High, CVSS 8.7
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114143 · GHSA-9j65-hcg3-gc64 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114144 · GHSA-9qmh-m7c6-f92p · amended
- High, CVSS 8.7
Storybook dev server vulnerable to code injection from the local network
npm storybook · Upgrade to 11.0.0-alpha.6 (pre-release), 10.6.2, 9.1.21 or 8.6.19 by release line · >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · +5 more packages · CVE-2026-114126 · GHSA-px85-f4q5-jh77 · amended
- High, CVSS 8.4
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
npm @graphql-tools/utils · Upgrade to 12.0.2 or later · >= 10.10.1, <= 12.0.1 · CVE-2026-114604 · GHSA-c4qx-w738-7hr3 · amended
- High, CVSS 7.5
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
PyPI graphql-core · Upgrade to 3.3.0rc1 (pre-release) or 3.2.12 by release line · >= 3.2.3, < 3.2.12; >= 3.3.0a3, < 3.3.0rc1 · CVE-2026-75508 · GHSA-r77w-qph3-7vf8 · amended
- High, CVSS 7.5
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
PyPI graphql-core · Upgrade to 3.3.0rc1 (pre-release) or 3.2.12 by release line · >= 3.0.0, < 3.2.12; >= 3.3.0a1, < 3.3.0rc1 · CVE-2026-75507 · GHSA-vj8h-fx38-h3vc · amended
- Critical, CVSS 9.2
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
npm dompurify · Upgrade to 3.4.17 or later · >= 3.4.4, < 3.4.17 · CVE-2026-116804 · GHSA-cg2g-xh64-v4q7 · amended
- High, CVSS 7.6
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
npm dompurify · Upgrade to 3.4.17 or later · < 3.4.17 · CVE-2026-116803 · GHSA-mrv2-3pqr-j5jr · amended
- High, CVSS 8.8
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
PyPI nbconvert · Upgrade to 7.17.2 or later · >= 5.4.0, <= 7.17.1 · CVE-2026-114140 · GHSA-pjvx-prjx-h659 · amended
- High, CVSS 8.7
Black: GitHub Action installs unvalidated required-version from pyproject.toml
PyPI black · Upgrade to 26.10.1 or later · < 26.10.1 · CVE-2026-114134 · GHSA-cg8m-r9f2-5wm2 · amended
- High, CVSS 7.4
Django REST framework: TokenProxy.delete() reports success and revokes nothing
PyPI djangorestframework · Upgrade to 3.18.2 or later · >= 3.12.0, < 3.18.2 · CVE-2026-114137 · GHSA-xw6w-gcfp-cf8m · amended
- High, CVSS 7.5
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
PyPI djangorestframework · Upgrade to 3.18.2 or later · < 3.18.2 · CVE-2026-114138 · GHSA-33wh-fxxf-88vv · amended
- High, CVSS 7.5
Django REST framework: JSONParser applies an attacker-named codec to the request stream
PyPI djangorestframework · Upgrade to 3.18.2 or later · >= 3.6.4, < 3.18.2 · CVE-2026-114136 · GHSA-3547-9m27-7rxg · amended
- High, CVSS 7.7
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 9.4.0, < 13.0.0 · CVE-2026-96778 · GHSA-g7cr-3p24-7wf7 · amended
- High, CVSS 7.1
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96644 · GHSA-9v9v-9qvf-h2hj · amended
- High, CVSS 7.1
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 11.0.0, < 13.0.0 · CVE-2026-96643 · GHSA-g4qv-2jxx-769h · amended
- High, CVSS 7.1
Pillow: TarIO negative size field causes infinite CPU-spin loop
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96642 · GHSA-3j72-p6qg-6xp7 · amended
- High, CVSS 8.2
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-96640 · GHSA-mrfp-p49p-3hf2 · amended
- Critical, CVSS 9.8
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 11.0.0, < 13.0.0 · CVE-2026-96639 · GHSA-v9pv-5gc8-w2m6 · amended
- High, CVSS 7.1
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96637 · GHSA-g842-9rc4-69pw · amended
- Critical, CVSS 9.1
Sentry-Javascript: Middleware Bypass when using Tunnel route
npm @sentry/nextjs · Upgrade to 11.0.0-rc.1 (pre-release), 10.75.2 or 9.47.2 by release line · >= 9.36.0, < 9.47.2; >= 10.0.0-alpha.0, < 10.75.2; >= 11.0.0-alpha.0, < 11.0.0-rc.1 · CVE-2026-114139 · GHSA-mchm-gjx6-7h55 · amended
- Critical, CVSS 9.5
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
npm next · Upgrade to 16.4.1 or 15.5.28 by release line · >= 10.0.0, <= 15.5.27; >= 16.0.0, <= 16.4.0 · GHSA-2464-fhr4-w9xw · amended
- High, CVSS 7.8
Librsvg: Use-after-free when XML includes have duplicated entities
crates.io librsvg · Upgrade to 2.63.2, 2.62.4, 2.61.5 or 2 more by release line · < 2.57.5; >= 2.60.0-beta.0, < 2.60.3; >= 2.61.0, < 2.61.5; >= 2.62.0-beta.0, < 2.62.4; >= 2.63.0-beta.0, < 2.63.2 · CVE-2026-96889 · GHSA-cpvr-w4j5-2mpg · amended
- High, CVSS 8.2
Next.js: Denial of Service in App Router using Server Actions
npm next · Upgrade to 16.4.1 or 15.5.28 by release line · >= 13.0.0, <= 15.5.27; >= 16.0.0, <= 16.4.0 · CVE-2026-94482 · GHSA-p3m5-59mp-jv5r · amended
- High, CVSS 7.4
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · GHSA-pxh4-856f-4h89 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.