High, CVSS 8.2
follow-redirects sensitiveHeaders regex escaping can expose credential headers
npm follow-redirects · Upgrade to 1.16.1 or later · >= 1.16.0, < 1.16.1 · CVE-2026-111755 · GHSA-8r9p-f939-6h3c · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
npm @angular/router · Upgrade to 22.2.1 or 21.2.25 by release line · >= 22.0.0, < 22.2.1; >= 21.2.0, < 21.2.25 · CVE-2026-111751 · GHSA-57xq-rjx2-v5xh · amended
- High, CVSS 8.2
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
npm @angular/router · Upgrade to 22.2.1, 21.2.25 or 20.3.33 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.2.1; >= 21.0.0, < 21.2.25; >= 20.0.0, < 20.3.33; <= 19.2.25 · CVE-2026-111752 · GHSA-62vg-58rm-qff7 · amended
- High, CVSS 7.5
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
npm markdown-it · Upgrade to 15.0.2 or 14.3.2 by release line · >= 15.0.0, < 15.0.2; < 14.3.2 · CVE-2026-111759 · GHSA-r7fv-28h4-cvq7 · amended
- High, CVSS 7.5
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
Go github.com/klauspost/compress · Upgrade to 1.18.7 or later · <= 1.18.6 · CVE-2026-63209 · GHSA-259r-337f-4rfw · amended
- High, CVSS 8.9
Crass : Large numeric exponents cause CPU and memory denial of service
RubyGems crass · Upgrade to 1.0.7 or later · < 1.0.7 · CVE-2026-61845 · GHSA-6wmf-3r64-vcwv · amended
- High, CVSS 7.0
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
crates.io pingora-proxy · Upgrade to 0.9.0 or later · >= 0.0.0-0, < 0.9.0 · CVE-2026-105299 · GHSA-vx4q-2c55-cvmg
- High, CVSS 7.5
Unbounded tool schema cache in Streamable HTTP server transport
crates.io rmcp · Upgrade to 3.6.0 or later · >= 3.0.0, < 3.6.0 · GHSA-4432-vg92-fqh6
- High, CVSS 8.7
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
crates.io pingora-core · Upgrade to 0.8.1 or later · >= 0.0.0-0, < 0.8.1 · CVE-2026-105297 · GHSA-7gpj-mj4q-x62x
- High, CVSS 7.1
Nginx UI: Casdoor SSO callback uses a constant
stateparameter (login CSRF)Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84312 · GHSA-44xr-mrhh-qm78 · amended
- High, CVSS 8.8
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84313 · GHSA-gfrc-g87h-7h5w · amended
- High, CVSS 8.2
aiohttp server lacks an initial request/header timeout
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111064 · GHSA-5wr8-gcqf-gqf3 · amended
- High, CVSS 8.7
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
PyPI aiohttp · Upgrade to 3.14.4 or later · < 3.14.4 · CVE-2026-123817 · GHSA-2g87-pp6c-29x5 · amended
- Critical, CVSS 10.0
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
PyPI mercury · Upgrade to 3.2.4 or later · >= 3.0.0, <= 3.2.3 · CVE-2026-111057 · GHSA-f8c7-rwf9-fmgm · amended
- Critical, CVSS 9.8
Mercury: Unauthenticated Remote Code Execution via /api/kernels
PyPI mercury · Upgrade to 3.2.6 or later · <= 3.2.5 · CVE-2026-111058 · GHSA-rv4m-xm3f-3ccq · amended
- High, CVSS 7.1
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
PyPI loopx · Upgrade to 0.4.5 or later · >= 0.0.1, < 0.4.5 · CVE-2026-108372 · GHSA-vx2m-gpq4-8j5q · amended
- Critical, CVSS 9.9
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
crates.io wasmtime · Upgrade to 43.0.0 or 36.0.19 by release line · < 36.0.19; >= 37.0.0, < 43.0.0 · CVE-2026-115889 · GHSA-897f-g5gm-fmxm · amended
- High, CVSS 7.8
Use-after-free in KV backends via leaked
affinitypool::spawn_localfuturecrates.io surrealdb · Upgrade to 3.3.0 or later · >= 0.0.0-0, < 3.3.0 · CVE-2026-121417 · GHSA-pm86-cc75-q463
- Critical, CVSS 9.9
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm
br_tableinstructioncrates.io wasmtime · Upgrade to 49.0.4, 48.0.7 or 36.0.19 by release line · < 36.0.19; >= 37.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 · CVE-2026-115893 · GHSA-mghf-wjfp-p5xm · amended
- High, CVSS 7.5
Exponential event growth with
ENABLE_WIKILINKScrates.io pulldown-cmark · Upgrade to 0.13.5 or later · >= 0.13.0, < 0.13.5
- Critical, CVSS 9.8
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
PyPI lmcache · Upgrade to 0.5.6 or later · >= 0.3.9, < 0.5.6 · CVE-2026-105192 · GHSA-w5f2-9q9c-ff4h · amended
- High, CVSS 8.2
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
Go github.com/getkin/kin-openapi · Upgrade to 0.146.0 or later · < 0.146.0 · CVE-2026-100349 · GHSA-74vm-87hj-r66f · amended
- High, CVSS 7.5
lopdf has a stack overflow via deeply nested PDF objects
crates.io lopdf · Upgrade to 0.42.0 or later · < 0.42.0 · GHSA-6fj4-rcr3-r7rr · amended
- High, CVSS 7.5
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
Maven org.bytedeco:javacv · Upgrade to 1.5.14 or later · < 1.5.14 · CVE-2026-102834 · GHSA-rxjv-24xq-76wc · amended
- Critical, CVSS 9.2
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
PyPI claude-agent-sdk · Upgrade to 0.2.121 or later · < 0.2.121 · CVE-2026-96620 · GHSA-h4mw-j7qp-8mwm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.