High, CVSS 7.3
Open WebUI: Stored web worker XSS via Pyodide
PyPI open-webui · Upgrade to 0.10.0 or later · < 0.10.0 · CVE-2026-59214 · GHSA-4r2p-27mh-5m22 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 129 matching · newest first
- High, CVSS 7.7
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
npm @anthropic-ai/claude-code · Upgrade to 2.1.163 or later · >= 2.1.38, < 2.1.163 · CVE-2026-55607 · GHSA-7835-87q9-rgvv · amended
- High, CVSS 7.5
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Maven io.netty:netty-codec-xml · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; <= 4.1.135.Final · CVE-2026-73507 · GHSA-v74w-7mr3-4qg3
- Medium, CVSS 5.3
Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
Maven io.netty:netty-codec-dns · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; <= 4.1.135.Final · CVE-2026-73508 · GHSA-mfg7-5gfp-c4w3
- High, CVSS 7.5
js-yaml: Exponential parsing time in flow collections leads to denial of service
npm js-yaml · Upgrade to 5.2.2 or later · >= 5.0.0, <= 5.2.1 · CVE-2026-73643 · GHSA-pm4m-ph32-ghv5 · amended
- Medium, CVSS 5.3
Russh: client wrong-length X25519
clone_from_slicepanic (pre-auth DoS)crates.io russh · Upgrade to 0.62.4 or later · <= 0.62.3 · CVE-2026-73429 · GHSA-g9hv-x236-4qp3
- Medium, CVSS 4.3
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
crates.io russh · Upgrade to 0.62.4 or later · <= 0.62.3 · CVE-2026-73489 · GHSA-cqjc-rmpq-xprq
- Medium, CVSS 5.3
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
crates.io russh · Upgrade to 0.62.4 or later · <= 0.62.3 · CVE-2026-73430 · GHSA-5xvq-cp9x-6p6r
- High, CVSS 7.1
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
npm react-router · Upgrade to 8.3.0 or 7.18.2 by release line · >= 7.12.0, < 7.18.2; >= 8.0.0, < 8.3.0 · GHSA-qwww-vcr4-c8h2 · amended
- Medium, CVSS 5.3
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
npm @fastify/static · Upgrade to 10.1.2 or later · <= 10.1.1 · CVE-2026-7120 · GHSA-8pvw-jcv7-9cmj · amended
- High, CVSS 7.5
@fastify/static vulnerable to route guard bypass via path traversal
npm @fastify/static · Upgrade to 10.1.1 or later · <= 10.1.0 · CVE-2026-15074 · GHSA-83w8-p2f5-377r · amended
- High, CVSS 8.7
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73625 · GHSA-r9mr-m37c-5fr3 · amended
- High, CVSS 7.5
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73623 · GHSA-6p8h-3wgx-97gf · amended
- High, CVSS 7.2
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73624 · GHSA-fjr4-x663-mwxc · amended
- High, CVSS 7.5
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
npm tar · Upgrade to 7.5.21 or later · <= 7.5.20 · CVE-2026-73566 · GHSA-r292-9mhp-454m · amended
- High, CVSS 7.5
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
npm postcss · Upgrade to 8.5.18 or later · <= 8.5.17 · CVE-2026-73646 · GHSA-r28c-9q8g-f849 · amended
- Critical, CVSS 10.0
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
npm @prompty/core · Upgrade to 2.0.0-beta.5 (pre-release) or 0.1.5 by release line · <= 0.1.4; >= 2.0.0-alpha.1, <= 2.0.0-beta.4 · CVE-2026-73299 · GHSA-w28w-gp39-m4p6 · amended
- Medium, CVSS 6.5
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
npm mongoose · Upgrade to 9.7.2, 8.24.1, 7.8.10 or 6.13.10 by release line · < 6.13.10; >= 7.0.0, < 7.8.10; >= 8.0.0, < 8.24.1; >= 9.0.0, < 9.7.2 · CVE-2026-73562 · GHSA-664h-wqgq-64gw · amended
- High, CVSS 7.0
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
PyPI gitpython · Upgrade to 3.1.53 or later · <= 3.1.52 · CVE-2026-69097 · GHSA-3rp5-jjmw-4wv2 · amended
- Critical, CVSS 9.8
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
npm velocityjs · Upgrade to 2.1.7 or later · <= 2.1.6 · CVE-2026-73649 · GHSA-7gfh-x38p-prh3 · amended
- Medium, CVSS 4.7
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via
redirect_uriallowlist bypassnpm @backstage/plugin-auth-backend · Upgrade to 0.29.2 or later · <= 0.29.1 · CVE-2026-73563 · GHSA-38hq-7x33-php4 · amended
- Medium, CVSS 5.1
ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
NuGet magick.net-q8-x86 +5 · Upgrade all 6 to 14.15.0 or later · < 14.15.0 · CVE-2026-62946 · GHSA-h22j-f9xw-xjjm
- Medium, CVSS 5.0
ImageMagick: Heap Buffer Over-Write in fx operation
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-62363 · GHSA-422r-8c97-xcg4
- Medium, CVSS 4.7
ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-62343 · GHSA-f5m7-cqgw-8hm7
- Medium, CVSS 5.3
PyMdown Extensions: Path traversal in the b64 extension lets read files outside base_path
PyPI pymdown-extensions · Upgrade to 11.0.0 or later · <= 10.21.3 · CVE-2026-61632 · GHSA-9xwg-3r6f-jcx2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.