Medium, CVSS 6.1
justhtml: to_markdown() code-span blank-line breakout enables XSS
PyPI justhtml · Upgrade to 1.22.0 or later · >= 0.9.0, <= 1.21.0 · CVE-2026-77088 · GHSA-jf6w-2mvx-633j · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–60 of 60 matching · newest first
- Critical, CVSS 9.1
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
npm i18next-fs-backend · Upgrade to 2.6.6 or later · < 2.6.6 · CVE-2026-48713 · GHSA-2933-q333-qg83 · amended
- Critical, CVSS 9.1
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
npm i18next-http-middleware · Upgrade to 3.9.7 or later · < 3.9.7 · CVE-2026-48714 · GHSA-f49m-vf83-692w · amended
- High, CVSS 7.5
OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing
Maven org.openidentityplatform.openam:openam-radius · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46560 · GHSA-386j-6m86-78f9 · amended
- High, CVSS 7.1
OpenAM Arbitrary OAuth Token Minting via Push Registration
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46498 · GHSA-cj8f-2fhf-826r · amended
- Medium, CVSS 4.4
@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write
npm @anthropic-ai/claude-code · Upgrade to 2.1.128 or later · >= 2.1.59, < 2.1.128 · CVE-2026-46406 · GHSA-4vp2-6q8c-pvq2 · amended
- High, CVSS 7.7
OpenAM has Unsafe Java Deserialization via SNS
Maven org.openidentityplatform.openam:openam-push-notification · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-45794 · GHSA-pp89-732f-3g8q · amended
- High, CVSS 8.2
Apache Shiro shiro-guice module vulnerable to authentication bypass
Maven org.apache.shiro:shiro-guice · Upgrade to 3.0.0 or later · >= 2.0.0, < 3.0.0 · CVE-2026-56091 · GHSA-qj64-jj84-w38j · amended
- Low, CVSS 2.0
Apache Shiro's "remember me" cookie age is not verified on the server.
Maven org.apache.shiro:shiro-web +1 · Upgrade all 2 to 3.0.0 or later · >= 1.2.4, < 3.0.0 · CVE-2026-56130 · GHSA-m8g6-vrr2-x7ff · amended
- High, CVSS 7.1
Tiptap contains an input validation vulnerability resulting in DoS
Packagist ueberdosis/tiptap-php · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-47110 · GHSA-4595-7fjw-r3jh
A vendor fix does not resolve your finding until you verify it in your own systems.