High, CVSS 8.7
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
Go google.golang.org/grpc · Upgrade to 1.83.1 or later · <= 1.83.0 · CVE-2026-84304 · GHSA-vp52-pcj8-j9qc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 31 matching · newest first
- High, CVSS 7.3
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Packagist typo3/cms-backend · Upgrade to 13.4.34 or later · >= 13.0.0, < 13.4.34 · +1 more package · CVE-2026-19418 · GHSA-68jx-f42c-7599 · amended
- Medium, CVSS 6.5
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Packagist filament/filament · Upgrade to 5.7.6 or 4.12.6 by release line · >= 4.0.0, < 4.12.6; >= 5.0.0, < 5.7.6 · CVE-2026-84306 · GHSA-r3j6-gpjw-qfjr · amended
- Low, CVSS 3.7
Filament: Password validity disclosure for accounts denied panel access on login page
Packagist filament/filament · Upgrade to 5.7.5 or 4.12.5 by release line · >= 4.0.0, < 4.12.5; >= 5.0.0, < 5.7.5 · CVE-2026-84307 · GHSA-xwpv-pqxp-5v36 · amended
- High, CVSS 8.1
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
Packagist filament/filament · Upgrade to 5.7.0 or 4.12.0 by release line · >= 4.0.0, < 4.12.0; >= 5.0.0, < 5.7.0 · CVE-2026-77567 · GHSA-52xp-w8hr-xv3c · amended
- Medium, CVSS 4.8
pypdf: Possible long runtimes/large memory usage when retrieving outlines
PyPI pypdf · Upgrade to 6.16.1 or later · < 6.16.1 · CVE-2026-84310 · GHSA-23w6-3w8w-8484
- Medium, CVSS 4.8
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
PyPI pypdf · Upgrade to 6.16.1 or later · < 6.16.1 · CVE-2026-84311 · GHSA-763m-79hh-57f2
- Medium, CVSS 6.9
pypdf: Possible infinite loop for TreeObject.insert_child
PyPI pypdf · Upgrade to 6.16.0 or later · < 6.16.0 · CVE-2026-84309 · GHSA-jp53-mhqp-8xcg
- Medium, CVSS 5.1
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-84305 · GHSA-cfqr-cjx5-5jcm
- Medium, CVSS 5.4
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
npm sanitize-html · Upgrade to 2.17.7 or later · >= 1.9.0, <= 2.17.6 · CVE-2026-84371 · GHSA-g8qq-57p8-ggw5
- Critical, CVSS 9.3
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79675 · GHSA-m4rf-3fr8-xwx3 · amended
- High, CVSS 7.5
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Packagist league/commonmark · Upgrade to 2.10.0 or later · >= 1.5.0, < 2.10.0 · CVE-2026-86428 · GHSA-8rr7-cvq3-gmfh · amended
- High, CVSS 8.5
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-78680 · GHSA-6hwm-xvph-95vm
- High, CVSS 7.5
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Packagist league/commonmark · Upgrade to 2.9.1 or later · >= 1.5.0, < 2.9.1 · CVE-2026-86429 · GHSA-jjv6-8j6v-6j52 · amended
- High, CVSS 7.2
league/commonmark XSS:
on*event-handler filter inAttributesExtensionbypassed with a U+000C form feedPackagist league/commonmark · Upgrade to 2.9.1 or later · >= 2.7.0, < 2.9.1 · CVE-2026-86431 · GHSA-f8fg-pg57-v4j8 · amended
- High, CVSS 7.5
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Packagist league/commonmark · Upgrade to 2.9.1 or later · >= 0.6.0, < 2.9.1 · CVE-2026-86430 · GHSA-j8pm-gj4c-rq4x · amended
- Medium, CVSS 6.9
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
PyPI tornado · Upgrade to 6.5.8 or later · <= 6.5.7 · GHSA-8423-8fgw-73vq
- Low, CVSS 2.3
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive
**kwargspath inset_cookiePyPI tornado · Upgrade to 6.5.8 or later · >= 6.5.5, < 6.5.8 · GHSA-wwv5-g3v4-889x
- Medium, CVSS 5.3
Django REST framework: Potential bypass of Django
DATA_UPLOAD_MAX_MEMORY_SIZEwhen parsing oversized JSON and urlencoded request bodies via DRFrequest.dataPyPI djangorestframework · Upgrade to 3.17.2 or later · < 3.17.2 · CVE-2026-73228 · GHSA-2m8g-3cmr-wg3w
- Medium, CVSS 4.3
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
PyPI djangorestframework · Upgrade to 3.17.2 or later · <= 3.17.1 · CVE-2026-73229 · GHSA-g47c-3xmw-q6m2
- High, CVSS 7.4
nanoid: Integer Overflow or Wraparound
npm nanoid · Upgrade to 5.1.11 or 3.3.12 by release line · < 3.3.12; >= 4.0.0, < 5.1.11 · CVE-2026-73086 · GHSA-xwg4-73v4-xw9w
- High, CVSS 7.4
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
npm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · >= 11.0.0, < 11.11.0; >= 10.7.0, < 10.34.5 · GHSA-vx52-2968-3vc6
- High, CVSS 7.1
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
npm pnpm · Upgrade to 12.0.0-alpha.5 (pre-release) or later · >= 12.0.0-alpha.0, < 12.0.0-alpha.5 · GHSA-2rx9-3g3h-c2jv · amended
- Medium, CVSS 6.5
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
npm @appium/base-driver · Upgrade to 10.7.0 or later · <= 10.6.0 · CVE-2026-58191 · GHSA-3wgp-x9p5-c7cc
- High, CVSS 8.8
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
PyPI mlflow · Upgrade to 3.15.0 or later · >= 2.1.0, < 3.15.0 · GHSA-gqvg-gmmx-x4hm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.