High, CVSS 8.7
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
PyPI pillow · Upgrade to 12.3.0 or later · >= 8.2.0, < 12.3.0 · CVE-2026-59204 · GHSA-vjc4-5qp5-m44j · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 946 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3651–3675 of 30,922 matching · newest first
- Medium, CVSS 5.3
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
PyPI pillow · Upgrade to 12.3.0 or later · >= 12.0.0, < 12.3.0 · CVE-2026-59203 · GHSA-pg7v-jwj7-p798 · amended
- High, CVSS 7.5
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
PyPI pillow · Upgrade to 12.3.0 or later · >= 5.1.0, < 12.3.0 · CVE-2026-59200 · GHSA-jjj6-mw9f-p565 · amended
- High, CVSS 7.5
Pillow: Heap out-of-bounds write
Image.paste()/Image.crop()via signed coordinate overflowPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59199 · GHSA-6r8x-57c9-28j4 · amended
- Medium, CVSS 6.5
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
PyPI pillow · Upgrade to 12.3.0 or later · >= 5.2.0, < 12.3.0 · CVE-2026-59198 · GHSA-fj7v-r99m-22gq · amended
- High, CVSS 8.2
Pillow: Heap out-of-bounds write in
ImageFilter.RankFiltervia integer overflow inImagingExpandPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59197 · GHSA-xj96-63gp-2gmr · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50651 · GHSA-wp74-jgxh-gv4q · amended
- Medium, CVSS 6.5
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50659 · GHSA-74jp-vm22-8q8x
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50525 · GHSA-8q5v-6pqq-x66h
- High, CVSS 8.2
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50528 · GHSA-qvw7-jm5c-6hqw
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50648 · GHSA-23rf-6693-g89p
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50524 · GHSA-w7cw-xp7h-6j5j · amended
- High, CVSS 8.1
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-47304 · GHSA-g8r8-53c2-pm3f
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · +12 more packages · CVE-2026-47302 · GHSA-cvvh-rhrc-wg4q
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-57108 · GHSA-rp2p-6cmp-jxj9 · amended
- High, CVSS 8.3
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.31.1, < 0.33.0; >= 1.15.2, < 1.18.0 · CVE-2026-67320 · GHSA-gcfj-64vw-6mp9 · amended
- Medium, CVSS 6.9
Axios form serializer maxDepth bypass via {} metatoken
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.31.1, < 0.33.0; >= 1.15.1, < 1.18.0 · CVE-2026-67321 · GHSA-hcpx-6fm6-wx23 · amended
- Medium, CVSS 6.3
Axios: Nested axios option objects can consume polluted prototype values
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.8.0, < 0.33.0; >= 1.0.0, < 1.18.0 · CVE-2026-67319 · GHSA-7q8q-rj6j-mhjq · amended
- Medium, CVSS 6.3
Axios: HTTP/2 streamed uploads bypass
maxBodyLengthnpm axios · Upgrade to 1.18.0 or later · >= 1.13.0, < 1.18.0 · CVE-2026-67318 · GHSA-mwf2-3pr3-8698 · amended
- Medium, CVSS 6.3
Axios: Fetch adapter
ReadableStreamuploads bypassmaxBodyLengthnpm axios · Upgrade to 1.18.0 or later · >= 1.7.0, < 1.18.0 · CVE-2026-67317 · GHSA-jqh4-m9w3-8hp9 · amended
- Medium, CVSS 6.3
Axios: Prototype pollution gadgets can alter axios request construction
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 1.0.0, < 1.18.0; < 0.33.0 · CVE-2026-67316 · GHSA-mmx7-hfxf-jppx · amended
- Medium, CVSS 6.9
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 1.15.0, < 1.18.0; >= 0.31.0, < 0.33.0 · CVE-2026-67315 · GHSA-f4gw-2p7v-4548 · amended
- High, CVSS 8.1
File Browser: Colliding username normalization gives two users the same home directory
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · <= 2.63.16 · CVE-2026-62685 · GHSA-7rc3-g7h6-22m7
- Low, CVSS 2.7
File Browser: Share API exposes the password hash and bypass token
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · <= 2.63.16 · CVE-2026-62684 · GHSA-833g-cqhp-h72j
- Medium, CVSS 6.8
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · >= 2.63.6, <= 2.63.16 · CVE-2026-62843 · GHSA-83xp-526h-j3ww
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.