High, CVSS 8.7
shell-quote: Quadratic-complexity Denial of Service in parse() (CWE-407)
npm shell-quote · Upgrade to 1.9.0 or later · <= 1.8.4 · CVE-2026-13311 · GHSA-395f-4hp3-45gv · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 90 matching · newest first
shell-quote: Quadratic-complexity Denial of Service in
- High, CVSS 8.6
Directus: Authorization-dependent response served from unsegmented cache key
npm directus · Upgrade to 12.0.0 or later · < 12.0.0 · CVE-2026-61836 · GHSA-c6w9-5g5j-jh2p · amended
- High, CVSS 7.7
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
npm directus · Upgrade to 12.0.0 or later · < 12.0.0 · CVE-2026-61835 · GHSA-j5h6-vqc3-phqh · amended
- Critical, CVSS 9.3
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
PyPI lightrag-hku · Upgrade to 1.5.4 or later · < 1.5.4 · CVE-2026-61740 · GHSA-f4vv-55c2-5789 · amended
- Medium, CVSS 5.3
Guzzle: Proxy-Authorization headers can be sent to origin servers
Packagist guzzlehttp/guzzle · Upgrade to 7.14.2 or later · < 7.14.2 · CVE-2026-67339 · GHSA-94pj-82f3-465w
- Critical, CVSS 9.3
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
PyPI lightrag-hku · Upgrade to 1.5.4 or later · <= 1.5.3 · CVE-2026-61736 · GHSA-6x6h-qqr7-855w · amended
- Medium, CVSS 6.1
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to
javascript:executionPyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59929 · GHSA-qfrw-5rxm-mhh2 · amended
- Medium, CVSS 4.3
Mistune toc / TableOfContents directive: heading IDs use predictable
toc_Nnumbering with no slugification, allowing collision with attacker-controlledid="toc_N"contentPyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59930 · GHSA-2hm2-hc3v-44h9 · amended
- Medium, CVSS 5.9
Mistune: Arbitrary File Read via Include directive path traversal
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59924 · GHSA-r4rv-85jg-w4mf · amended
- High, CVSS 7.5
Mistune plugins/formatting: quadratic-time parsing on long runs of
~~x~~,==x==, and^^x^^markers (strikethrough / mark / insert)PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59922 · GHSA-c8j7-8cv4-2xmq · amended
- Medium, CVSS 5.3
Mistune: XSS via unescaped class option in Admonition directive
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59926 · GHSA-g97x-gvcm-x72h · amended
- Medium, CVSS 6.1
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59923 · GHSA-8c25-4j27-2rv3 · amended
- High, CVSS 7.5
Mistune inline_parser: quadratic-time parsing on long runs of
**x**and***x***emphasis pairsPyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59925 · GHSA-4j32-57v6-6g45 · amended
- Medium, CVSS 5.3
Mistune directives/include: mutual
.. include::recursion crashes the renderer withRecursionError, denial of service via two attacker-controlled markdown filesPyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59927 · GHSA-8mpj-m6qm-5qr8 · amended
- High, CVSS 7.5
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59928 · GHSA-ffq3-xpv3-j92q · amended
- Medium, CVSS 5.3
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
npm js-yaml · Upgrade to 5.2.0 or later · >= 5.0.0, <= 5.1.0 · CVE-2026-59868 · GHSA-g796-fgmg-93mv · amended
- High, CVSS 7.5
js-yaml: YAML merge-key chains can force quadratic CPU consumption
npm js-yaml · Upgrade to 4.3.0 or 3.15.0 by release line · >= 3.0.0, < 3.15.0; >= 4.0.0, < 4.3.0 · CVE-2026-59869 · GHSA-52cp-r559-cp3m · amended
- Medium, CVSS 5.3
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
npm js-yaml · Upgrade to 5.2.1 or later · >= 5.0.0, <= 5.2.0 · CVE-2026-59870 · GHSA-724g-mxrg-4qvm · amended
- Medium, CVSS 6.3
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.16 or later · <= 2.63.15 · CVE-2026-55668 · GHSA-8wc8-hf36-mjh9
- High, CVSS 8.2
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.16 or later · <= 2.63.15 · CVE-2026-55667 · GHSA-fmm7-x4gx-8jhr
- High, CVSS 7.6
Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
Go github.com/cloudreve/Cloudreve/v4 · Upgrade to 4.0.0-20260606015557-ed20843dc3df (pre-release) or later · >= 4.0.0-20260114075425-bc6845bd742c, < 4.0.0-20260606015557-ed20843dc3df · CVE-2026-54560 · GHSA-vgj4-345g-jcf8
- Medium, CVSS 4.5
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-55798 · GHSA-4x4j-2g7c-83w6 · amended
- High, CVSS 7.5
Pillow
GdImageFile._open(): image dimensions accepted without_decompression_bomb_check()PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-55380 · GHSA-phj9-mv4w-65pm · amended
- High, CVSS 7.5
Pillow
BdfFontFile:Image.new()called without_decompression_bomb_check()— bomb protection bypass via font loadingPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-55379 · GHSA-45hq-cxwh-f6vc · amended
- High, CVSS 7.5
Pillow:
FontFile.compile():Image.new()called without_decompression_bomb_check()PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-54060 · GHSA-5x94-69rx-g8h2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.