Medium, CVSS 4.2
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92945 · GHSA-7q3f-wx44-378m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 60 matching · newest first
- Medium, CVSS 6.8
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 3.0.0, <= 4.5.10 · +1 more package · CVE-2026-102830 · GHSA-3jqq-pw4j-pqcj · amended
- Medium, CVSS 5.4
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 4.0.0, <= 4.5.10 · CVE-2026-102904 · GHSA-3325-v43h-43rv · amended
- High, CVSS 8.1
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 4.5.0, <= 4.5.10 · +3 more packages · CVE-2026-102831 · GHSA-6966-vjj6-99xv · amended
- High, CVSS 7.5
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.22.3, 2.21.7 or 2.18.11 by release line · >= 2.19.0, <= 2.21.6; >= 2.22.0, <= 2.22.2; >= 2.8.0, <= 2.18.10 · +1 more package · CVE-2026-89425 · GHSA-7hhh-6rmp-j9qf · amended
- High, CVSS 7.5
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.22.3, 2.21.7 or 2.18.11 by release line · >= 2.17.0, <= 2.18.10; >= 2.19.0, <= 2.21.6; >= 2.22.0, <= 2.22.2 · +1 more package · CVE-2026-89407 · GHSA-p6pp-m3f8-5c89 · amended
- High, CVSS 7.5
devalue:
stringify/unevalserialize shared memorynpm devalue · Upgrade to 5.9.3 or later · >= 5.1.0, <= 5.9.2 · CVE-2026-92708 · GHSA-j22f-vq7h-c4qm · amended
- Medium, CVSS 6.3
devalue: Residual sparse-array CPU amplification in uneval
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123566 · GHSA-hx4r-w6wj-j8fg · amended
- High, CVSS 8.2
devalue: Repeated primitive strings cause quadratic expansion in uneval
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123565 · GHSA-mcm9-63f2-9j32 · amended
- Low, CVSS 2.3
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
npm devalue · Upgrade to 5.9.3 or later · >= 1.0.0, < 5.9.3 · CVE-2026-123564 · GHSA-wf3x-273g-mvxv · amended
- High, CVSS 8.2
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123563 · GHSA-r9w8-h9r3-54w4 · amended
- High, CVSS 8.2
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
npm devalue · Upgrade to 5.9.3 or later · >= 5.8.0, < 5.9.3 · CVE-2026-123562 · GHSA-x5rw-q4pp-hg5g · amended
- Medium, CVSS 6.3
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123561 · GHSA-4q55-j62x-fr9h · amended
- High, CVSS 7.8
virtualenv bash and fish activation scripts execute commands embedded in paths
PyPI virtualenv · Upgrade to 21.7.13 or later · <= 21.7.12 · CVE-2026-102925 · GHSA-p58f-9548-mpm2 · amended
- High, CVSS 7.3
virtualenv: Command injection via --prompt in activate.bat (batch activator)
PyPI virtualenv · Upgrade to 21.7.12 or later · <= 21.7.11 · CVE-2026-102937 · GHSA-x78j-v8h9-3j2q · amended
- High, CVSS 8.7
pypdf: Possible long runtimes with large amount of embedded files
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-102999 · GHSA-v247-6f48-mgcj · amended
- High, CVSS 8.7
pypdf: Possible long runtimes when generating appearance streams
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-102998 · GHSA-php9-fj8v-98fj · amended
- High, CVSS 8.7
pypdf: Possible large memory usage when retrieving alphabetical page labels
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-103000 · GHSA-w23x-9jrw-r45c · amended
- High, CVSS 8.7
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102997 · GHSA-jw7q-gvrg-4vj3 · amended
- High, CVSS 8.7
pypdf: Possible large memory usage when parsing font data
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102996 · GHSA-g9cg-prrw-2r8q · amended
- High, CVSS 8.7
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102995 · GHSA-fp3h-c4fm-7vvf · amended
- High, CVSS 8.7
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
PyPI pypdf · Upgrade to 6.18.0 or later · < 6.18.0 · CVE-2026-102994 · GHSA-5jq2-8x83-x246 · amended
- High, CVSS 8.7
pypdf: Possible large memory usage when retrieving Roman page labels
PyPI pypdf · Upgrade to 6.17.0 or later · < 6.17.0 · CVE-2026-102993 · GHSA-qv6h-rv94-w285 · amended
- Critical, CVSS 9.2
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
npm piscina · Upgrade to 6.0.0-rc.5 (pre-release), 5.3.2 or 4.9.4 by release line · >= 5.0.0, < 5.3.2; < 4.9.4; >= 6.0.0-rc.1, < 6.0.0-rc.5 · CVE-2026-102992 · GHSA-67c8-pqhq-4rmx · amended
- High, CVSS 8.2
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
npm basic-ftp · Upgrade to 6.2.1 or later · <= 6.2.0 · CVE-2026-102990 · GHSA-c475-qrg2-pj4r · amended
A vendor fix does not resolve your finding until you verify it in your own systems.