enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Packagist enshrined/svg-sanitize · Upgrade to 1.0.0 or later · <= 0.22.0 · CVE-2026-107380 · GHSA-9rjx-3jch-6vjf · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–75 of 104 matching · newest first
Packagist enshrined/svg-sanitize · Upgrade to 1.0.0 or later · <= 0.22.0 · CVE-2026-107380 · GHSA-9rjx-3jch-6vjf · amended
nesting-DoS check in Resolver::processReferencesPackagist enshrined/svg-sanitize · Upgrade to 1.0.0 or later · <= 0.22.0 · CVE-2026-107381 · GHSA-m9xh-6747-9r6f · amended
Packagist enshrined/svg-sanitize · Upgrade to 1.0.0 or later · <= 0.22.0 · CVE-2026-107379 · GHSA-v383-3rw5-q8rf · amended
.dsf (residual of GHSA-v6c2-xwv6-8xf7)npm music-metadata · Upgrade to 11.15.0 or later · <= 11.14.0 · CVE-2026-107392 · GHSA-8j4c-6x6g-rq3j · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.14.0 or later · < 1.14.0 · CVE-2026-107386 · GHSA-w6r9-248c-frg8 · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60086 · GHSA-4r3p-w3mc-5v34 · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61433 · GHSA-79fv-7hq9-w7xg · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61435 · GHSA-2gpf-2492-q9jh · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61431 · GHSA-q7m5-3jmv-vm48 · amended
PyPI datamodel-code-generator · Upgrade to 0.81.0 or later · >= 0.59.0, <= 0.80.0 · CVE-2026-107377 · GHSA-77xj-x4rm-935c · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60088 · GHSA-xpx6-x8c2-mw5w · amended
npm handlebars · Upgrade to 4.7.10 or later · >= 4.0.0, <= 4.7.9 · CVE-2026-106444 · GHSA-xw65-4hp5-5hc7 · amended
npm handlebars · Upgrade to 4.7.10 or later · >= 4.0.0, <= 4.7.9 · CVE-2026-106446 · GHSA-8r5x-fm3f-whwj · amended
npm handlebars · Upgrade to 4.7.10 or later · >= 3.0.0, <= 4.7.9 · CVE-2026-106445 · GHSA-p8wg-vrv2-v86f · amended
npm @langchain/mongodb · Upgrade to 1.3.1 or later · <= 1.3.0 · CVE-2026-106119 · GHSA-m6rx-h84q-8r95 · amended
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 (pre-release) or later · >= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2 · CVE-2026-107211 · GHSA-mx22-3794-2vpv · amended
PyPI pydantic-ai +1 · Upgrade all 2 to 2.52.0 or 1.107.7 by release line · >= 1.77.0, < 1.107.7; >= 2.0.0b1, < 2.52.0 · CVE-2026-107287 · GHSA-v36g-jcw9-x7cw · amended
npm generator-jhipster · Upgrade to 9.4.0 or later · >= 7.0.0, < 9.4.0 · CVE-2026-107375 · GHSA-r223-96jv-q533 · amended
npm generator-jhipster · Upgrade to 9.4.0 or later · < 9.4.0 · +1 more package · CVE-2026-107303 · GHSA-9ffp-22j7-56r2 · amended
npm msgpack5 · Upgrade to 6.1.0 or later · >= 4.1.0, < 6.1.0 · CVE-2026-107302 · GHSA-8f34-f56x-9xph · amended
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107300 · GHSA-5x5g-h9x8-2fh9 · amended
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107299 · GHSA-26wq-p25c-j6fv · amended
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107301 · GHSA-8hq7-ggx2-cc6m · amended
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107298 · GHSA-24ch-f2g6-9hhh · amended
npm msgpack5 · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-107297 · GHSA-gcx5-hxj7-gpqq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.