Medium, CVSS 5.9
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
npm nodemailer · Upgrade to 9.1.1 or later · <= 9.1.0 · CVE-2026-92595 · GHSA-8m3c-c648-2xjj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 89 matching · newest first
- High, CVSS 8.7
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.11, <= 0.9.11 · CVE-2026-83617 · GHSA-jxjr-3g7g-3944 · amended
- High, CVSS 8.7
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.0, <= 0.9.11 · CVE-2026-83609 · GHSA-3px3-54cx-rmw9 · amended
- High, CVSS 8.7
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.10, <= 0.9.11 · CVE-2026-83618 · GHSA-vr34-hp96-76pp · amended
- High, CVSS 8.7
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
npm @xmldom/xmldom · Upgrade to 0.8.15 or later · >= 0.7.0, <= 0.8.14 · CVE-2026-83619 · GHSA-x4fp-j954-r2f4 · amended
- High, CVSS 8.7
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.0-beta.1, <= 0.9.11 · CVE-2026-83612 · GHSA-6mj3-qw4j-hgrw · amended
- Critical, CVSS 9.8
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Packagist predis/predis · Upgrade to 3.3.0 or later · >= 3.0.0-RC1, < 3.3.0 · CVE-2026-84372 · GHSA-w6f5-v2h6-g786 · amended
- Critical, CVSS 9.2
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
Packagist cakephp/cakephp +1 · Upgrade all 2 to 5.3.7, 5.2.15 or 5.1.10 by release line · >= 5.3.0, < 5.3.7; >= 5.2.0, < 5.2.15; >= 5.1.0, < 5.1.10 · CVE-2026-77635 · GHSA-fxf7-vhh8-7vpq · amended
- High, CVSS 8.2
CakePHP: SmtpTransport vulnerable to CRLF header injection
Packagist cakephp/cakephp · Upgrade to 5.3.7, 5.2.14, 5.1.9 or 2 more by release line · >= 4.5.0, < 4.5.12; >= 4.6.0, < 4.6.5; >= 5.0.0, < 5.1.9; >= 5.2.0, < 5.2.14; >= 5.3.0, < 5.3.7 · CVE-2026-77634 · GHSA-2qh5-382h-3jpc · amended
- Medium, CVSS 6.9
Colord: Slow rejection of oversized malformed color strings
npm colord · Upgrade to 2.9.4 or later · < 2.9.4 · CVE-2026-85062 · GHSA-2wm5-q62r-hmrv · amended
- Critical, CVSS 9.0
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
npm next · Upgrade to 16.3.3 or 15.5.24 by release line · >= 13.4.0, < 15.5.24; >= 16.0.0, < 16.3.3 · CVE-2026-75604 · GHSA-p293-qw3h-jr36 · amended
- Low, CVSS 3.7
joi: object().rename() with a template target can set the validated object's prototype
npm joi · Upgrade to 18.2.4 or 17.13.5 by release line · >= 16.0.0, < 17.13.5; >= 18.0.0, < 18.2.4 · CVE-2026-84367 · GHSA-gg4h-3hg2-grpc · amended
- Critical, CVSS 10.0
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
npm maplibre-gl · Upgrade to 6.4.1 or later · <= 6.4.0 · CVE-2026-85061 · GHSA-jrc7-96c5-q579 · amended
- Medium, CVSS 6.3
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Go google.golang.org/grpc · Upgrade to 1.83.1 or later · <= 1.83.0 · CVE-2026-84303 · GHSA-qc2q-p7wx-3px3 · amended
- High, CVSS 7.5
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
PyPI httpx2 · Upgrade to 2.12.0 or later · < 2.12.0 · CVE-2026-84382 · GHSA-8xx6-hgc6-gc2m · amended
- Medium, CVSS 5.9
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
npm vitest +1 · Upgrade all 2 to 5.0.0-rc.2 (pre-release) or 4.1.11 by release line · >= 2.1.0, < 4.1.11; >= 5.0.0-beta.1, < 5.0.0-rc.2 · CVE-2026-84373 · GHSA-82fw-gwwq-j7x9 · amended
- Medium, CVSS 5.6
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
PyPI httpx2 · Upgrade to 2.11.0 or later · < 2.11.0 · CVE-2026-84380 · GHSA-pf96-p4fj-6566 · amended
- Medium, CVSS 5.3
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
PyPI httpx2 · Upgrade to 2.11.0 or later · < 2.11.0 · CVE-2026-84379 · GHSA-h4x7-gw46-3wm6 · amended
- Medium, CVSS 5.9
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
PyPI httpx2 · Upgrade to 2.10.0 or later · >= 2.5.0, < 2.10.0 · CVE-2026-84378 · GHSA-f2fp-rgf2-35cp · amended
- High, CVSS 8.1
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
PyPI httpx2 +1 · Upgrade all 2 to 2.10.0 or later · >= 2.6.0, < 2.10.0 · CVE-2026-84381 · GHSA-7mj9-2mp8-4m2p · amended
- Medium, CVSS 6.5
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor
_fetch_imageand audio loader bypass MediaConnector protectionsPyPI vllm · Upgrade to 0.26.0 or later · < 0.26.0 · CVE-2026-73560 · GHSA-4hhp-h66f-j5j7 · amended
- High, CVSS 7.5
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Packagist maatwebsite/excel · Upgrade to 3.1.70 or later · >= 3.1.8, < 3.1.70 · CVE-2026-84374 · GHSA-c7r6-vx3h-w5g2 · amended
- High, CVSS 8.7
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
npm @xmldom/xmldom · Upgrade to 0.9.11 or later · >= 0.9.0-beta.9, <= 0.9.10 · CVE-2026-83606 · GHSA-g53g-w8rj-fmg7 · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50646 · GHSA-gh2h-rhph-h37g · amended
- Medium, CVSS 6.3
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81725 · GHSA-8mpw-7fpc-4gqj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.