Critical, CVSS 9.1
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
npm proxy-addr · Upgrade to 2.0.8 or later · >= 1.1.0, < 2.0.8 · CVE-2026-90711 · GHSA-jqcg-44mw-7w3h · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 78 matching · newest first
- Medium, CVSS 5.3
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
crates.io rustls · Upgrade to 0.23.45 or later · >= 0.23.13, < 0.23.45 · CVE-2026-123613 · GHSA-2mjx-qc3c-rqvc · amended
- High, CVSS 7.3
@nx/docker: OS command injection in the @nx/docker release pipeline
npm @nx/docker · Upgrade to 23.1.1 or 22.7.8 by release line · >= 21.4.0, < 22.7.8; >= 23.0.0, < 23.1.1 · CVE-2026-104859 · GHSA-6vc5-vf29-ffr2 · amended
- High, CVSS 8.5
Nx: OS command injection via git revisions and remote refs
npm nx · Upgrade to 23.1.1 or 22.7.8 by release line · >= 14.0.0, < 22.7.8; >= 23.0.0, < 23.1.1 · GHSA-w2vw-w76x-qr89 · amended
- High, CVSS 8.5
Nx daemon and plugin worker sockets are accessible to other local users
npm nx · Upgrade to 23.1.2 or 22.7.9 by release line · >= 14.6.0, < 22.7.9; >= 23.0.0, < 23.1.2 · CVE-2026-104854 · GHSA-w3vv-58gj-gw77 · amended
- Medium, CVSS 5.8
Nx: Path traversal in nx migrate package-migrations extraction
npm nx · Upgrade to 23.2.1 or 22.7.10 by release line · >= 13.10.0, < 22.7.10; >= 23.0.0, < 23.2.1 · CVE-2026-104853 · GHSA-hrvq-x7jp-36xv · amended
- High, CVSS 7.5
compression vulnerable to Denial of Service via memory leak on premature response close
npm compression · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2026-87776 · GHSA-vc2v-76pw-4v95 · amended
- Medium, CVSS 6.5
OpenClaw: Channel read actions could skip target allowlists
npm @openclaw/feishu +3 · Upgrade all 4 to 2026.8.1 or later · < 2026.8.1 · CVE-2026-100582 · GHSA-g7fw-3gjp-g5hf · amended
- Medium, CVSS 6.1
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
PyPI pymongo · Upgrade to 4.18.1 or later · <= 4.18.0 · CVE-2026-88029 · GHSA-8fvv-fgr5-f8ch · amended
- Medium, CVSS 6.1
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Packagist mongodb/mongodb · Upgrade to 2.4.2 or 1.21.5 by release line · >= 1.1.0, < 1.21.5; >= 2.0.0, < 2.4.2 · CVE-2026-88023 · GHSA-8fxw-fmj8-xp7j · amended
- Critical, CVSS 9.5
vm2: NodeVM custom resolution bypasses external path boundaries
npm vm2 · Upgrade to 3.12.2 or later · <= 3.12.1 · CVE-2026-100721 · GHSA-5h3f-q97h-ccvc · amended
- High, CVSS 8.9
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
npm vm2 · Upgrade to 3.12.2 or later · <= 3.12.1 · CVE-2026-100722 · GHSA-2v2p-6j97-cjg9 · amended
- Medium, CVSS 6.9
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
npm vm2 · Upgrade to 3.12.2 or later · <= 3.12.1 · CVE-2026-100723 · GHSA-489w-w794-jq94 · amended
- High, CVSS 7.4
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
npm @graphql-tools/executor-legacy-ws · Upgrade to 1.1.35 or later · <= 1.1.34 · CVE-2026-103921 · GHSA-6fw5-9hq8-w87g · amended
- High, CVSS 8.2
GraphQL Tools has prototype pollution in well-established utility function
mergeDeepnpm @graphql-tools/utils · Upgrade to 12.0.1 or later · <= 12.0.0 · CVE-2026-104852 · GHSA-7mx3-vvmw-hjmv · amended
- Medium, CVSS 6.9
hickory-resolver follows irrelevant CNAME records
crates.io hickory-resolver · Upgrade to 0.26.2 or later · >= 0.25.0, < 0.26.2 · CVE-2026-123585 · GHSA-6f2x-v7q7-m7m5 · amended
- High, CVSS 8.7
hickory-resolver: Unbounded TC-retry loop in
NameServerPool::try_send(resource-exhaustion DoS)crates.io hickory-resolver · Upgrade to 0.26.2 or later · >= 0.26.0-beta.1, < 0.26.2 · CVE-2026-123604 · GHSA-6w6g-hm98-mhgm · amended
- High, CVSS 7.5
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
crates.io hickory-resolver · Upgrade to 0.26.2 or later · < 0.26.2 · CVE-2026-93657 · GHSA-5j98-2g5x-46v6 · amended
- Medium, CVSS 5.9
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
npm postcss-selector-parser · Upgrade to 7.1.6 or 6.1.5 by release line · >= 7.0.0, < 7.1.6; < 6.1.5 · CVE-2026-104844 · GHSA-rj75-hqrm-r3gf · amended
- Medium, CVSS 6.3
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
npm @angular/ssr · Upgrade to 22.1.7, 21.2.23 or 20.3.36 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.7; >= 21.0.0, < 21.2.23; >= 20.0.0, < 20.3.36; <= 19.2.27 · CVE-2026-104871 · GHSA-7g7c-h8rr-7p6q · amended
- High, CVSS 8.8
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
PyPI fsspec · Upgrade to 2026.6.0 or later · >= 0.9.0, < 2026.6.0 · CVE-2026-104851 · GHSA-27vj-qcqg-25rc · amended
- Critical, CVSS 9.3
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
npm @capacitor/android +2 · Upgrade all 3 to 8.5.1, 8.4.3, 7.6.9 or 6.2.2 by release line; some affected versions have no fix yet · >= 6.0.0, < 6.2.2; >= 7.0.0, < 7.6.9; >= 8.5.0, < 8.5.1; >= 8.3.5, < 8.4.3; >= 8.0.0, <= 8.3.4 · CVE-2026-103922 · GHSA-rvm3-566m-v7fv · amended
- Medium, CVSS 5.8
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
npm @opentelemetry/instrumentation-pg · Upgrade to 0.73.0 or later · < 0.73.0 · +7 more packages · CVE-2026-104872 · GHSA-qqmp-wf37-98f9 · amended
- Medium, CVSS 6.3
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
npm fast-copy · Upgrade to 4.1.0, 3.1.0 or 2.2.0 by release line · >= 4.0.0, < 4.1.0; >= 3.0.0, < 3.1.0; < 2.2.0 · GHSA-jggr-w7fw-pc2j · amended
- High, CVSS 7.2
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
npm @vue/server-renderer · Upgrade to 3.6.0-rc.6 (pre-release) or 3.5.42 by release line · < 3.5.42; >= 3.6.0-rc.0, < 3.6.0-rc.6 · GHSA-g2v6-rqmx-r4w6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.