High, CVSS 7.5
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-92000 · GHSA-rcw4-f5rp-g42v · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 58 matching · newest first
- High, CVSS 7.1
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-102282 · GHSA-j5f4-cc29-5x44 · amended
- Low, CVSS 3.1
Laravel: XSS in Debug Page Information
Packagist laravel/framework · Upgrade to 13.30.0 or 12.69.0 by release line · < 12.69.0; >= 13.0.0, < 13.30.0 · CVE-2026-102279 · GHSA-jh5r-qr3c-85q8 · amended
- Medium, CVSS 5.9
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
npm nodemailer · Upgrade to 10.0.2 or later · < 10.0.2 · CVE-2026-100702 · GHSA-8vvx-rff5-p5rq · amended
- Medium, CVSS 5.9
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.9.0, <= 2.13.0 · CVE-2026-102274 · GHSA-w6j9-cwv2-h6wq · amended
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via orphaned RetryHandler response body
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.11.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-18149 · GHSA-pmjh-fq2x-6v4x · amended
- Low, CVSS 3.7
undici vulnerable to downstream response splitting via retry interceptor
npm undici · Upgrade to 8.10.2, 7.29.1 or 6.28.1 by release line · < 6.28.1; >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-18540 · GHSA-r53p-7pc4-xj5r · amended
- High, CVSS 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
npm undici · Upgrade to 8.10.2, 7.29.1 or 6.28.1 by release line · >= 6.7.0, < 6.28.1; >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-19534 · GHSA-rfgv-xxqx-mfg5 · amended
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.15.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84890 · GHSA-3xpg-4rpp-hhhm · amended
- Medium, CVSS 6.5
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84933 · GHSA-2jfj-6hjv-fm6j · amended
- Low, CVSS 3.7
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.1.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84947 · GHSA-2gqq-gqf2-x968 · amended
- High, CVSS 7.4
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.24.1, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84961 · GHSA-w293-vg96-wgc3 · amended
- Low, CVSS 3.7
undici vulnerable to caching and replay of unsafe HTTP method responses
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-85008 · GHSA-8436-99hf-9mmv · amended
- High, CVSS 7.4
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
npm undici · Upgrade to 8.10.2 or later · >= 8.10.0, < 8.10.2 · CVE-2026-85152 · GHSA-vp8m-p9jh-q5pm · amended
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via WebSocketStream unclean close
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-85014 · GHSA-rx4f-c7p8-82vq · amended
- Low, CVSS 3.5
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Packagist league/flysystem · Upgrade to 3.35.3 or later · <= 3.35.2 · CVE-2026-102601 · GHSA-cxf4-7mrp-vvpr · amended
- High, CVSS 8.7
joi: Quadratic regular-expression backtracking in
Joi.string().isoDate()npm joi · Upgrade to 18.2.6 or 17.13.7 by release line · >= 17.2.0, < 17.13.7; >= 18.0.0, < 18.2.6 · CVE-2026-92599 · GHSA-6h2x-m376-mqjq · amended
- Medium, CVSS 6.7
Electron: Local race condition in Squirrel.Mac update installation on macOS
npm electron · Upgrade to 42.0.0-beta.2 (pre-release), 41.10.5 or 39.8.10 by release line · < 39.8.10; >= 40.0.0-alpha.1, < 41.10.5; >= 42.0.0-alpha.1, < 42.0.0-beta.2 · CVE-2026-102672 · GHSA-vv43-5jgx-7qv8 · amended
- High, CVSS 8.2
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
npm electron · Upgrade to 43.0.0, 42.5.2 or 41.10.4 by release line · < 41.10.4; >= 42.0.0-alpha.1, < 42.5.2; >= 43.0.0-alpha.1, < 43.0.0 · CVE-2026-102673 · GHSA-hq2x-r82h-9wj4 · amended
- High, CVSS 8.2
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102674 · GHSA-gr2m-v5gq-v685 · amended
- High, CVSS 7.4
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102675 · GHSA-j84w-jfhq-vhvj · amended
- High, CVSS 8.3
Electron: can enable Node.js integration in Web Workers despite embedder restrictions
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102676 · GHSA-9qh4-3jw8-366w · amended
- High, CVSS 7.8
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
npm electron · Upgrade to 44.0.0-beta.6 (pre-release), 43.5.0 or 42.10.0 by release line · >= 42.3.3, < 42.10.0; >= 43.0.0-beta.1, < 43.5.0; >= 44.0.0-alpha.1, < 44.0.0-beta.6 · CVE-2026-102677 · GHSA-qmv3-fv6v-rmhq · amended
- Medium, CVSS 6.3
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
Go go.opentelemetry.io/otel/sdk/log · Upgrade to 0.21.0 or later · < 0.21.0 · CVE-2026-81872 · GHSA-hjf4-fphr-2h65 · amended
- Medium, CVSS 5.1
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
Go go.opentelemetry.io/otel/sdk · Upgrade to 1.33.0 or later · >= 1.10.0, < 1.33.0 · CVE-2026-81869 · GHSA-p9f8-wvj8-2fg8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.