High, CVSS 7.8
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
npm systeminformation · Upgrade to 5.33.16 or later · < 5.33.16 · CVE-2026-116576 · GHSA-3f7j-7jwc-fxfj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
PyPI electrum · Upgrade to 4.8.3 or later · < 4.8.3 · CVE-2026-117601 · GHSA-6jp4-8v48-cc5v · amended
- High, CVSS 7.5
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
npm seroval · Upgrade to 1.6.8 or later · < 1.6.8 · CVE-2026-116581 · GHSA-97r2-qh9m-474h · amended
- High, CVSS 7.5
Seroval
fromJSON/fromCrossJSONdenial of service via unvalidated array node lengthnpm seroval · Upgrade to 1.6.8 or later · >= 1.4.1, < 1.6.8 · CVE-2026-116584 · GHSA-wp97-x4hv-qvhp · amended
- High, CVSS 7.3
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
npm seroval · Upgrade to 1.6.8 or later · < 1.6.8 · CVE-2026-116580 · GHSA-7rv5-mrxv-xcr9 · amended
- High, CVSS 8.1
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
PyPI vllm · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-115915 · GHSA-h3rc-j82p-2c3h · amended
- High, CVSS 7.5
vLLM: Public multimodal SHM handle forgery reaches worker-side
pickle.loads()with insecure serialization disabledPyPI vllm · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-115912 · GHSA-6757-hggm-hp2w · amended
- High, CVSS 7.5
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
npm graphql-scalars · Upgrade to 2.0.1 or later · >= 1.24.1, < 2.0.1 · CVE-2026-115887 · GHSA-x8rm-f576-gq67 · amended
- High, CVSS 7.5
RE2JS: Quadratic-time denial of service in re2js lookbehind matching
npm re2js · Upgrade to 2.8.7 or later · >= 2.2.0, < 2.8.7 · CVE-2026-116795 · GHSA-gg6h-894w-4m9c · amended
- Critical, CVSS 9.4
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
crates.io zip · Upgrade to 9.0.5 or later · < 9.0.5 · CVE-2026-115905 · GHSA-m665-v7pm-7grj · amended
- High, CVSS 8.6
LangGraph JavaScript custom authentication may permit cross-user Store access
PyPI langgraph-api · Upgrade to 0.15.0 or later · >= 0.1.2, < 0.15.0 · CVE-2026-118668 · GHSA-4hm6-w6qq-w73v · amended
- High, CVSS 8.6
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
npm happy-dom · Upgrade to 21.0.0 or later · < 21.0.0 · CVE-2026-118660 · GHSA-c8p4-j97h-3vg8 · amended
- High, CVSS 7.2
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
npm @intlify/shared +5 · Upgrade all 6 to 12.0.0-alpha.5 (pre-release) or 11.4.14 by release line; some affected versions have no fix yet · >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5 · CVE-2026-118257 · GHSA-83rm-6c8r-g728 · amended
- High, CVSS 8.2
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
npm @graphql-tools/executor-legacy-ws · Upgrade to 1.1.36 or later · < 1.1.36 · CVE-2026-118665 · GHSA-434m-5hcj-pxf3 · amended
- High, CVSS 8.4
Highcharts Grid:
javascript:URL in credits.href runs script on clicknpm @highcharts/grid-pro · Upgrade to 3.2.0 or later · >= 2.0.0, < 3.2.0 · +1 more package · CVE-2026-118255 · GHSA-6hgp-fmhr-mrg4 · amended
- High, CVSS 8.6
Highcharts Grid parses pagination language options as HTML
npm @highcharts/grid-pro +1 · Upgrade all 2 to 3.2.0 or later · >= 2.0.0, < 3.2.0 · CVE-2026-118254 · GHSA-r5wg-q8fc-p6w2 · amended
- High, CVSS 8.4
Highcharts Dashboards parses fullscreen labels as HTML
npm @highcharts/dashboards · Upgrade to 4.2.3 or later · >= 1.0.0, < 4.2.3 · CVE-2026-118253 · GHSA-58g7-7f52-h92c · amended
- High, CVSS 8.4
Highcharts Dashboards parses sidebar component labels as HTML
npm @highcharts/dashboards · Upgrade to 4.2.3 or later · >= 1.0.0, < 4.2.3 · CVE-2026-118252 · GHSA-rcqf-f6h2-ccg9 · amended
- High, CVSS 8.4
Highcharts:
javascript:URL in credits.href runs script on clicknpm highcharts · Upgrade to 13.1.0, 12.6.1 or 11.4.9 by release line · < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0 · CVE-2026-118251 · GHSA-5793-x2q3-c3q7 · amended
- High, CVSS 7.2
Highcharts: dotted series.keys paths write to Object.prototype
npm highcharts · Upgrade to 13.1.0, 12.6.1 or 11.4.9 by release line · >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0; >= 6.1.0, < 11.4.9 · CVE-2026-118250 · GHSA-rmqc-xvr3-v46c · amended
- High, CVSS 7.1
Highcharts: series column construction writes to Object.prototype
npm highcharts · Upgrade to 13.1.0 or later · >= 13.0.0, < 13.1.0 · CVE-2026-118249 · GHSA-gfvx-2c2g-38wq · amended
- High, CVSS 8.4
Highcharts Core:
breadcrumbs.stylekeys become SVG event-handler attributesnpm highcharts · Upgrade to 13.1.0, 12.6.1 or 11.4.9 by release line · >= 10.0.0, < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0 · CVE-2026-118246 · GHSA-35rr-xwfh-x789 · amended
- High, CVSS 8.5
Highcharts Grid Pro: cell-renderer
attributesmap written with rawsetAttributenpm @highcharts/grid-pro · Upgrade to 3.2.0 or later · >= 2.0.0, < 3.2.0 · +1 more package · CVE-2026-116797 · GHSA-5ghw-9mgr-jvx2 · amended
- High, CVSS 8.5
Highcharts Grid: custom icon definition objects written with raw
setAttributeonnpm @highcharts/grid-pro +1 · Upgrade all 2 to 3.2.0 or later · >= 2.3.0, < 3.2.0 · CVE-2026-118242 · GHSA-6g3c-p4fg-xv47 · amended
- High, CVSS 8.6
Highcharts Dashboards:
chartConstructoris an unchecked lookup into the Highcharts namespacenpm @highcharts/dashboards · Upgrade to 4.2.2 or later · >= 1.0.0, < 4.2.2 · CVE-2026-118245 · GHSA-grj7-r4jv-pw9j · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.