High, CVSS 7.5
find-my-way: DDoS with HTTP2
npm find-my-way · Upgrade to 9.7.0 or later · <= 9.6.0 · CVE-2026-47219 · GHSA-c96f-x56v-gq3h · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3451–3475 of 30,921 matching · newest first
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
PyPI pypdf · Upgrade to 6.14.2 or later · < 6.14.2 · CVE-2026-59935 · GHSA-g867-7843-wf8q · amended
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images
PyPI pypdf · Upgrade to 6.14.1 or later · < 6.14.1 · CVE-2026-59936 · GHSA-5xf7-4p34-54qr · amended
- Medium, CVSS 6.9
pypdf: Possible long runtimes for repeated malformed cross-reference entries
PyPI pypdf · Upgrade to 6.14.0 or later · < 6.14.0 · CVE-2026-59937 · GHSA-55h5-xmcq-c37v · amended
- Medium, CVSS 6.9
pypdf: Possible large memory usage for wrong image dimensions
PyPI pypdf · Upgrade to 6.14.0 or later · < 6.14.0 · CVE-2026-59938 · GHSA-5qjq-93h5-hrgp · amended
- High, CVSS 7.5
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
npm postcss · Upgrade to 8.5.12 or later · <= 8.5.11 · CVE-2026-45623 · GHSA-6g55-p6wh-862q · amended
- High, CVSS 7.5
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59933 · GHSA-xh5m-36r6-47m3
- High, CVSS 7.5
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59932 · GHSA-2mrg-gjxq-2gvr
- High, CVSS 7.7
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59931 · GHSA-6hq5-7373-42rg
- Critical, CVSS 9.1
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
npm next-auth · Upgrade to 5.0.0-beta.32 (pre-release) or later · >= 5.0.0-beta.0, <= 5.0.0-beta.31 · CVE-2026-73421 · GHSA-8fpg-xm3f-6cx3 · amended
- High, CVSS 7.5
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73418 · GHSA-xmf8-cvqr-rfgj · amended
- Critical, CVSS 9.1
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73420 · GHSA-7rqj-j65f-68wh · amended
- Medium, CVSS 6.8
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
npm @auth/core · Upgrade to 0.41.3 or later · <= 0.41.2 · +1 more package · CVE-2026-73419 · GHSA-x445-f3h2-j279 · amended
- Medium, CVSS 4.8
danger allows local OS command injection through crafted file paths
npm danger · Upgrade to 13.0.8 or later · < 13.0.8 · CVE-2026-16629 · GHSA-3x93-p86w-5jvh · amended
- Medium, CVSS 5.3
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72750 · GHSA-652q-gvq3-74qv · amended
- Medium, CVSS 5.8
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72775 · GHSA-jqwr-vx3p-r266 · amended
- Medium, CVSS 5.8
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72764 · GHSA-9cmh-xcqm-5hqr · amended
- High, CVSS 8.6
JupyterLab: Cross-site scripting (XSS) via crafted settings file (
overrides.json)PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; >= 3.3.0, <= 4.5.9 · CVE-2026-73417 · GHSA-pppj-hq3g-57pj · amended
- High, CVSS 7.5
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; <= 4.5.9 · CVE-2026-73415 · GHSA-gx64-gj6p-pc4c · amended
- Medium, CVSS 6.1
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; >= 4.5.0, <= 4.5.9 · CVE-2026-73416 · GHSA-89vp-jrxv-24w8 · amended
- Medium, CVSS 6.0
JupyterLab PluginManager lock-rule enforcement bypass
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; >= 4.1.0, <= 4.5.9 · CVE-2026-73627 · GHSA-h5v5-8746-g7mm · amended
- High, CVSS 7.7
JupyterLab: Allowlist/blocklist check in
PyPIExtensionManager.install()not enforced for direct callers (missingawait)PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; <= 4.5.9 · CVE-2026-73626 · GHSA-whvh-wf3x-g77j · amended
- High, CVSS 8.3
Next.js: Server-Side Request Forgery in Server Actions on custom servers
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 14.1.1, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64649 · GHSA-89xv-2m56-2m9x · amended
- Medium, CVSS 6.0
Next.js: Cache confusion of response bodies for requests with bodies
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64648 · GHSA-68g3-v927-f742 · amended
- Medium, CVSS 6.3
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64647 · GHSA-4633-3j49-mh5q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.