 or 12.60.0 by release line · >= 13.0.0, <= 13.9.0; < 12.60.0 · GHSA-5vg9-5847-vvmq
- Unrated
HTTP Response Queue Poisoning via TOCTOU Race Condition in
http.Agentruntime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48931
- Unrated
Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48930
- Unrated
Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48933
- Unrated
Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48618
- Unrated
Proxy credentials leaked in ERR_PROXY_TUNNEL error message
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48615
- Unrated
Permission Model bypass via FileHandle.utimes() in the promises API
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48935
- Unrated
Unbounded memory growth in
node:http2clients via attacker-controlled ORIGIN framesruntime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48619
- Unrated
Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)
runtime node · Upgrade to 26.3.1 or later · >= 26.0.0, < 26.3.1 · CVE-2026-48936
- Unrated
Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48928
- Unrated
TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48934
- Unrated
HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
runtime node · Upgrade to 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0 · CVE-2026-48937
- Unrated
Permission Model Bypass via
process.report.writeReport()Path Misvalidationruntime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48617
A vendor fix does not resolve your finding until you verify it in your own systems.