Medium, CVSS 4.8
protobufjs: Text Format string map parsing can mutate returned map object prototype
npm protobufjs · Upgrade to 8.6.5 or later · >= 8.2.0, <= 8.6.4 · CVE-2026-59876 · GHSA-jfj6-75fj-8934 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 946 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3676–3700 of 30,922 matching · newest first
- Medium, CVSS 5.3
protobufjs: Denial of Service via infinite loop in .proto option parsing
npm protobufjs · Upgrade to 8.6.6 or 7.6.5 by release line · >= 7.5.0, <= 7.6.4; >= 8.0.0, <= 8.6.5 · CVE-2026-59877 · GHSA-j3f2-48v5-ccww · amended
- Medium, CVSS 5.3
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
npm webpack-dev-server · Upgrade to 5.2.6 or later · <= 5.2.5 · CVE-2026-14631 · GHSA-m28w-2pqf-7qgj · amended
- Medium, CVSS 4.7
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
npm webpack-dev-server · Upgrade to 5.2.6 or later · <= 5.2.5 · CVE-2026-14620 · GHSA-f5vj-f2hx-8m93 · amended
- Medium, CVSS 4.7
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Packagist guzzlehttp/guzzle · Upgrade to 7.12.3 or later · < 7.12.3 · CVE-2026-59883 · GHSA-g446-98w2-8p5w
- High, CVSS 8.2
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
npm astro · Upgrade to 6.4.8 or later · >= 6.4.7, < 6.4.8 · CVE-2026-59731 · GHSA-vj59-8hwv-xxmv · amended
- Medium, CVSS 6.1
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Packagist composer/composer · Upgrade to 2.10.2 or 2.2.29 by release line · >= 2.3.0, < 2.10.2; >= 1.0.0, < 2.2.29 · CVE-2026-59946 · GHSA-gjfg-22fp-rrxx
- Medium, CVSS 4.7
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Packagist composer/composer · Upgrade to 2.10.2 or 2.2.29 by release line · >= 2.3.0, < 2.10.2; >= 1.0.0, < 2.2.29 · CVE-2026-59947 · GHSA-g6xq-892h-64w3
- Medium, CVSS 5.3
node-tar: Process crash via PAX numeric path type confusion
npm tar · Upgrade to 7.5.18 or later · <= 7.5.17 · CVE-2026-59871 · GHSA-w8wr-v893-vjvp · amended
- Critical, CVSS 9.2
node-tar: Decompression/parse DoS via unlimited input
npm tar · Upgrade to 7.5.19 or later · <= 7.5.18 · CVE-2026-59873 · GHSA-23hp-3jrh-7fpw · amended
- High, CVSS 8.7
node-tar: Negative tar entry size causes infinite loop in archive replace
npm tar · Upgrade to 7.5.18 or later · <= 7.5.17 · CVE-2026-59874 · GHSA-8x88-c5mf-7j5w · amended
- Medium, CVSS 5.3
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
npm tar · Upgrade to 7.5.17 or later · <= 7.5.16 · CVE-2026-59875 · GHSA-gvwx-54wh-qm9j · amended
- High, CVSS 7.5
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
npm engine.io · Upgrade to 6.6.7 or later · >= 4.1.0, < 6.6.7 · CVE-2026-59725 · GHSA-r635-g3xr-vw7x · amended
- High, CVSS 8.7
shell-quote: Quadratic-complexity Denial of Service in
parse()(CWE-407)npm shell-quote · Upgrade to 1.9.0 or later · <= 1.8.4 · CVE-2026-13311 · GHSA-395f-4hp3-45gv · amended
- High, CVSS 8.6
Directus: Authorization-dependent response served from unsegmented cache key
npm directus · Upgrade to 12.0.0 or later · < 12.0.0 · CVE-2026-61836 · GHSA-c6w9-5g5j-jh2p · amended
- High, CVSS 7.7
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
npm directus · Upgrade to 12.0.0 or later · < 12.0.0 · CVE-2026-61835 · GHSA-j5h6-vqc3-phqh · amended
- Critical, CVSS 9.3
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
PyPI lightrag-hku · Upgrade to 1.5.4 or later · < 1.5.4 · CVE-2026-61740 · GHSA-f4vv-55c2-5789 · amended
- Medium, CVSS 5.3
Guzzle: Proxy-Authorization headers can be sent to origin servers
Packagist guzzlehttp/guzzle · Upgrade to 7.14.2 or later · < 7.14.2 · CVE-2026-67339 · GHSA-94pj-82f3-465w
- Critical, CVSS 9.3
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
PyPI lightrag-hku · Upgrade to 1.5.4 or later · <= 1.5.3 · CVE-2026-61736 · GHSA-6x6h-qqr7-855w · amended
- Medium, CVSS 6.1
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to
javascript:executionPyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59929 · GHSA-qfrw-5rxm-mhh2 · amended
- Medium, CVSS 4.3
Mistune toc / TableOfContents directive: heading IDs use predictable
toc_Nnumbering with no slugification, allowing collision with attacker-controlledid="toc_N"contentPyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59930 · GHSA-2hm2-hc3v-44h9 · amended
- Medium, CVSS 5.9
Mistune: Arbitrary File Read via Include directive path traversal
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59924 · GHSA-r4rv-85jg-w4mf · amended
- High, CVSS 7.5
Mistune plugins/formatting: quadratic-time parsing on long runs of
~~x~~,==x==, and^^x^^markers (strikethrough / mark / insert)PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59922 · GHSA-c8j7-8cv4-2xmq · amended
- Medium, CVSS 5.3
Mistune: XSS via unescaped class option in Admonition directive
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59926 · GHSA-g97x-gvcm-x72h · amended
- Medium, CVSS 6.1
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59923 · GHSA-8c25-4j27-2rv3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.