High, CVSS 7.1
pypdf: Possible long runtimes for repeated references to the same missing object
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115572 · GHSA-6c7f-9265-g8fw · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115585 · GHSA-jr96-gvgh-j3r4 · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for large xref table header limits
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115580 · GHSA-gmh7-3g9r-mjh5 · amended
- High, CVSS 7.4
Electron: Mitigation for compromised eMudhra intermediate certificates
npm electron · Upgrade to 45.0.0-beta.6 (pre-release), 44.9.1, 43.8.1 or 42.11.16 by release line · >= 45.0.0-alpha.1, < 45.0.0-beta.6; >= 44.0.0-alpha.1, < 44.9.1; >= 43.0.0-alpha.1, < 43.8.1; < 42.11.16 · CVE-2026-115570 · GHSA-jr5w-w6x2-84p9 · amended
- High, CVSS 7.5
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
npm body-parser · Upgrade to 2.4.0 or 1.20.9 by release line · >= 2.0.0, < 2.4.0; < 1.20.9 · CVE-2026-111181 · GHSA-27r3-jxmh-p828 · amended
- High, CVSS 7.3
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
crates.io gix · Upgrade to 0.90.0 or later · >= 0.88.0, <= 0.89.0 · GHSA-q54r-jf2p-rfr2 · amended
- High, CVSS 8.2
Echo: WebSocket proxy can retain connections and handlers after client disconnect
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.15.0, < 4.16.1 · +1 more package · CVE-2026-118262 · GHSA-9969-6676-49h5 · amended
- High, CVSS 8.2
Echo: Decompress permits unbounded gzip expansion in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118261 · GHSA-h7wr-284f-5qvc · amended
- Critical, CVSS 9.1
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · +1 more package · CVE-2026-118264 · GHSA-cxf3-9h37-7rr8 · amended
- High, CVSS 8.2
Echo: BodyDump captures request and response bodies without size limits in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118260 · GHSA-f48p-c9v4-h7xv · amended
- High, CVSS 8.6
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
npm @strands-agents/sdk · Upgrade to 1.5.0 or later · < 1.5.0 · +1 more package · CVE-2026-115419 · GHSA-4v6f-7vjh-6x4m · amended
- High, CVSS 7.1
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
PyPI virtualenv +1 · Upgrade all 2 to 21.14.13 or later · >= 21.14.9, < 21.14.13 · CVE-2026-115586 · GHSA-cx6f-vjhg-g3cc · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115776 · GHSA-53xc-49m8-p798 · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115778 · GHSA-cwm5-jh59-mwxr · amended
- High, CVSS 8.7
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115775 · GHSA-3476-c5c2-fr73 · amended
- High, CVSS 7.1
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
npm obsidian-tc · Upgrade to 1.31.4 or later · >= 1.0.1, <= 1.31.3 · CVE-2026-115478 · GHSA-r3g7-r4hr-m258 · amended
- High, CVSS 7.5
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260731131820-67bc300b6ea6 (pre-release) or later · < 0.0.0-20260731131820-67bc300b6ea6 · CVE-2026-73054 · GHSA-c8w8-3pqp-wr83 · amended
- Critical, CVSS 9.6
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77363 · GHSA-pqh8-4pj7-32xx · amended
- High, CVSS 7.1
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
npm obsidian-tc · Upgrade to 1.31.4 or later · >= 1.13.0, <= 1.31.3 · CVE-2026-115477 · GHSA-737x-cwfr-5vvc · amended
- Critical, CVSS 9.9
obsidian-tc tokens can access arbitrary configured vaults
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77366 · GHSA-84c9-qqpq-2pq5 · amended
- High, CVSS 8.1
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
PyPI pillow · Upgrade to 13.0.0 or later · >= 11.1.0, < 13.0.0 · GHSA-78g4-xqwv-q3g8 · amended
- Critical, CVSS 9.5
Next.js: Unauthenticated Remote Code Execution in
use cachefunctions returning typed arraysnpm next · Upgrade to 16.4.1 or later · >= 16.0.0, <= 16.4.0 · GHSA-673q-mjm6-r5xr · amended
- High, CVSS 7.5
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
PyPI gitpython · Upgrade to 3.2.1 or later · <= 3.2.0 · CVE-2026-114145 · GHSA-83vg-56qc-22m7 · amended
- High, CVSS 8.8
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
npm toml +1 · Upgrade all 2 to 5.0.1 or later · <= 5.0.0 · CVE-2026-114142 · GHSA-h895-cgqg-jf52 · amended
- High, CVSS 8.7
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114141 · GHSA-4qx8-w7c3-pj3p · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.