Medium, CVSS 4.3
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
npm tarteaucitronjs · Upgrade to 1.33.0 or later · < 1.33.0 · CVE-2026-49977 · GHSA-jxj7-g6gm-49j7 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–30 of 30 matching · newest first
- High, CVSS 7.5
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
npm @libp2p/gossipsub · Upgrade to 16.0.0 or later · < 16.0.0 · CVE-2026-49866 · GHSA-cwc9-cp4j-mcvv · amended
- Medium, CVSS 5.3
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-49865 · GHSA-pj8j-p4g4-4vw8
- Medium, CVSS 5.3
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
npm morgan · Upgrade to 1.11.0 or later · >= 1.2.0, <= 1.10.1 · CVE-2026-5078 · GHSA-4vj7-5mj6-jm8m · amended
- Medium, CVSS 5.9
API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
Packagist api-platform/core +2 · Upgrade all 3 to 4.3.8, 4.2.25 or 4.1.29 by release line · >= 2.6.0, < 4.1.29; >= 4.2.0, < 4.2.25; >= 4.3.0, < 4.3.8 · CVE-2026-49858 · GHSA-pjhx-3c3w-9v23
A vendor fix does not resolve your finding until you verify it in your own systems.