High, CVSS 7.5
Mistune inline_parser: quadratic-time parsing on long runs of **x** and ***x*** emphasis pairs
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59925 · GHSA-4j32-57v6-6g45 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Mistune inline_parser: quadratic-time parsing on long runs of
- High, CVSS 7.5
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59928 · GHSA-ffq3-xpv3-j92q · amended
- High, CVSS 7.5
js-yaml: YAML merge-key chains can force quadratic CPU consumption
npm js-yaml · Upgrade to 4.3.0 or 3.15.0 by release line · >= 3.0.0, < 3.15.0; >= 4.0.0, < 4.3.0 · CVE-2026-59869 · GHSA-52cp-r559-cp3m · amended
- High, CVSS 8.2
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.16 or later · <= 2.63.15 · CVE-2026-55667 · GHSA-fmm7-x4gx-8jhr
- High, CVSS 7.6
Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
Go github.com/cloudreve/Cloudreve/v4 · Upgrade to 4.0.0-20260606015557-ed20843dc3df (pre-release) or later · >= 4.0.0-20260114075425-bc6845bd742c, < 4.0.0-20260606015557-ed20843dc3df · CVE-2026-54560 · GHSA-vgj4-345g-jcf8
- High, CVSS 7.5
Pillow
GdImageFile._open(): image dimensions accepted without_decompression_bomb_check()PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-55380 · GHSA-phj9-mv4w-65pm · amended
- High, CVSS 7.5
Pillow
BdfFontFile:Image.new()called without_decompression_bomb_check()— bomb protection bypass via font loadingPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-55379 · GHSA-45hq-cxwh-f6vc · amended
- High, CVSS 7.5
Pillow:
FontFile.compile():Image.new()called without_decompression_bomb_check()PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-54060 · GHSA-5x94-69rx-g8h2 · amended
- High, CVSS 7.5
Pillow
PcfFontFile._load_bitmaps():Image.frombytes()called without_decompression_bomb_check()— bomb protection bypass via PCF font loadingPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-54059 · GHSA-8v84-f9pq-wr9x · amended
- High, CVSS 8.3
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-54058 · GHSA-62p4-gmf7-7g93 · amended
- High, CVSS 7.1
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role
npm @better-auth/sso · Upgrade to 1.6.11 or later · >= 1.2.10, < 1.6.11 · CVE-2026-53515 · GHSA-gv74-j8m3-fg5f · amended
- High, CVSS 7.7
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
npm brace-expansion · Upgrade to 5.0.7, 2.1.2 or 1.1.16 by release line · >= 3.0.0, < 5.0.7; < 1.1.16; >= 2.0.0, < 2.1.2 · CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp · amended
- High, CVSS 7.0
Composer: Arbitrary file write outside vendor via malicious transitive package name
Packagist composer/composer · Upgrade to 2.10.2 or 2.2.29 by release line · >= 2.3.0, < 2.10.2; >= 1.0.0, < 2.2.29 · CVE-2026-59948 · GHSA-499r-g7pc-vmp9
- High, CVSS 7.1
vLLM denial of service via prompt embeds on M-RoPE models
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.12.0, < 0.24.0 · CVE-2026-55514 · GHSA-33cg-gxv8-3p8g · amended
- High, CVSS 7.5
Tornado: Quadratic DoS via Crafted Multipart Parameters
PyPI tornado · Upgrade to 6.5.3 or later · < 6.5.3 · CVE-2025-67726 · GHSA-jhmp-mqwm-3gq8 · amended
- High, CVSS 7.5
Tornado: Quadratic DoS via Repeated Header Coalescing
PyPI tornado · Upgrade to 6.5.3 or later · < 6.5.3 · CVE-2025-67725 · GHSA-c98p-7wgm-6p64 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.