High, CVSS 7.5
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
PyPI quart · Upgrade to 0.23.1 or later · >= 0.23.0, <= 0.23.0 · GHSA-v853-p72q-4cfw · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.6
LangGraph SDK custom auth silently ignores actions= on resource decorators
PyPI langgraph-sdk · Upgrade to 0.4.4 or later · >= 0.1.45, <= 0.4.3 · CVE-2026-104873 · GHSA-fvww-7h3r-vfhp · amended
- High, CVSS 7.1
vm2:
allowAsync: falsecan be bypassed through Promise thenable assimilation in VM and NodeVMnpm vm2 · Upgrade to 3.11.8 or later · <= 3.11.7 · CVE-2026-92959 · GHSA-f8gf-w286-fmq2 · amended
- Critical, CVSS 10.0
vm2: Sandbox Escape (NodeVM)
npm vm2 · Upgrade to 3.11.8 or later · <= 3.11.7 · CVE-2026-92955 · GHSA-88hf-g992-jg85 · amended
- Critical, CVSS 9.2
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
npm vm2 · Upgrade to 3.11.8 or later · >= 3.10.0, <= 3.11.7 · CVE-2026-92954 · GHSA-gjq8-xm47-88rc · amended
- Critical, CVSS 9.3
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
npm vm2 · Upgrade to 3.11.8 or later · >= 3.11.0, <= 3.11.7 · CVE-2026-92953 · GHSA-3vgf-8m4q-q4qr · amended
- Critical, CVSS 9.5
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
npm vm2 · Upgrade to 3.11.8 or later · <= 3.11.7 · CVE-2026-92934 · GHSA-x965-fc75-jpqh · amended
- High, CVSS 8.5
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
npm prosemirror-view · Upgrade to 1.42.3 or later · < 1.42.3 · CVE-2026-104847 · GHSA-c8x8-7fp4-3x9w · amended
- High, CVSS 7.5
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92942 · GHSA-r4fx-v8hh-22mv · amended
- Critical, CVSS 10.0
vm2: NodeVM
require.externalwithout an explicitrequire.rootgrants unrestricted host filesystem access and full RCEnpm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92946 · GHSA-j3hm-6rg5-mchv · amended
- Critical, CVSS 10.0
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92947 · GHSA-fcqc-726x-5wfc · amended
- Critical, CVSS 10.0
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
npm vm2 · Upgrade to 3.11.7 or later · >= 3.10.1, <= 3.11.6 · CVE-2026-92956 · GHSA-wjwh-qqvp-g4p4 · amended
- Critical, CVSS 9.1
Langflow: Weak Fernet Key via random.seed()
PyPI langflow · Upgrade to 1.10.1 or later · <= 1.10.0 · CVE-2026-9205 · GHSA-jxw3-mjmx-3pqm · amended
- Critical, CVSS 9.8
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
PyPI langflow · Upgrade to 1.9.1 or later · >= 1.7.0, <= 1.9.0 · CVE-2026-8505 · GHSA-cf6m-vc3m-7cgm · amended
- High, CVSS 8.8
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
PyPI langflow · Upgrade to 1.10.1 or later · >= 1.7.2, < 1.10.1 · CVE-2026-51886 · GHSA-w584-2h2r-2hvf · amended
- High, CVSS 8.8
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
PyPI langflow · Upgrade to 1.10.3 or later · >= 1.3.0, < 1.10.3 · CVE-2026-7700 · GHSA-9fpm-3445-2vx4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.