High, CVSS 8.7
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
Go google.golang.org/grpc · Upgrade to 1.83.1 or later · <= 1.83.0 · CVE-2026-84304 · GHSA-vp52-pcj8-j9qc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.3
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Packagist typo3/cms-backend · Upgrade to 13.4.34 or later · >= 13.0.0, < 13.4.34 · +1 more package · CVE-2026-19418 · GHSA-68jx-f42c-7599 · amended
- High, CVSS 8.1
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
Packagist filament/filament · Upgrade to 5.7.0 or 4.12.0 by release line · >= 4.0.0, < 4.12.0; >= 5.0.0, < 5.7.0 · CVE-2026-77567 · GHSA-52xp-w8hr-xv3c · amended
- Critical, CVSS 9.3
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79675 · GHSA-m4rf-3fr8-xwx3 · amended
- High, CVSS 7.5
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Packagist league/commonmark · Upgrade to 2.10.0 or later · >= 1.5.0, < 2.10.0 · CVE-2026-86428 · GHSA-8rr7-cvq3-gmfh · amended
- High, CVSS 8.5
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-78680 · GHSA-6hwm-xvph-95vm
- High, CVSS 7.5
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Packagist league/commonmark · Upgrade to 2.9.1 or later · >= 1.5.0, < 2.9.1 · CVE-2026-86429 · GHSA-jjv6-8j6v-6j52 · amended
- High, CVSS 7.2
league/commonmark XSS:
on*event-handler filter inAttributesExtensionbypassed with a U+000C form feedPackagist league/commonmark · Upgrade to 2.9.1 or later · >= 2.7.0, < 2.9.1 · CVE-2026-86431 · GHSA-f8fg-pg57-v4j8 · amended
- High, CVSS 7.5
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Packagist league/commonmark · Upgrade to 2.9.1 or later · >= 0.6.0, < 2.9.1 · CVE-2026-86430 · GHSA-j8pm-gj4c-rq4x · amended
- High, CVSS 7.4
nanoid: Integer Overflow or Wraparound
npm nanoid · Upgrade to 5.1.11 or 3.3.12 by release line · < 3.3.12; >= 4.0.0, < 5.1.11 · CVE-2026-73086 · GHSA-xwg4-73v4-xw9w
- High, CVSS 7.4
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
npm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · >= 11.0.0, < 11.11.0; >= 10.7.0, < 10.34.5 · GHSA-vx52-2968-3vc6
- High, CVSS 7.1
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
npm pnpm · Upgrade to 12.0.0-alpha.5 (pre-release) or later · >= 12.0.0-alpha.0, < 12.0.0-alpha.5 · GHSA-2rx9-3g3h-c2jv · amended
- High, CVSS 8.8
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
PyPI mlflow · Upgrade to 3.15.0 or later · >= 2.1.0, < 3.15.0 · GHSA-gqvg-gmmx-x4hm
- High, CVSS 7.5
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
npm browserslist · Upgrade to 4.28.7 or later · <= 4.28.6 · CVE-2026-73089 · GHSA-c83g-rgw3-j3cx
- High, CVSS 7.5
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
npm browserslist · Upgrade to 4.28.7 or later · <= 4.28.6 · CVE-2026-73088 · GHSA-73wf-gq98-2v4g
- High, CVSS 8.2
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
npm mysql2 · Upgrade to 3.22.0 or later · < 3.22.0 · GHSA-3f6p-5ww8-9rcr
- High, CVSS 7.5
jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input
Maven org.jolokia:jolokia-service-jsr160 · Upgrade to 2.6.2 or later · < 2.6.2 · CVE-2026-84218 · GHSA-c9ff-59g8-m36q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.