High, CVSS 8.8
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
PyPI jupyter-server · Upgrade to 2.6.0 or later · >= 2.0.0, < 2.6.0 · CVE-2026-114135 · GHSA-354v-3q48-cv69 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.2Exploited · CISA KEV
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
PyPI brotli · Upgrade to 1.2.1 or later · >= 1.0.3, < 1.2.1 · +9 more packages · CVE-2026-111497 · GHSA-9v8h-qqgm-4m35 · amended
- Critical, CVSS 9.2
mem0ai Databricks vector store vulnerable to SQL injection
PyPI mem0ai · Upgrade to 1.0.8 or later · >= 0.1.117, < 1.0.8 · CVE-2026-115324 · GHSA-7587-9684-52r6 · amended
- High, CVSS 7.5
SSRF and local file disclosure via unvalidated URLs
crates.io webpage · Upgrade to 2.1.0 or later · >= 0.0.0-0, < 2.1.0 · GHSA-23hp-j76v-pcwj
- Critical, CVSS 9.2Exploited · CISA KEV
RCE via stale global state
Bitnami php +2 · Upgrade all 3 to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 by release line · >= 5.4.0, < 8.2.35; >= 8.3.0, < 8.3.36; >= 8.4.0, < 8.4.27; >= 8.5.0, < 8.5.12 · CVE-2026-109619 · GHSA-6wmf-4rv5-p3rp · amended
- Critical, CVSS 9.2Exploited · CISA KEV
RCE via OOM corruption
Bitnami php +2 · Upgrade all 3 to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 by release line · >= 7.3.0, < 8.2.35; >= 8.3.0, < 8.3.36; >= 8.4.0, < 8.4.27; >= 8.5.0, < 8.5.12 · CVE-2026-109618 · GHSA-w8hw-w9fx-j79w · amended
- High, CVSS 7.8
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113722 · GHSA-c978-59m8-c77v · amended
- High, CVSS 8.8
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
PyPI pillow · Upgrade to 13.0.0 or later · >= 5.4.0, < 13.0.0 · CVE-2026-112902 · GHSA-xvh5-g6gv-559v · amended
- Critical, CVSS 9.2
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 2.0.0, < 13.0.0 · CVE-2026-112393 · GHSA-332p-7hrc-92wf · amended
- High, CVSS 8.7
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-112406 · GHSA-f2g6-542v-9j58 · amended
- High, CVSS 8.7
Pillow: APNG background disposal allocates full canvas before decompression bomb check
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 8.1.0, < 13.0.0 · CVE-2026-112399 · GHSA-5xm2-6676-qcp9 · amended
- High, CVSS 8.7
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 4.1.0, < 13.0.0 · CVE-2026-112892 · GHSA-gg2r-wvfm-q9rx · amended
- High, CVSS 8.7
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-112894 · GHSA-jg86-v3jv-hrpm · amended
- High, CVSS 8.2
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 7.2.0, < 13.0.0 · CVE-2026-112390 · GHSA-22hg-r758-rrw9 · amended
- High, CVSS 8.2
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112392 · GHSA-27h8-gf7j-v5hc · amended
- High, CVSS 8.7
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 12.0.0, < 13.0.0 · CVE-2026-112405 · GHSA-cp9v-662q-vvx9 · amended
- High, CVSS 8.2
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 10.0.0, < 13.0.0 · CVE-2026-112893 · GHSA-j4m9-6w36-pw47 · amended
- High, CVSS 8.7
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112402 · GHSA-7mwm-ghpf-9vrm · amended
- Critical, CVSS 9.2
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 2.6.0, < 13.0.0 · CVE-2026-112900 · GHSA-w889-685w-c8fh · amended
- Critical, CVSS 9.4
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
npm storybook · Upgrade to 11.0.0-alpha.6 (pre-release), 10.6.2, 9.1.21 or 8.6.19 by release line · >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · +5 more packages · CVE-2026-114125 · GHSA-f2ph-cmg5-wxc8 · amended
- High, CVSS 7.8
virtualenv bash activate runs commands from an environment name with a backslash before $
PyPI virtualenv +1 · Upgrade all 2 to 21.14.7 or later · < 21.14.7 · CVE-2026-113725 · GHSA-vxj4-q4g9-crj7 · amended
- High, CVSS 7.8
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
PyPI virtualenv +1 · Upgrade all 2 to 21.14.4 or later · < 21.14.4 · CVE-2026-113726 · GHSA-5vjq-rrrf-7h2q · amended
- High, CVSS 7.8
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
PyPI virtualenv +1 · Upgrade all 2 to 21.14.2 or later · < 21.14.2 · CVE-2026-113732 · GHSA-c947-3pg5-gm8q · amended
- High, CVSS 7.8
virtualenv activation scripts run code from a path that contains a placeholder name
PyPI virtualenv +1 · Upgrade all 2 to 21.14.2 or later · >= 20.26.6, < 21.14.2 · CVE-2026-113776 · GHSA-8rjx-v5ww-45pp · amended
- High, CVSS 7.4
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
Go github.com/openchoreo/openchoreo · Upgrade to 1.2.5, 1.1.7 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.7; >= 1.2.0, < 1.2.5 · CVE-2026-113727 · GHSA-46r4-q7wv-32fc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.