Medium, CVSS 6.3
Next.js: Unbounded Server Action payload in Edge runtime
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64646 · GHSA-4c39-4ccg-62r3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3476–3500 of 30,921 matching · newest first
- High, CVSS 8.3
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64645 · GHSA-p9j2-gv94-2wf4 · amended
- Medium, CVSS 6.3
Next.js: Denial of Service in the Image Optimization API using SVGs
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 15.5.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64644 · GHSA-q8wf-6r8g-63ch · amended
- Medium, CVSS 6.3
Next.js: Unauthenticated disclosure of internal Server Function endpoints
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64643 · GHSA-955p-x3mx-jcvp · amended
- High, CVSS 8.3
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
npm next · Upgrade to 16.2.11 or later · >= 16.0.0, < 16.2.11 · CVE-2026-64642 · GHSA-6gpp-xcg3-4w24 · amended
- High, CVSS 8.2
Next.js: Denial of Service in App Router using Server Actions
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64641 · GHSA-m99w-x7hq-7vfj · amended
- High, CVSS 7.5
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Maven org.eclipse.jetty:jetty-server · Upgrade to 11.0.23 or 10.0.23 by release line · >= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23 · CVE-2024-7708 · GHSA-9299-c6m4-mjhc
- Medium, CVSS 5.3
Eclipse Jetty: Path parameter traversal
Maven org.eclipse.jetty:jetty-util · Upgrade to 12.1.9 or 12.0.35 by release line · >= 12.0.0, <= 12.0.34; >= 12.1.0, <= 12.1.8 · CVE-2026-8384 · GHSA-w7x5-g22v-xqhr
- Medium, CVSS 5.3
Eclipse Jetty: HTTP Authority/Host mismatch
Maven org.eclipse.jetty:jetty-server · Upgrade to 12.1.9 or 12.0.35 by release line; some affected versions have no fix yet · >= 9.4.0.v20161208, <= 9.4.58.v20250814; >= 10.0.0, <= 10.0.26; >= 11.0.0, <= 11.0.26; >= 12.0.0, <= 12.0.34; >= 12.1.0, <= 12.1.8 · CVE-2026-6790 · GHSA-7p3p-8qv8-m2vh
- Medium, CVSS 6.9
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
Maven org.eclipse.jetty:jetty-server · Upgrade to 12.1.10 or 12.0.36 by release line · >= 12.0.0, <= 12.0.35; >= 12.1.0, <= 12.1.9 · CVE-2026-10051 · GHSA-f4v5-65jj-pcr2
- High, CVSS 8.7
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
Maven org.eclipse.jetty.ee9:jetty-ee9-security · Upgrade to 12.1.10 or 12.0.36 by release line · >= 12.0.0, <= 12.0.35; >= 12.1.0, <= 12.1.9 · +2 more packages · CVE-2026-10050 · GHSA-2fvj-hgj9-j2gr
- Medium, CVSS 5.1
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65589 · GHSA-89gh-3pgc-v5h2 · amended
- Medium, CVSS 6.3
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-59943 · GHSA-j8qw-6jw8-r297
- Medium, CVSS 6.3
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-59942 · GHSA-f5gf-2cj8-52g2
- Medium, CVSS 6.3
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-59941 · GHSA-8hg6-c449-896m
- Low, CVSS 2.1
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
PyPI litellm · Upgrade to 1.82.0 or later · < 1.82.0 · CVE-2026-59821 · GHSA-72m8-9m7m-h278 · amended
- High, CVSS 8.8Exploited · CISA KEV
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
PyPI litellm · Upgrade to 1.84.0 or later · < 1.84.0 · CVE-2026-59822 · GHSA-7488-6r32-c95q · amended
- Low, CVSS 2.1
LiteLLM: Local file read via request-supplied OIDC file references
PyPI litellm · Upgrade to 1.83.10 or later · < 1.83.10 · CVE-2026-59819 · GHSA-4g5m-c9r5-49xf · amended
- Medium, CVSS 6.1
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
PyPI litellm · Upgrade to 1.83.7 or later · < 1.83.7 · CVE-2026-59820 · GHSA-5jmr-gcrj-2c9q · amended
- Medium, CVSS 6.3
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
npm n8n · Upgrade to 2.27.4 or later · < 2.27.4 · CVE-2026-65014 · GHSA-33q9-f52j-gc75 · amended
- Medium, CVSS 5.1
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0, < 2.29.8 · CVE-2026-65596 · GHSA-gq66-9cw5-j5jm · amended
- Medium, CVSS 5.1
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
npm n8n · Upgrade to 2.30.1 or 2.29.8 by release line · >= 2.30.0, < 2.30.1; < 2.29.8 · CVE-2026-65594 · GHSA-q5xf-xhwf-cwqf · amended
- Medium, CVSS 5.5
n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows
npm n8n · Upgrade to 2.30.1 or 2.29.8 by release line · >= 2.30.0, < 2.30.1; < 2.29.8 · CVE-2026-65590 · GHSA-fpg6-x68q-5793 · amended
- Medium, CVSS 5.3
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
npm n8n · Upgrade to 2.28.0 or 1.123.58 by release line · >= 2.0.0, < 2.28.0; < 1.123.58 · CVE-2026-58661 · GHSA-w867-jm58-p9pv · amended
- Medium, CVSS 5.3
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects
npm n8n · Upgrade to 2.28.0 or later · < 2.28.0 · CVE-2026-59253 · GHSA-2xgm-wc4g-5jvg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.