Medium, CVSS 5.9
Guzzle: URI fragments disclosed in redirect Referer headers
Packagist guzzlehttp/guzzle · Upgrade to 7.15.1 or later · < 7.15.1 · CVE-2026-67354 · GHSA-h95v-h523-3mw8
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 90 matching · newest first
- Medium, CVSS 5.9
Guzzle: Host-only cookie scope is not preserved
Packagist guzzlehttp/guzzle · Upgrade to 7.15.1 or later · < 7.15.1 · CVE-2026-67355 · GHSA-wm3w-8rrp-j577
- Medium, CVSS 5.3
Guzzle: Unbounded response cookies risk denial of service
Packagist guzzlehttp/guzzle · Upgrade to 7.15.1 or later · < 7.15.1 · CVE-2026-67353 · GHSA-f283-ghqc-fg79
- Medium, CVSS 5.1
Astro: composable
astro/honopipeline bypassessecurity.checkOriginwhenmiddleware()is absent or misorderednpm astro · Upgrade to 7.0.6 or later · >= 7.0.0, < 7.0.6 · CVE-2026-73423 · GHSA-8mv7-9c27-98vc · amended
- Medium, CVSS 6.5
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
npm @astrojs/vercel · Upgrade to 11.0.3 or later · >= 10.0.3, < 11.0.3 · CVE-2026-73424 · GHSA-x27w-589x-frm2 · amended
- Low, CVSS 3.7
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
npm @astrojs/netlify · Upgrade to 8.1.2 or later · < 8.1.2 · CVE-2026-73425 · GHSA-hp3v-mfqw-h74c · amended
- Low, CVSS 3.7
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
npm body-parser · Upgrade to 2.3.0 or 1.20.6 by release line · < 1.20.6; >= 2.0.0, < 2.3.0 · CVE-2026-12590 · GHSA-v422-hmwv-36x6 · amended
- Low, CVSS 2.1
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
npm @astrojs/node · Upgrade to 11.0.2 or later · >= 8.1.0, < 11.0.2 · CVE-2026-59730 · GHSA-r557-wffq-wvrc · amended
- Medium, CVSS 5.1
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
npm astro · Upgrade to 7.0.6 or later · < 7.0.6 · CVE-2026-59729 · GHSA-f48w-9m4c-m7f5 · amended
- Medium, CVSS 4.3
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
npm @astrojs/rss · Upgrade to 4.0.19 or later · >= 1.0.0, < 4.0.19 · CVE-2026-59728 · GHSA-8j5q-mfj2-5q9q · amended
- Low, CVSS 2.1
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
npm astro · Upgrade to 7.0.4 or later · >= 3.10.0, < 7.0.4 · CVE-2026-59727 · GHSA-7pw4-f3q4-r2p2 · amended
- High, CVSS 7.5
Pillow: Controlled heap out-of-bounds write in Pillow
ImageCmsTransform.apply()via output mode mismatchPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59205 · GHSA-9hw9-ch79-4vh6 · amended
- High, CVSS 8.7
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
PyPI pillow · Upgrade to 12.3.0 or later · >= 8.2.0, < 12.3.0 · CVE-2026-59204 · GHSA-vjc4-5qp5-m44j · amended
- Medium, CVSS 5.3
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
PyPI pillow · Upgrade to 12.3.0 or later · >= 12.0.0, < 12.3.0 · CVE-2026-59203 · GHSA-pg7v-jwj7-p798 · amended
- High, CVSS 7.5
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
PyPI pillow · Upgrade to 12.3.0 or later · >= 5.1.0, < 12.3.0 · CVE-2026-59200 · GHSA-jjj6-mw9f-p565 · amended
- High, CVSS 7.5
Pillow: Heap out-of-bounds write
Image.paste()/Image.crop()via signed coordinate overflowPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59199 · GHSA-6r8x-57c9-28j4 · amended
- Medium, CVSS 6.5
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
PyPI pillow · Upgrade to 12.3.0 or later · >= 5.2.0, < 12.3.0 · CVE-2026-59198 · GHSA-fj7v-r99m-22gq · amended
- High, CVSS 8.2
Pillow: Heap out-of-bounds write in
ImageFilter.RankFiltervia integer overflow inImagingExpandPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59197 · GHSA-xj96-63gp-2gmr · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50651 · GHSA-wp74-jgxh-gv4q · amended
- Medium, CVSS 6.5
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50659 · GHSA-74jp-vm22-8q8x
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50525 · GHSA-8q5v-6pqq-x66h
- High, CVSS 8.2
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50528 · GHSA-qvw7-jm5c-6hqw
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50648 · GHSA-23rf-6693-g89p
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50524 · GHSA-w7cw-xp7h-6j5j · amended
- High, CVSS 8.1
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-47304 · GHSA-g8r8-53c2-pm3f
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.