Medium, CVSS 4.5
virtualenv: Generated files can follow existing destination links
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113721 · GHSA-558c-9hv2-4prj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 64 matching · newest first
- High, CVSS 8.1
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
PyPI pillow · Upgrade to 13.0.0 or later · >= 11.1.0, < 13.0.0 · GHSA-78g4-xqwv-q3g8 · amended
- Medium, CVSS 5.4
Nuxt server islands render
useHeadSafeinput without sanitisationnpm nuxt · Upgrade to 4.6.2 or later · >= 3.13.0, < 4.6.2 · CVE-2026-114133 · GHSA-xfq5-w38q-pc2x · amended
- Low, CVSS 2.3
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a
javascript:URL prefixed with an ASCII control character executes frompagesis disablednpm nuxt · Upgrade to 4.6.0 or later · < 4.6.0 · CVE-2026-114130 · GHSA-jjm6-p2m9-9w4x · amended
- Medium, CVSS 6.5
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass
appMiddlewareon dynamic and catch-all routesnpm nuxt · Upgrade to 4.4.4 or 3.21.4 by release line · >= 4.0.0, < 4.4.4; >= 3.11.0, < 3.21.4 · CVE-2026-114131 · GHSA-6gq8-jgmh-3ffp · amended
- Medium, CVSS 6.0
pypdf: Possible long runtimes/large memory usage when retrieving form fields
PyPI pypdf · Upgrade to 6.21.0 or later · < 6.21.0 · CVE-2026-113789 · GHSA-6vvc-x485-93v7 · amended
- Medium, CVSS 6.0
pypdf: Possible large memory usage when parsing arrays and dictionaries
PyPI pypdf · Upgrade to 6.21.0 or later · < 6.21.0 · CVE-2026-113790 · GHSA-f54x-cmq8-qg57 · amended
- Medium, CVSS 6.0
pypdf: Possible large memory usage when parsing content streams
PyPI pypdf · Upgrade to 6.21.0 or later · < 6.21.0 · CVE-2026-113791 · GHSA-cgf9-327m-v77c · amended
- Medium, CVSS 4.2
Electron: SameSite cookie restrictions are not applied to windows opened from links
npm electron · Upgrade to 45.0.0-alpha.6 (pre-release), 44.3.0, 43.7.0 or 42.11.3 by release line · >= 45.0.0-alpha.1, < 45.0.0-alpha.6; >= 44.0.0-alpha.1, < 44.3.0; >= 43.0.0-alpha.1, < 43.7.0; < 42.11.3 · CVE-2026-113796 · GHSA-2p8c-gr87-2676 · amended
- Medium, CVSS 5.4
Electron: Pointer lock permission requests can be attributed to the wrong frame
npm electron · Upgrade to 45.0.0-alpha.13 (pre-release), 44.5.0, 43.7.6 or 42.11.9 by release line · >= 45.0.0-alpha.1, < 45.0.0-alpha.13; >= 44.0.0-alpha.1, < 44.5.0; >= 43.0.0-alpha.1, < 43.7.6; < 42.11.9 · CVE-2026-113798 · GHSA-x562-297c-g43g · amended
- Low, CVSS 3.1
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
npm electron · Upgrade to 45.0.0-alpha.4 (pre-release), 44.1.1, 43.5.1 or 42.11.1 by release line · >= 45.0.0-alpha.1, < 45.0.0-alpha.4; >= 44.0.0-alpha.1, < 44.1.1; >= 43.0.0-alpha.1, < 43.5.1; < 42.11.1 · CVE-2026-113797 · GHSA-98mx-cjp9-gchm · amended
- Low, CVSS 3.9
Electron: Frame subscription trusts GPU-supplied frame geometry
npm electron · Upgrade to 45.0.0-alpha.9 (pre-release), 44.4.3, 43.7.3 or 42.11.6 by release line · < 42.11.6; >= 43.0.0-alpha.1, < 43.7.3; >= 44.0.0-alpha.1, < 44.4.3; >= 45.0.0-alpha.1, < 45.0.0-alpha.9 · CVE-2026-114122 · GHSA-3qxv-5xgr-q7w9 · amended
- Low, CVSS 3.9
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
npm electron · Upgrade to 45.0.0-alpha.9 (pre-release), 44.4.3, 43.7.3 or 42.11.6 by release line · < 42.11.6; >= 43.0.0-alpha.1, < 43.7.3; >= 44.0.0-alpha.1, < 44.4.3; >= 45.0.0-alpha.1, < 45.0.0-alpha.9 · CVE-2026-114124 · GHSA-h3v5-h239-pg29 · amended
- Medium, CVSS 5.4
Electron: openExternal permission requests can be attributed to the wrong origin
npm electron · Upgrade to 45.0.0-alpha.5 (pre-release), 44.3.0, 43.7.0 or 42.11.3 by release line · < 42.11.3; >= 43.0.0-alpha.1, < 43.7.0; >= 44.0.0-alpha.1, < 44.3.0; >= 45.0.0-alpha.1, < 45.0.0-alpha.5 · CVE-2026-114121 · GHSA-997q-gvvc-jwmx · amended
- Critical, CVSS 9.5
Next.js: Unauthenticated Remote Code Execution in
use cachefunctions returning typed arraysnpm next · Upgrade to 16.4.1 or later · >= 16.0.0, <= 16.4.0 · GHSA-673q-mjm6-r5xr · amended
- High, CVSS 7.5
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
PyPI gitpython · Upgrade to 3.2.1 or later · <= 3.2.0 · CVE-2026-114145 · GHSA-83vg-56qc-22m7 · amended
- Low, CVSS 3.7
fastify is vulnerable to header validation bypass via case-sensitive propertyNames
npm fastify · Upgrade to 5.12.6 or later · >= 5.12.2, < 5.12.6 · CVE-2026-107832 · GHSA-389g-gv7q-r4x8 · amended
- High, CVSS 8.8
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
npm toml +1 · Upgrade all 2 to 5.0.1 or later · <= 5.0.0 · CVE-2026-114142 · GHSA-h895-cgqg-jf52 · amended
- High, CVSS 8.7
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114141 · GHSA-4qx8-w7c3-pj3p · amended
- High, CVSS 8.7
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114143 · GHSA-9j65-hcg3-gc64 · amended
- High, CVSS 7.5
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114144 · GHSA-9qmh-m7c6-f92p · amended
- High, CVSS 8.7
Storybook dev server vulnerable to code injection from the local network
npm storybook · Upgrade to 11.0.0-alpha.6 (pre-release), 10.6.2, 9.1.21 or 8.6.19 by release line · >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · +5 more packages · CVE-2026-114126 · GHSA-px85-f4q5-jh77 · amended
- Medium, CVSS 6.5
Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering
npm astro · Upgrade to 7.3.2 or later · < 7.3.2 · CVE-2026-114128 · GHSA-98hj-9722-w3j8 · amended
- Low, CVSS 2.3
Astro: Arbitrary CSS injection in Astro View Transitions
npm astro · Upgrade to 7.3.3 or later · >= 7.1.0, <= 7.3.2 · CVE-2026-114127 · GHSA-mpr7-6m5w-76rw · amended
- High, CVSS 8.4
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
npm @graphql-tools/utils · Upgrade to 12.0.2 or later · >= 10.10.1, <= 12.0.1 · CVE-2026-114604 · GHSA-c4qx-w738-7hr3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.