High, CVSS 8.7
pypdf: Possible large memory usage when retrieving alphabetical page labels
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-103000 · GHSA-w23x-9jrw-r45c · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102997 · GHSA-jw7q-gvrg-4vj3 · amended
- High, CVSS 8.7
pypdf: Possible large memory usage when parsing font data
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102996 · GHSA-g9cg-prrw-2r8q · amended
- High, CVSS 8.7
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102995 · GHSA-fp3h-c4fm-7vvf · amended
- High, CVSS 8.7
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
PyPI pypdf · Upgrade to 6.18.0 or later · < 6.18.0 · CVE-2026-102994 · GHSA-5jq2-8x83-x246 · amended
- High, CVSS 8.7
pypdf: Possible large memory usage when retrieving Roman page labels
PyPI pypdf · Upgrade to 6.17.0 or later · < 6.17.0 · CVE-2026-102993 · GHSA-qv6h-rv94-w285 · amended
- Critical, CVSS 9.2
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
npm piscina · Upgrade to 6.0.0-rc.5 (pre-release), 5.3.2 or 4.9.4 by release line · >= 5.0.0, < 5.3.2; < 4.9.4; >= 6.0.0-rc.1, < 6.0.0-rc.5 · CVE-2026-102992 · GHSA-67c8-pqhq-4rmx · amended
- High, CVSS 8.2
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
npm basic-ftp · Upgrade to 6.2.1 or later · <= 6.2.0 · CVE-2026-102990 · GHSA-c475-qrg2-pj4r · amended
- Critical, CVSS 10.0
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721043339-eef10568384e (pre-release) or later · < 0.0.0-20260721043339-eef10568384e · CVE-2026-69085 · GHSA-33jq-p8c2-q3q4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.