High, CVSS 7.5
find-my-way: DDoS with HTTP2
npm find-my-way · Upgrade to 9.7.0 or later · <= 9.6.0 · CVE-2026-47219 · GHSA-c96f-x56v-gq3h · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
PyPI pypdf · Upgrade to 6.14.2 or later · < 6.14.2 · CVE-2026-59935 · GHSA-g867-7843-wf8q · amended
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images
PyPI pypdf · Upgrade to 6.14.1 or later · < 6.14.1 · CVE-2026-59936 · GHSA-5xf7-4p34-54qr · amended
- High, CVSS 7.5
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
npm postcss · Upgrade to 8.5.12 or later · <= 8.5.11 · CVE-2026-45623 · GHSA-6g55-p6wh-862q · amended
- High, CVSS 7.5
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59933 · GHSA-xh5m-36r6-47m3
- High, CVSS 7.5
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59932 · GHSA-2mrg-gjxq-2gvr
- High, CVSS 7.7
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59931 · GHSA-6hq5-7373-42rg
- Critical, CVSS 9.1
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
npm next-auth · Upgrade to 5.0.0-beta.32 (pre-release) or later · >= 5.0.0-beta.0, <= 5.0.0-beta.31 · CVE-2026-73421 · GHSA-8fpg-xm3f-6cx3 · amended
- High, CVSS 7.5
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73418 · GHSA-xmf8-cvqr-rfgj · amended
- Critical, CVSS 9.1
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73420 · GHSA-7rqj-j65f-68wh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.