Medium, CVSS 6.3
Werkzeug safe_join() allows Windows special device names
PyPI werkzeug · Upgrade to 3.1.9 or later · < 3.1.9 · CVE-2026-102598 · GHSA-g6x2-hccm-hh4m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 78 matching · newest first
- Critical, CVSS 9.2
simple-git:
VISUALeditor environment variable is omitted from unsafe editor detectionnpm @simple-git/argv-parser · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2026-102829 · GHSA-v5rq-49vh-5v5c · amended
- Critical, CVSS 9.2
simple-git unsafe-operation guard does not block trailer command configuration
npm simple-git · Upgrade to 4.0.1 or later · >= 3.15.0, < 4.0.1 · CVE-2026-102828 · GHSA-x6jw-m9v5-85vh · amended
- High, CVSS 8.1
simple-git allows command execution through unblocked Git configuration includes
npm simple-git · Upgrade to 4.0.0 or later · <= 3.36.0 · CVE-2026-102826 · GHSA-g4wm-2vf7-vfgr · amended
- High, CVSS 8.1
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
npm simple-git · Upgrade to 4.0.0 or later · <= 3.36.0 · CVE-2026-102827 · GHSA-858h-whjf-mvg5 · amended
- High, CVSS 7.5
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
PyPI pymongo · Upgrade to 4.18.2 or later · < 4.18.2 · CVE-2026-96749 · GHSA-v4x9-3549-crwv · amended
- High, CVSS 8.3
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
PyPI pymongo · Upgrade to 4.18.2 or later · >= 3.5.0, <= 4.18.1 · CVE-2026-96748 · GHSA-vp6j-j7w5-5xjj · amended
- Medium, CVSS 5.3
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
PyPI pymongo · Upgrade to 4.18.2 or later · >= 3.9.0, <= 4.18.1 · CVE-2026-96747 · GHSA-qx36-8mw2-4r3x · amended
- High, CVSS 7.5
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
npm @socket.io/cluster-engine · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-102600 · GHSA-wfpm-5gcm-94cg · amended
- Medium, CVSS 5.4
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Packagist filament/filament · Upgrade to 5.8.3 or 4.13.3 by release line · >= 4.0.0, <= 4.13.2; >= 5.0.0, <= 5.8.2 · CVE-2026-104181 · GHSA-7m6h-rg42-m449 · amended
- Medium, CVSS 6.5
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
PyPI pyjwt · Upgrade to 2.15.0 or later · >= 2.1.0, <= 2.14.0 · CVE-2026-102275 · GHSA-x33g-cr3x-6449 · amended
- Unrated
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
npm dompurify · Upgrade to 3.4.16 or later · <= 3.4.15 · CVE-2026-109345 · GHSA-6688-9rhm-gjv2 · amended
- Medium, CVSS 5.3
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
PyPI vllm · Upgrade to 0.30.0 or later · >= 0.24.0, < 0.30.0 · CVE-2026-105758 · GHSA-x6mc-67gf-chw4 · amended
- Medium, CVSS 5.3
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
PyPI vllm · Upgrade to 0.30.0 or later · >= 0.23.0rc2, < 0.30.0 · CVE-2026-105760 · GHSA-58v5-2m8f-94pr · amended
- Medium, CVSS 6.5
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
PyPI vllm · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-105754 · GHSA-ph72-cqr5-qpp7 · amended
- Medium, CVSS 6.5
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
PyPI vllm · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-105757 · GHSA-85xf-c7hm-whqw · amended
- Medium, CVSS 4.2
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on
/scoreand/rerankPyPI vllm · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-105755 · GHSA-2phq-3phc-84px · amended
- Medium, CVSS 6.5
vLLM: Loose
cache_saltvalidation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstreamValueErrordenial of servicePyPI vllm · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-105756 · GHSA-2823-qmq8-rwvj · amended
- Medium, CVSS 5.9
uv: Path traversal on Windows through wheel extraction
crates.io uv +1 · Upgrade all 2 to 0.12.18 or later · >= 0.12.7, < 0.12.18 · CVE-2026-104843 · GHSA-2cv4-cqwr-gwf7 · amended
- Medium, CVSS 6.5
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
PyPI mako · Upgrade to 1.4.2 or later · <= 1.4.1 · CVE-2026-102991 · GHSA-5639-2j2p-m4mx · amended
- Medium, CVSS 5.3
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
npm smol-toml · Upgrade to 1.9.0 or later · <= 1.8.0 · GHSA-r4xh-jqrq-34v2 · amended
- Low, CVSS 2.1
KaTeX: Existing prototype pollution can bypass trust restrictions
npm katex · Upgrade to 0.18.2 or later · >= 0.11.0, < 0.18.2 · CVE-2026-103923 · GHSA-238p-pmpm-9mq7 · amended
- Medium, CVSS 5.3
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
PyPI multidict · Upgrade to 6.9.1 or later · >= 6.7.0, <= 6.9.0 · CVE-2026-104874 · GHSA-54p9-h82j-f925 · amended
- Critical, CVSS 9.8
Seroval:
fromJSON()Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)npm seroval · Upgrade to 1.6.2 or later · >= 0.12.0, <= 1.6.0 · CVE-2026-104846 · GHSA-p6vx-979v-rg4c · amended
- High, CVSS 7.5
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
npm seroval · Upgrade to 1.6.3 or later · <= 1.6.2 · CVE-2026-104845 · GHSA-jp82-f5mq-hwhp · amended
A vendor fix does not resolve your finding until you verify it in your own systems.