High, CVSS 7.5
Forge: Denial of service in TLS record processing via call stack exhaustion
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119187 · GHSA-hqq3-7jhf-c5jx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 74 matching · newest first
- High, CVSS 7.4
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119190 · GHSA-5x38-2vff-x55p · amended
- Medium, CVSS 5.4
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling
Packagist phpunit/phpunit · Upgrade to 13.4.4 or later · >= 13.4.0, < 13.4.4 · CVE-2026-119193 · GHSA-9vw2-f4vp-x7gf · amended
- Medium, CVSS 4.8
Nuxt dev server exposes generated appSecret through Vite file serving
npm @nuxt/vite-builder · Upgrade to 4.6.3 or later · >= 4.6.0, < 4.6.3 · CVE-2026-119201 · GHSA-3xf4-9g3c-4h4w · amended
- Medium, CVSS 6.5
Nuxt: Dot segments in the request path bypass
server/middlewarepath checks and server route rules on page routesnpm nuxt +1 · Upgrade all 2 to 4.6.3 or later · >= 4.6.0, < 4.6.3 · CVE-2026-119200 · GHSA-9v7c-q64q-vv33 · amended
- Medium, CVSS 5.9
Nuxt dev server arbitrary file read through client error reports
npm @nuxt/vite-builder · Upgrade to 4.6.3 or later · >= 4.6.0, < 4.6.3 · CVE-2026-119198 · GHSA-x287-wcfc-q46c · amended
- Medium, CVSS 5.9
Nuxt dev server exposes private runtime config through the Nitro dev bundle
npm @nuxt/vite-builder · Upgrade to 4.6.3 or later · >= 3.0.0, < 4.6.3 · CVE-2026-119199 · GHSA-648h-gw55-m2g7 · amended
- High, CVSS 7.4
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
npm @sigstore/oci · Upgrade to 0.7.2 or later · < 0.7.2 · CVE-2026-118763 · GHSA-j63v-mwhm-56jx · amended
- Medium, CVSS 5.9
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.11, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · CVE-2026-119276 · GHSA-h599-m3w5-9m7x · amended
- Medium, CVSS 5.9
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.10, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.10 · CVE-2026-119279 · GHSA-797x-p4mc-jwpm · amended
- Low, CVSS 3.7
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.11, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · CVE-2026-119280 · GHSA-4jq2-8v3c-97w8 · amended
- Medium, CVSS 5.9
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.11, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · CVE-2026-119210 · GHSA-fhx5-2xqw-2cgm · amended
- Medium, CVSS 5.9
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.11, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · CVE-2026-119281 · GHSA-grfq-r75j-rw9x · amended
- High, CVSS 8.2
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
npm follow-redirects · Upgrade to 1.16.2 or later · >= 1.16.0, < 1.16.2 · CVE-2026-116689 · GHSA-mrwp-f3q8-3g9p · amended
- Low, CVSS 2.3
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
crates.io pageant · Upgrade to 0.2.5 or later · >= 0.2.0, < 0.2.5 · CVE-2026-116775 · GHSA-662x-8wvj-2276 · amended
- Low, CVSS 3.3
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
crates.io russh · Upgrade to 0.65.0 or later · < 0.65.0 · CVE-2026-116696 · GHSA-9wfm-jcj8-jfv9 · amended
- High, CVSS 7.5
GraphQL-core has denial of service via memory leak in aborted validations
PyPI graphql-core · Upgrade to 3.3.1 or later · >= 3.3.0a3, < 3.3.1 · CVE-2026-119286 · GHSA-mpqx-q82w-9x46 · amended
- High, CVSS 8.4
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
PyPI oauthlib · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-118669 · GHSA-7984-qgvg-3j9c · amended
- Medium, CVSS 5.3
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
PyPI openwisp-controller · Upgrade to 1.3.2 or later · >= 1.0.0, < 1.3.2 · CVE-2026-116677 · GHSA-9gh4-xw24-9xh5 · amended
- Medium, CVSS 5.9
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
Go github.com/gofiber/fiber/v2 · Upgrade to 2.52.3 or later · >= 2.52.1, < 2.52.3 · CVE-2026-119285 · GHSA-g5jq-qmqr-qrwf · amended
- Medium, CVSS 4.2
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
npm signalk-server · Upgrade to 2.34.0 or later · >= 2.28.0-beta.2, < 2.34.0 · CVE-2026-115752 · GHSA-7wpf-ch8f-5f4x · amended
- Critical, CVSS 9.8
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
npm signalk-server · Upgrade to 2.34.0 or later · >= 2.0.0, < 2.34.0 · +1 more package · CVE-2026-123807 · GHSA-4xm8-rg9h-jhq2 · amended
- Critical, CVSS 9.8
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
Go github.com/imgproxy/imgproxy +3 · Upgrade all 4 to 4.0.16 or later · >= 4.0.0, < 4.0.16 · CVE-2026-123614 · GHSA-hff9-5pqw-6w9f · amended
- Medium, CVSS 6.5
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS
Go github.com/anacrolix/torrent · Upgrade to 1.61.1-0.20260911233437-76452a2c8a2f (pre-release) or later · < 1.61.1-0.20260911233437-76452a2c8a2f · GHSA-2wrx-84qj-4pcg · amended
- Medium, CVSS 6.9
AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96634 · GHSA-p96f-p2p2-2g3h · amended
A vendor fix does not resolve your finding until you verify it in your own systems.