Medium, CVSS 5.3
LiteLLM Proxy has server-side request forgery via the user_config request parameter
PyPI litellm · Upgrade to 1.83.9 or later · <= 1.83.8 · CVE-2026-59823 · GHSA-hx8v-g79f-8w5f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–84 of 84 matching · newest first
LiteLLM Proxy has server-side request forgery via the
- High, CVSS 8.5
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
npm @cyclonedx/cyclonedx-npm · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2026-71538 · GHSA-q69g-4hcv-6jg4 · amended
- Critical, CVSS 9.1
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
npm @vendure/core · Upgrade to 3.7.0 or later · < 3.7.0 · CVE-2026-63472 · GHSA-6j36-r6pr-59x4 · amended
- Medium, CVSS 5.3
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
npm @vendure/core · Upgrade to 3.6.5 or later · >= 1.0.0, < 3.6.5 · CVE-2026-63461 · GHSA-xf65-r35x-wmmv · amended
- High, CVSS 7.5
Vendure: Unauthenticated ReDoS via
regexfilter on SQLite backendsnpm @vendure/core · Upgrade to 3.6.5 or later · <= 3.6.4 · CVE-2026-63460 · GHSA-jgm3-qmp2-c4p7 · amended
- High, CVSS 8.7
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
npm @vendure/dashboard · Upgrade to 3.6.5 or later · < 3.6.5 · CVE-2026-63459 · GHSA-xhq9-whgq-49j5 · amended
- Medium, CVSS 6.9
Nuxt OG Image has unauthenticated SSRF via
fonts[].pathURL parameternpm nuxt-og-image · Upgrade to 6.7.0 or later · >= 6.0.2, < 6.7.0 · CVE-2026-61793 · GHSA-q8hw-4fvp-9rwv · amended
- Medium, CVSS 6.8
RMCP: Custom HTTP headers leak to cross-origin redirect targets
crates.io rmcp · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2026-64684 · GHSA-9g45-5xwm-f3wc · amended
- Medium, CVSS 5.7
tarfile hardlink fallback ignores custom extraction filter rejection via None
Bitnami python-min +2 · Upgrade all 3 to 3.14.9, 3.13.16, 3.12.15 or 2 more by release line · < 3.10.22; >= 3.11.0, < 3.11.17; >= 3.12.0, < 3.12.15; >= 3.13.0, < 3.13.16; >= 3.14.0, < 3.14.9 · CVE-2026-87910 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.