Medium, CVSS 6.3
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
npm jodit · Upgrade to 4.12.18 or later · < 4.12.18 · CVE-2026-54756 · GHSA-5957-5c94-3v7w
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3151–3175 of 30,921 matching · newest first
- Medium, CVSS 5.4
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
npm jodit · Upgrade to 4.12.31 or later · <= 4.12.30 · CVE-2026-62324 · GHSA-j839-gqq4-gf9j
- High, CVSS 8.7
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53502 · GHSA-cj54-hpcc-gj6h
- High, CVSS 7.5
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53505 · GHSA-phj3-59pf-cp83
- High, CVSS 7.5
Thumbor has Regex Denial of Service (ReDoS) in
convolutionfilterPyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53504 · GHSA-5vjc-7cxw-4w6j
- High, CVSS 7.5
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53503 · GHSA-cqjp-jf4r-h5q9
- High, CVSS 8.2
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53501 · GHSA-mw3h-qjxj-6xg9
- High, CVSS 8.2
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
PyPI thumbor · Upgrade to 7.8.0 or later · <= 7.7.7 · CVE-2026-53500 · GHSA-6x26-6r6f-m537
- High, CVSS 7.3
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
npm @phun-ky/defaults-deep · Upgrade to 2.0.5 or later · < 2.0.5 · CVE-2026-54737 · GHSA-mj3g-7xcc-x4vh
- Critical, CVSS 9.6
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
Go github.com/bank-vaults/vault-secrets-webhook · Upgrade to 1.23.1 or later · <= 1.22.2 · CVE-2026-54725 · GHSA-r2v3-8gwf-7ghm · amended
- High, CVSS 8.7
hashi-vault-js has a path traversal and query parameter injection
npm hashi-vault-js · Upgrade to 0.5.2 or later · <= 0.5.1 · CVE-2026-55100 · GHSA-g956-2f74-rmv7
- High, CVSS 8.7
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
npm dssrf · Upgrade to 1.0.5 or later · <= 1.0.4 · CVE-2026-54729 · GHSA-5846-7qm3-r52j
- Medium, CVSS 6.6
Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
Go github.com/projectcapsule/capsule · Upgrade to 0.13.8 or later · >= 0.13.0, <= 0.13.7 · CVE-2026-65835 · GHSA-jr6p-8pjj-mfx6 · amended
- Medium, CVSS 6.8
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
Go github.com/projectcapsule/capsule · Upgrade to 0.13.8 or later · <= 0.13.7 · CVE-2026-65834 · GHSA-68cj-mvg9-rgm2 · amended
- Medium, CVSS 5.7
re2: Out-of-bounds heap read in
exec/test/matchvia attacker-influencedlastIndexon a non-ASCII subject → uncatchable process crash (DoS)npm re2 · Upgrade to 1.25.2 or later · <= 1.25.1 · CVE-2026-67550 · GHSA-ff84-5f28-78qj
- Medium, CVSS 6.2
re2: Global
String.prototype.matchwith an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)npm re2 · Upgrade to 1.25.2 or later · <= 1.25.1 · CVE-2026-68499 · GHSA-6hxr-mr5r-9836
- Medium, CVSS 6.5
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
Packagist sylius/mollie-plugin · Upgrade to 3.3.1, 3.2.4 or 2.2.8 by release line · < 2.2.8; >= 3.0.0, < 3.2.4; >= 3.3.0, < 3.3.1 · CVE-2026-68501 · GHSA-x83g-979r-f5fh · amended
- High, CVSS 7.5
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
Packagist sylius/mollie-plugin · Upgrade to 3.3.1, 3.2.4 or 2.2.8 by release line · < 2.2.8; >= 3.0.0, < 3.2.4; >= 3.3.0, < 3.3.1 · CVE-2026-68500 · GHSA-rc52-c4hv-w89p · amended
- High, CVSS 7.5
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-56819 · GHSA-93wv-jw9v-4972 · amended
- High, CVSS 8.6
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12075 · GHSA-qvv7-cg9c-w4x3
- High, CVSS 7.5
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12061 · GHSA-fg7f-2386-8897
- High, CVSS 7.5
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12072 · GHSA-6hm5-jgcp-p838
- High, CVSS 7.5
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-12074 · GHSA-xh95-f55m-82fw
- Medium, CVSS 5.9
nx graphdev server permissive CORS policynpm nx · Upgrade to 23.0.0-beta.2 (pre-release) or 22.7.2 by release line · >= 17.0.4, < 22.7.2; >= 23.0.0-beta.0, < 23.0.0-beta.2 · CVE-2026-54753 · GHSA-g2r8-wvmj-jf5w
- High, CVSS 7.5
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
Maven org.springframework.data:spring-data-commons · Upgrade to 4.0.6 or 3.5.12 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.5; >= 3.5.0, <= 3.5.11; >= 3.4.0, <= 3.4.13 · CVE-2026-41695 · GHSA-88fw-v6x4-3f58 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.