Medium, CVSS 6.3
Vyper: Return inside for loop more than 1 level deep
PyPI vyper · Upgrade to 0.2.3 or later · >= 0.1.0b10, < 0.2.3 · CVE-2020-37288 · GHSA-vg88-3v92-rjx2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–36 of 36 matching · newest first
- High, CVSS 8.9
sharp : Vulnerability in librsvg dependency CVE-2026-96889
npm sharp · Upgrade to 0.35.5 or later · < 0.35.5 · CVE-2026-114111 · GHSA-wq5f-xc86-pv6w · amended
- Medium, CVSS 4.3
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
PyPI docling +1 · Upgrade all 2 to 2.131.0 or later · >= 2.45.0, < 2.131.0 · CVE-2026-105747 · GHSA-3cr3-8m4c-fpxw · amended
- Critical, CVSS 9.2
shell-quote:
quote()command injection via a line terminator in a token after a{ comment }tokennpm shell-quote · Upgrade to 1.11.0 or later · >= 1.8.4, < 1.11.0 · CVE-2026-102422 · GHSA-pqg4-j6r4-53mv · amended
- Medium, CVSS 6.3
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
npm pbkdf2 · Upgrade to 3.1.7 or later · <= 3.1.6 · CVE-2026-102414 · GHSA-477h-4r7f-fvrx · amended
- Medium, CVSS 6.3
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
PyPI langflow · Upgrade to 1.10.3 or later · < 1.10.3 · +3 more packages · GHSA-j8f7-x8jm-wmm4 · amended
- Critical, CVSS 9.9
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
PyPI langflow · Upgrade to 1.10.1 or later · < 1.10.1 · CVE-2026-10561 · GHSA-8qpj-27x8-pwpq · amended
- Unrated
Resource budgets not enforced on the typed deserialization path
crates.io noyalib · Upgrade to 0.0.53 or later · >= 0.0.0-0, < 0.0.53 · GHSA-4xcc-23fx-w2wj
- Medium, CVSS 5.9
Docling:
enable_local_fetchis not enforced in HTML browser-rendering modePyPI docling +1 · Upgrade all 2 to 2.118.1 or later · >= 2.82.0, < 2.118.1 · CVE-2026-105750 · GHSA-q43m-vhcp-mhvm · amended
- Medium, CVSS 6.5
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
PyPI vllm · Upgrade to 0.28.0 or later · < 0.28.0 · CVE-2026-105753 · GHSA-ph3r-5jfg-f84f · amended
- Low, CVSS 3.1
vLLM: Harmony tool continuations drop
cache_salt— restoring a cross-tenant prefix-cache membership oraclePyPI vllm · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-105752 · GHSA-935w-9g4m-p28p · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.