High, CVSS 7.5
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
npm browserslist · Upgrade to 4.28.7 or later · <= 4.28.6 · CVE-2026-73089 · GHSA-c83g-rgw3-j3cx
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–31 of 31 matching · newest first
- High, CVSS 7.5
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
npm browserslist · Upgrade to 4.28.7 or later · <= 4.28.6 · CVE-2026-73088 · GHSA-73wf-gq98-2v4g
- High, CVSS 8.2
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
npm mysql2 · Upgrade to 3.22.0 or later · < 3.22.0 · GHSA-3f6p-5ww8-9rcr
- Medium, CVSS 6.9
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Packagist smarty/smarty · Upgrade to 5.8.2 or 4.5.7 by release line · >= 5.0.0, < 5.8.2; < 4.5.7 · CVE-2026-62993 · GHSA-cq55-c7wv-pxmq · amended
- Medium, CVSS 6.9
Kirby: System path exposure from error messages in the REST API
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · <= 4.9.4; >= 5.0.0, < 5.5.2 · CVE-2026-69127 · GHSA-rf2p-vh74-7vvh · amended
- High, CVSS 7.5
jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input
Maven org.jolokia:jolokia-service-jsr160 · Upgrade to 2.6.2 or later · < 2.6.2 · CVE-2026-84218 · GHSA-c9ff-59g8-m36q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.