Critical, CVSS 9.2
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112398 · GHSA-5x8w-8jj5-q52h · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 80 matching · newest first
- High, CVSS 7.5
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
npm postal-mime · Upgrade to 4.0.8 or later · >= 3.0.0, < 4.0.8 · GHSA-f2hq-32vh-53cc · amended
- Medium, CVSS 6.3
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 11.2.1, < 13.0.0 · CVE-2026-114501 · GHSA-654x-cwwv-5j9c · amended
- Medium, CVSS 6.5
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
npm nodemailer · Upgrade to 10.1.4 or later · >= 3.0.0, < 10.1.4 · CVE-2026-121424 · GHSA-8c8m-p3m8-cjg8 · amended
- Medium, CVSS 6.5
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
npm nodemailer · Upgrade to 10.1.4 or later · >= 3.0.0, < 10.1.4 · CVE-2026-121425 · GHSA-m943-m63m-w62w · amended
- Medium, CVSS 6.5
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
npm nodemailer · Upgrade to 10.1.4 or later · >= 3.0.0, < 10.1.4 · CVE-2026-121426 · GHSA-85x2-q946-cp5h · amended
- Critical, CVSS 9.2
Laravel TokenGuard authentication bypass through non-string API credentials
Packagist laravel/framework · Upgrade to 13.27.0, 12.68.0, 11.56.1 or 10.50.4 by release line · >= 13.0.0, < 13.27.0; >= 12.0.0, < 12.68.0; >= 11.0.0, < 11.56.1; < 10.50.4 · CVE-2026-114509 · GHSA-f9x3-7vq9-cph6 · amended
- Medium, CVSS 6.5
Laravel relationship inclusion can trigger unauthorized data destruction
Packagist laravel/framework · Upgrade to 13.27.0 or 12.68.0 by release line · >= 12.45.0, < 12.68.0; >= 13.0.0, < 13.27.0 · CVE-2026-114508 · GHSA-5wcm-3v2w-8362 · amended
- Low, CVSS 1.0
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
PyPI setuptools · Upgrade to 84.1.0 or later · >= 38.2.2, < 84.1.0 · GHSA-xmj3-9gf7-h52w · amended
- Medium, CVSS 6.1
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
npm fast-uri · Upgrade to 4.2.3, 3.1.9 or 2.4.8 by release line · < 2.4.8; >= 3.0.0, < 3.1.9; >= 4.0.0, < 4.2.3 · CVE-2026-110306 · GHSA-w74x-v6f9-j3xg · amended
- Low, CVSS 3.7
fast-uri vulnerable to improper path equivalence in relative reference normalization
npm fast-uri · Upgrade to 4.2.3, 3.1.9 or 2.4.8 by release line · < 2.4.8; >= 3.0.0, < 3.1.9; >= 4.0.0, < 4.2.3 · CVE-2026-110095 · GHSA-xhq7-xmqj-769h · amended
- Medium, CVSS 4.8
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
npm fast-uri · Upgrade to 4.2.3, 3.1.9 or 2.4.8 by release line · >= 2.4.2, < 2.4.8; >= 3.1.3, < 3.1.9; >= 4.0.1, < 4.2.3 · CVE-2026-110180 · GHSA-wjr9-j795-jxcr · amended
- Low, CVSS 3.7
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
npm fast-uri · Upgrade to 4.2.3, 3.1.9 or 2.4.8 by release line · < 2.4.8; >= 3.0.0, < 3.1.9; >= 4.0.0, < 4.2.3 · CVE-2026-110725 · GHSA-333x-w4r6-6crp · amended
- Medium, CVSS 6.8
FastMCP: Post-transform component authorization is skipped on direct calls
PyPI fastmcp +1 · Upgrade all 2 to 4.1.2 or 3.4.10 by release line · >= 3.0.0, < 3.4.10; >= 4.0.0, < 4.1.2 · GHSA-7xgj-8392-5q4r · amended
- Medium, CVSS 5.9
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
PyPI fastmcp +1 · Upgrade all 2 to 4.1.2 or later · >= 4.0.0a1, < 4.1.2 · GHSA-vqqp-x5qm-5qp4 · amended
- High, CVSS 7.5
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
PyPI vllm · Upgrade to 0.31.0 or later · >= 0.7.3, < 0.31.0 · CVE-2026-114055 · GHSA-gx7p-2j49-hfq4 · amended
- Low, CVSS 2.1
SvelteKit: URL redirection to untrusted site via enhanced form submission
npm @sveltejs/kit · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2026-114060 · GHSA-pfhg-q3qv-9q6r · amended
- Medium, CVSS 4.8
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
Go github.com/go-chi/chi/v5 · Upgrade to 5.4.0 or later · <= 5.3.2 · CVE-2026-114437 · GHSA-j6qf-3m9c-vwj3 · amended
- Medium, CVSS 6.1
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
npm odf-kit · Upgrade to 0.14.2 or later · >= 0.9.8, < 0.14.2 · GHSA-2rqm-h6hv-g79v · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for repeated references to the same missing object
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115572 · GHSA-6c7f-9265-g8fw · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115585 · GHSA-jr96-gvgh-j3r4 · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for large xref table header limits
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115580 · GHSA-gmh7-3g9r-mjh5 · amended
- Medium, CVSS 5.8
Tokio: Race condition in
tokio::time::Intervalcrates.io tokio · Upgrade to 1.54.1 or later · >= 1.54.0, <= 1.54.0 · CVE-2026-115567 · GHSA-5wjr-9356-4wc8 · amended
- High, CVSS 7.4
Electron: Mitigation for compromised eMudhra intermediate certificates
npm electron · Upgrade to 45.0.0-beta.6 (pre-release), 44.9.1, 43.8.1 or 42.11.16 by release line · >= 45.0.0-alpha.1, < 45.0.0-beta.6; >= 44.0.0-alpha.1, < 44.9.1; >= 43.0.0-alpha.1, < 43.8.1; < 42.11.16 · CVE-2026-115570 · GHSA-jr5w-w6x2-84p9 · amended
- High, CVSS 7.5
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
npm body-parser · Upgrade to 2.4.0 or 1.20.9 by release line · >= 2.0.0, < 2.4.0; < 1.20.9 · CVE-2026-111181 · GHSA-27r3-jxmh-p828 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.