Low, CVSS 3.7
Ruby json: JSON generator heap buffer overflow when streaming to an IO
RubyGems json · Upgrade to 2.19.9 or later · >= 2.9.0, < 2.19.9 · CVE-2026-54696 · GHSA-x2f5-4prf-w687
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–21 of 21 matching · newest first
- Medium, CVSS 6.3
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
Maven com.mchange:c3p0 · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2026-55223 · GHSA-w6w4-rjh9-9r58
- Medium, CVSS 5.1
React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
npm react-router · Upgrade to 7.18.0 or later · >= 6.0.0, < 7.18.0 · CVE-2026-53669 · GHSA-wrjc-x8rr-h8h6 · amended
- Medium, CVSS 6.9
React Router: Open redirect leading to XSS
npm react-router · Upgrade to 7.13.0 or later · >= 7.9.6, <= 7.12.0 · +1 more package · CVE-2026-53668 · GHSA-jjmj-jmhj-qwj2 · amended
- Medium, CVSS 6.9
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
npm react-router · Upgrade to 7.18.0 or later · >= 7.11.0, < 7.18.0 · CVE-2026-53667 · GHSA-h8fp-f39c-q6mh · amended
- Medium, CVSS 6.1
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
npm react-router · Upgrade to 7.18.0 or later · >= 6.4.0, < 7.18.0 · CVE-2026-53666 · GHSA-337j-9hxr-rhxg · amended
- Medium, CVSS 5.3
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-53467 · GHSA-8g53-9m3c-69xg
- High, CVSS 7.5
find-my-way: DDoS with HTTP2
npm find-my-way · Upgrade to 9.7.0 or later · <= 9.6.0 · CVE-2026-47219 · GHSA-c96f-x56v-gq3h · amended
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
PyPI pypdf · Upgrade to 6.14.2 or later · < 6.14.2 · CVE-2026-59935 · GHSA-g867-7843-wf8q · amended
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images
PyPI pypdf · Upgrade to 6.14.1 or later · < 6.14.1 · CVE-2026-59936 · GHSA-5xf7-4p34-54qr · amended
- Medium, CVSS 6.9
pypdf: Possible long runtimes for repeated malformed cross-reference entries
PyPI pypdf · Upgrade to 6.14.0 or later · < 6.14.0 · CVE-2026-59937 · GHSA-55h5-xmcq-c37v · amended
- Medium, CVSS 6.9
pypdf: Possible large memory usage for wrong image dimensions
PyPI pypdf · Upgrade to 6.14.0 or later · < 6.14.0 · CVE-2026-59938 · GHSA-5qjq-93h5-hrgp · amended
- High, CVSS 7.5
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
npm postcss · Upgrade to 8.5.12 or later · <= 8.5.11 · CVE-2026-45623 · GHSA-6g55-p6wh-862q · amended
- High, CVSS 7.5
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59933 · GHSA-xh5m-36r6-47m3
- High, CVSS 7.5
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59932 · GHSA-2mrg-gjxq-2gvr
- High, CVSS 7.7
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59931 · GHSA-6hq5-7373-42rg
- Critical, CVSS 9.1
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
npm next-auth · Upgrade to 5.0.0-beta.32 (pre-release) or later · >= 5.0.0-beta.0, <= 5.0.0-beta.31 · CVE-2026-73421 · GHSA-8fpg-xm3f-6cx3 · amended
- High, CVSS 7.5
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73418 · GHSA-xmf8-cvqr-rfgj · amended
- Critical, CVSS 9.1
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73420 · GHSA-7rqj-j65f-68wh · amended
- Medium, CVSS 6.8
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
npm @auth/core · Upgrade to 0.41.3 or later · <= 0.41.2 · +1 more package · CVE-2026-73419 · GHSA-x445-f3h2-j279 · amended
- Medium, CVSS 4.8
danger allows local OS command injection through crafted file paths
npm danger · Upgrade to 13.0.8 or later · < 13.0.8 · CVE-2026-16629 · GHSA-3x93-p86w-5jvh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.