High, CVSS 8.1
better-auth: Device login approval does not show the requesting client or permissions
npm better-auth · Upgrade to 1.7.0-rc.3 (pre-release) or later · >= 1.3.8-beta.3, < 1.7.0-rc.3 · CVE-2026-109346 · GHSA-q84f-53jg-9ppm · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
vllm p2p never connected zmq_exhaustion
PyPI vllm · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-94624 · GHSA-frvg-qw88-hww9 · amended
- High, CVSS 8.6
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
PyPI rembg · Upgrade to 2.0.82 or later · < 2.0.82 · CVE-2026-115924 · GHSA-qr6x-7v33-6qmg · amended
- High, CVSS 8.2
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation
Maven com.google.guava:guava · Upgrade to 33.7.2 or later · >= 4.0, < 33.7.2 · CVE-2026-102554 · GHSA-xxph-c9ww-hj94 · amended
- High, CVSS 8.5
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
PyPI oauthlib · Upgrade to 4.0.1 or later · >= 3.3.0, < 4.0.1 · CVE-2026-49272 · GHSA-3jp2-3mrg-2vxc · amended
- Critical, CVSS 9.3
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
PyPI monai · Upgrade to 1.6.1 or later · < 1.6.1 · CVE-2026-48705 · GHSA-6hp3-vr39-rqw8 · amended
- High, CVSS 7.6
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Go github.com/wailsapp/wails/v2 · Upgrade to 2.13.0 or later · >= 2.0.0, < 2.13.0 · CVE-2026-34157 · GHSA-47hv-j4px-h3c9 · amended
- High, CVSS 8.8
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Packagist dolibarr/dolibarr · Upgrade to 23.0.2 or 22.0.5 by release line · < 22.0.5; >= 23.0.0, < 23.0.2 · CVE-2026-33944 · GHSA-v5fq-cf5m-vwv7 · amended
- High, CVSS 8.1
Ajenti has potential Remote Code Execution
PyPI aj · Upgrade to 2.2.13 or later · < 2.2.13 · CVE-2026-27975 · GHSA-vcw3-r3fx-j444 · amended
- High, CVSS 7.8
Arbitrary code execution when rerunning tests from a portable recording
crates.io cargo-nextest · Upgrade to 0.9.150 or later · >= 0.9.125, < 0.9.150 · GHSA-vc25-qg58-w57c
- High, CVSS 7.5
PYSEC-2026-4353
PyPI vllm · Upgrade to 0.30.0 or later · >= 0.20.0, < 0.30.0 · CVE-2026-116178 · GHSA-34qw-q2h2-jp3m
- High, CVSS 7.5
PYSEC-2026-4352
PyPI vllm · Upgrade to 0.25.0 or later · >= 0.10.2, < 0.25.0 · CVE-2026-116177 · GHSA-mm38-5g96-7j6x
- High, CVSS 8.2
PYSEC-2026-4351
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.9.2, < 0.24.0 · CVE-2026-116176 · GHSA-vfp2-c8pq-v6h6
- High, CVSS 7.5
PYSEC-2026-4350
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.22.0, < 0.24.0 · CVE-2026-116173 · GHSA-6pgw-f3pv-4h8q
- High, CVSS 7.1
virtualenv: Xonsh activation literals depend on the script decoding codec
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113718 · GHSA-394h-qwmc-48pf · amended
- High, CVSS 7.1
virtualenv: Bash prompt values can change meaning under older compatibility modes
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113723 · GHSA-6w3r-xr62-4xcp · amended
- High, CVSS 7.5
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
npm @azure/msal-node · Upgrade to 7.1.0 or later · >= 5.0.0-beta.0, < 7.1.0 · CVE-2026-109461 · GHSA-xcx6-jx8p-x3h5 · amended
- High, CVSS 7.5
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 6.23.0, < 6.29.1; >= 7.18.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109869 · GHSA-xjj6-f33q-929c · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
npm multer · Upgrade to 2.5.0 or later · >= 2.0.0, < 2.5.0 · CVE-2026-113872 · GHSA-q7qp-rjg7-q26m · amended
- High, CVSS 8.8
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
npm happy-dom · Upgrade to 21.0.4 or later · >= 17.0.0, <= 21.0.3 · CVE-2026-115895 · GHSA-834v-8h66-3h79 · amended
- High, CVSS 7.1
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.20.4, <= 4.2.0 · CVE-2026-112940 · GHSA-v4x8-3wr5-3wq8 · amended
- Critical, CVSS 9.2
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112398 · GHSA-5x8w-8jj5-q52h · amended
- High, CVSS 7.5
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
npm postal-mime · Upgrade to 4.0.8 or later · >= 3.0.0, < 4.0.8 · GHSA-f2hq-32vh-53cc · amended
- Critical, CVSS 9.2
Laravel TokenGuard authentication bypass through non-string API credentials
Packagist laravel/framework · Upgrade to 13.27.0, 12.68.0, 11.56.1 or 10.50.4 by release line · >= 13.0.0, < 13.27.0; >= 12.0.0, < 12.68.0; >= 11.0.0, < 11.56.1; < 10.50.4 · CVE-2026-114509 · GHSA-f9x3-7vq9-cph6 · amended
- High, CVSS 7.5
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
PyPI vllm · Upgrade to 0.31.0 or later · >= 0.7.3, < 0.31.0 · CVE-2026-114055 · GHSA-gx7p-2j49-hfq4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.