Medium, CVSS 5.3
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
Maven io.opentelemetry:opentelemetry-api · Upgrade to 1.67.0 or later · < 1.67.0 · CVE-2026-118259 · GHSA-ccrj-gw8r-854m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 93 matching · newest first
- High, CVSS 8.6
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
npm happy-dom · Upgrade to 21.0.0 or later · < 21.0.0 · CVE-2026-118660 · GHSA-c8p4-j97h-3vg8 · amended
- Low, CVSS 2.1
Vue I18n:
escapeParameterdoes not escape named values when the same call also passes a listnpm @intlify/vue-i18n-core +4 · Upgrade all 5 to 12.0.0-alpha.5 (pre-release) or 11.4.14 by release line · >= 9.2.0-alpha.7, < 11.4.14; >= 12.0.0-alpha.1, < 12.0.0-alpha.5 · CVE-2026-118256 · GHSA-8rc2-428q-7ww3 · amended
- High, CVSS 7.2
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
npm @intlify/shared +5 · Upgrade all 6 to 12.0.0-alpha.5 (pre-release) or 11.4.14 by release line; some affected versions have no fix yet · >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5 · CVE-2026-118257 · GHSA-83rm-6c8r-g728 · amended
- Medium, CVSS 6.5
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
npm happy-dom · Upgrade to 20.14.6 or later · < 20.14.6 · CVE-2026-118661 · GHSA-5fpq-26gf-qwcr · amended
- Medium, CVSS 4.3
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
PyPI langgraph · Upgrade to 1.2.14 or later · >= 1.2.3, < 1.2.14 · +1 more package · CVE-2026-118667 · GHSA-3fx2-cqw9-xr3c · amended
- High, CVSS 8.2
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
npm @graphql-tools/executor-legacy-ws · Upgrade to 1.1.36 or later · < 1.1.36 · CVE-2026-118665 · GHSA-434m-5hcj-pxf3 · amended
- Medium, CVSS 6.0
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
npm @graphql-tools/executor-legacy-ws · Upgrade to 1.1.36 or later · < 1.1.36 · CVE-2026-118666 · GHSA-mp66-8ww2-pcwm · amended
- Medium, CVSS 5.3
@hono/node-server:
serveStaticdecodes the request path a second time, leading to bypass of middleware on static pathsnpm @hono/node-server · Upgrade to 2.1.3 or later · >= 1.19.10, < 2.1.3 · CVE-2026-118663 · GHSA-rmxm-3fg6-px4f · amended
- Medium, CVSS 5.9
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Go github.com/labstack/echo/v4 · Upgrade to 4.16.0 or later · < 4.16.0 · +1 more package · CVE-2026-118657 · GHSA-2ffq-g2xg-c22p · amended
- Medium, CVSS 5.9
Echo static file middleware route protection bypass via encoded dot-dot traversal
Go github.com/labstack/echo/v4 · Upgrade to 4.16.0 or later · < 4.16.0 · +1 more package · CVE-2026-118654 · GHSA-3pmx-cf9f-34xr · amended
- Medium, CVSS 5.9
Echo has a Static Middleware Double-Unescape Path Traversal
Go github.com/labstack/echo/v4 · Upgrade to 4.15.3 or later · < 4.15.3 · +1 more package · CVE-2026-118655 · GHSA-xwq5-6cqp-vx96 · amended
- Medium, CVSS 6.1
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI
Go github.com/labstack/echo/v4 · Upgrade to 4.16.0 or later · < 4.16.0 · +1 more package · CVE-2026-118656 · GHSA-v753-g4cw-jm48 · amended
- Medium, CVSS 4.7
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
Go github.com/labstack/echo/v4 · Upgrade to 4.15.2 or later · < 4.15.2 · +1 more package · CVE-2026-118658 · GHSA-23wf-92cp-8pcj · amended
- High, CVSS 8.4
Highcharts Grid:
javascript:URL in credits.href runs script on clicknpm @highcharts/grid-pro · Upgrade to 3.2.0 or later · >= 2.0.0, < 3.2.0 · +1 more package · CVE-2026-118255 · GHSA-6hgp-fmhr-mrg4 · amended
- High, CVSS 8.6
Highcharts Grid parses pagination language options as HTML
npm @highcharts/grid-pro +1 · Upgrade all 2 to 3.2.0 or later · >= 2.0.0, < 3.2.0 · CVE-2026-118254 · GHSA-r5wg-q8fc-p6w2 · amended
- High, CVSS 8.4
Highcharts Dashboards parses fullscreen labels as HTML
npm @highcharts/dashboards · Upgrade to 4.2.3 or later · >= 1.0.0, < 4.2.3 · CVE-2026-118253 · GHSA-58g7-7f52-h92c · amended
- High, CVSS 8.4
Highcharts Dashboards parses sidebar component labels as HTML
npm @highcharts/dashboards · Upgrade to 4.2.3 or later · >= 1.0.0, < 4.2.3 · CVE-2026-118252 · GHSA-rcqf-f6h2-ccg9 · amended
- High, CVSS 8.4
Highcharts:
javascript:URL in credits.href runs script on clicknpm highcharts · Upgrade to 13.1.0, 12.6.1 or 11.4.9 by release line · < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0 · CVE-2026-118251 · GHSA-5793-x2q3-c3q7 · amended
- High, CVSS 7.2
Highcharts: dotted series.keys paths write to Object.prototype
npm highcharts · Upgrade to 13.1.0, 12.6.1 or 11.4.9 by release line · >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0; >= 6.1.0, < 11.4.9 · CVE-2026-118250 · GHSA-rmqc-xvr3-v46c · amended
- High, CVSS 7.1
Highcharts: series column construction writes to Object.prototype
npm highcharts · Upgrade to 13.1.0 or later · >= 13.0.0, < 13.1.0 · CVE-2026-118249 · GHSA-gfvx-2c2g-38wq · amended
- High, CVSS 8.4
Highcharts Core:
breadcrumbs.stylekeys become SVG event-handler attributesnpm highcharts · Upgrade to 13.1.0, 12.6.1 or 11.4.9 by release line · >= 10.0.0, < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0 · CVE-2026-118246 · GHSA-35rr-xwfh-x789 · amended
- High, CVSS 8.5
Highcharts Grid Pro: cell-renderer
attributesmap written with rawsetAttributenpm @highcharts/grid-pro · Upgrade to 3.2.0 or later · >= 2.0.0, < 3.2.0 · +1 more package · CVE-2026-116797 · GHSA-5ghw-9mgr-jvx2 · amended
- High, CVSS 8.5
Highcharts Grid: custom icon definition objects written with raw
setAttributeonnpm @highcharts/grid-pro +1 · Upgrade all 2 to 3.2.0 or later · >= 2.3.0, < 3.2.0 · CVE-2026-118242 · GHSA-6g3c-p4fg-xv47 · amended
- High, CVSS 8.6
Highcharts Dashboards:
chartConstructoris an unchecked lookup into the Highcharts namespacenpm @highcharts/dashboards · Upgrade to 4.2.2 or later · >= 1.0.0, < 4.2.2 · CVE-2026-118245 · GHSA-grj7-r4jv-pw9j · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.