Critical, CVSS 9.5
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
npm next · Upgrade to 16.4.1 or 15.5.28 by release line · >= 10.0.0, <= 15.5.27; >= 16.0.0, <= 16.4.0 · GHSA-2464-fhr4-w9xw · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–64 of 64 matching · newest first
- High, CVSS 7.8
Librsvg: Use-after-free when XML includes have duplicated entities
crates.io librsvg · Upgrade to 2.63.2, 2.62.4, 2.61.5 or 2 more by release line · < 2.57.5; >= 2.60.0-beta.0, < 2.60.3; >= 2.61.0, < 2.61.5; >= 2.62.0-beta.0, < 2.62.4; >= 2.63.0-beta.0, < 2.63.2 · CVE-2026-96889 · GHSA-cpvr-w4j5-2mpg · amended
- High, CVSS 8.2
Next.js: Denial of Service in App Router using Server Actions
npm next · Upgrade to 16.4.1 or 15.5.28 by release line · >= 13.0.0, <= 15.5.27; >= 16.0.0, <= 16.4.0 · CVE-2026-94482 · GHSA-p3m5-59mp-jv5r · amended
- Medium, CVSS 6.2
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
npm stream-json · Upgrade to 3.7.0 or later · >= 2.0.0, <= 3.6.0 · CVE-2026-114129 · GHSA-jj87-hc4r-jwfw · amended
- High, CVSS 7.4
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · GHSA-pxh4-856f-4h89 · amended
- High, CVSS 8.8
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
PyPI jupyter-server · Upgrade to 2.6.0 or later · >= 2.0.0, < 2.6.0 · CVE-2026-114135 · GHSA-354v-3q48-cv69 · amended
- Critical, CVSS 9.2Exploited · CISA KEV
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
PyPI brotli · Upgrade to 1.2.1 or later · >= 1.0.3, < 1.2.1 · +9 more packages · CVE-2026-111497 · GHSA-9v8h-qqgm-4m35 · amended
- Medium, CVSS 6.3
ammonia: mXSS via MathML
annotation-xmlencoding stripcrates.io ammonia · Upgrade to 4.1.3, 4.0.2 or 3.3.2 by release line · < 3.3.2; >= 4.0.0, < 4.0.2; >= 4.1.0, < 4.1.3 · CVE-2026-63430 · GHSA-9jh8-v38h-cvhr · amended
- Critical, CVSS 9.2
mem0ai Databricks vector store vulnerable to SQL injection
PyPI mem0ai · Upgrade to 1.0.8 or later · >= 0.1.117, < 1.0.8 · CVE-2026-115324 · GHSA-7587-9684-52r6 · amended
- Unrated
Out-of-bounds read in
Log2Cache::nlog2n(),nlog2n_difference()andplog2p()crates.io dahl-salso · Upgrade to 0.7.0 or later · >= 0.0.0-0, < 0.7.0
- High, CVSS 7.5
SSRF and local file disclosure via unvalidated URLs
crates.io webpage · Upgrade to 2.1.0 or later · >= 0.0.0-0, < 2.1.0 · GHSA-23hp-j76v-pcwj
- Unrated
OAuth client SSRF filter checks host strings, not resolved addresses
crates.io rmcp · Upgrade to 3.7.0 or later · >= 2.0.0, < 3.7.0 · GHSA-5p52-q7pq-9fq2
- Critical, CVSS 9.2Exploited · CISA KEV
RCE via stale global state
Bitnami php +2 · Upgrade all 3 to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 by release line · >= 5.4.0, < 8.2.35; >= 8.3.0, < 8.3.36; >= 8.4.0, < 8.4.27; >= 8.5.0, < 8.5.12 · CVE-2026-109619 · GHSA-6wmf-4rv5-p3rp · amended
- Critical, CVSS 9.2Exploited · CISA KEV
RCE via OOM corruption
Bitnami php +2 · Upgrade all 3 to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 by release line · >= 7.3.0, < 8.2.35; >= 8.3.0, < 8.3.36; >= 8.4.0, < 8.4.27; >= 8.5.0, < 8.5.12 · CVE-2026-109618 · GHSA-w8hw-w9fx-j79w · amended
A vendor fix does not resolve your finding until you verify it in your own systems.