High, CVSS 7.1
virtualenv: Xonsh activation literals depend on the script decoding codec
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113718 · GHSA-394h-qwmc-48pf · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
virtualenv: Bash prompt values can change meaning under older compatibility modes
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113723 · GHSA-6w3r-xr62-4xcp · amended
- High, CVSS 7.5
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
npm @azure/msal-node · Upgrade to 7.1.0 or later · >= 5.0.0-beta.0, < 7.1.0 · CVE-2026-109461 · GHSA-xcx6-jx8p-x3h5 · amended
- High, CVSS 7.5
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 6.23.0, < 6.29.1; >= 7.18.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109869 · GHSA-xjj6-f33q-929c · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
npm multer · Upgrade to 2.5.0 or later · >= 2.0.0, < 2.5.0 · CVE-2026-113872 · GHSA-q7qp-rjg7-q26m · amended
- High, CVSS 8.8
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
npm happy-dom · Upgrade to 21.0.4 or later · >= 17.0.0, <= 21.0.3 · CVE-2026-115895 · GHSA-834v-8h66-3h79 · amended
- High, CVSS 7.1
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.20.4, <= 4.2.0 · CVE-2026-112940 · GHSA-v4x8-3wr5-3wq8 · amended
- Critical, CVSS 9.2
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112398 · GHSA-5x8w-8jj5-q52h · amended
- High, CVSS 7.5
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
npm postal-mime · Upgrade to 4.0.8 or later · >= 3.0.0, < 4.0.8 · GHSA-f2hq-32vh-53cc · amended
- Critical, CVSS 9.2
Laravel TokenGuard authentication bypass through non-string API credentials
Packagist laravel/framework · Upgrade to 13.27.0, 12.68.0, 11.56.1 or 10.50.4 by release line · >= 13.0.0, < 13.27.0; >= 12.0.0, < 12.68.0; >= 11.0.0, < 11.56.1; < 10.50.4 · CVE-2026-114509 · GHSA-f9x3-7vq9-cph6 · amended
- High, CVSS 7.5
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
PyPI vllm · Upgrade to 0.31.0 or later · >= 0.7.3, < 0.31.0 · CVE-2026-114055 · GHSA-gx7p-2j49-hfq4 · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for repeated references to the same missing object
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115572 · GHSA-6c7f-9265-g8fw · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115585 · GHSA-jr96-gvgh-j3r4 · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for large xref table header limits
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115580 · GHSA-gmh7-3g9r-mjh5 · amended
- High, CVSS 7.4
Electron: Mitigation for compromised eMudhra intermediate certificates
npm electron · Upgrade to 45.0.0-beta.6 (pre-release), 44.9.1, 43.8.1 or 42.11.16 by release line · >= 45.0.0-alpha.1, < 45.0.0-beta.6; >= 44.0.0-alpha.1, < 44.9.1; >= 43.0.0-alpha.1, < 43.8.1; < 42.11.16 · CVE-2026-115570 · GHSA-jr5w-w6x2-84p9 · amended
- High, CVSS 7.5
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
npm body-parser · Upgrade to 2.4.0 or 1.20.9 by release line · >= 2.0.0, < 2.4.0; < 1.20.9 · CVE-2026-111181 · GHSA-27r3-jxmh-p828 · amended
- High, CVSS 7.3
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
crates.io gix · Upgrade to 0.90.0 or later · >= 0.88.0, <= 0.89.0 · GHSA-q54r-jf2p-rfr2 · amended
- High, CVSS 8.2
Echo: WebSocket proxy can retain connections and handlers after client disconnect
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.15.0, < 4.16.1 · +1 more package · CVE-2026-118262 · GHSA-9969-6676-49h5 · amended
- High, CVSS 8.2
Echo: Decompress permits unbounded gzip expansion in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118261 · GHSA-h7wr-284f-5qvc · amended
- Critical, CVSS 9.1
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · +1 more package · CVE-2026-118264 · GHSA-cxf3-9h37-7rr8 · amended
- High, CVSS 8.2
Echo: BodyDump captures request and response bodies without size limits in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118260 · GHSA-f48p-c9v4-h7xv · amended
- High, CVSS 8.6
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
npm @strands-agents/sdk · Upgrade to 1.5.0 or later · < 1.5.0 · +1 more package · CVE-2026-115419 · GHSA-4v6f-7vjh-6x4m · amended
- High, CVSS 7.1
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
PyPI virtualenv +1 · Upgrade all 2 to 21.14.13 or later · >= 21.14.9, < 21.14.13 · CVE-2026-115586 · GHSA-cx6f-vjhg-g3cc · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115776 · GHSA-53xc-49m8-p798 · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115778 · GHSA-cwm5-jh59-mwxr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.