High, CVSS 8.7
compress zstd: Panic on two-block frames
Go github.com/klauspost/compress +1 · Upgrade all 2 to 1.20.2 or later · < 1.20.2 · CVE-2026-116591 · GHSA-fpmh-frq8-7rj8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
476–500 of 30,910 matching · newest first
- Low, CVSS 2.6
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
PyPI authlib · Upgrade to 1.8.0 or later · < 1.8.0 · CVE-2026-114614 · GHSA-jj7h-c3hg-m23x · amended
- High, CVSS 7.5
dnspython dns.name.from_wire_parser() excessive CPU use
PyPI dnspython · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2026-114605 · GHSA-45c3-73f7-pv4m · amended
- High, CVSS 8.7
Datadog dd-trace-py: ReDoS in URL query string obfuscation
PyPI ddtrace · Upgrade to 4.15.6 or 3.19.9 by release line · >= 1.5.0, < 3.19.9; >= 4.0.0, < 4.15.6 · CVE-2026-116588 · GHSA-3633-r77q-h3v3 · amended
- High, CVSS 8.2
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
PyPI ddtrace · Upgrade to 4.15.5 or later · >= 3.13.0, < 4.15.5 · CVE-2026-116589 · GHSA-p3m5-h5v9-vqj6 · amended
- High, CVSS 8.2
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
PyPI pymongo · Upgrade to 4.18.3 or later · >= 3.9.0, < 4.18.3 · CVE-2026-106435 · GHSA-98qm-wvgf-w4cf · amended
- High, CVSS 8.1
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
PyPI vllm · Upgrade to 0.31.0 or later · >= 0.7.3, < 0.31.0 · CVE-2026-114053 · GHSA-h3rc-6mm3-gc2m · amended
- High, CVSS 7.1
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
PyPI strands-agents · Upgrade to 1.48.0 or later · < 1.48.0 · GHSA-3w55-933p-8pv5 · amended
- Medium, CVSS 5.7
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
PyPI strands-agents · Upgrade to 1.48.0 or later · < 1.48.0 · GHSA-763v-5pjm-fx36 · amended
- High, CVSS 7.5
snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
Maven org.xerial.snappy:snappy-java · Upgrade to 1.1.10.9 or later · < 1.1.10.9 · CVE-2026-93451 · GHSA-gwq9-9ffj-mvrv · amended
- Medium, CVSS 5.9
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
Maven org.xerial.snappy:snappy-java · Upgrade to 1.1.10.9 or later · < 1.1.10.9 · CVE-2026-116590 · GHSA-xqrx-qh46-34m7 · amended
- High, CVSS 7.5
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
Maven org.xerial.snappy:snappy-java · Upgrade to 1.1.10.9 or later · < 1.1.10.9 · CVE-2026-108106 · GHSA-q233-g92q-qxp6 · amended
- High, CVSS 7.1
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
PyPI flexible-graphrag · Upgrade to 0.8.2 or later · >= 0.6.0, < 0.8.2 · CVE-2026-114510 · GHSA-vqrg-773h-4wxc · amended
- High, CVSS 8.1
LiteLLM: internal_user_viewer arbitrary local file read via
vertex_ai_credentialsPyPI litellm · Upgrade to 1.95.0 or later · < 1.95.0 · GHSA-g5ff-637f-6q2m · amended
- Low, CVSS 3.7
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
npm @better-auth/drizzle-adapter · Upgrade to 1.7.7 or later · >= 1.6.17, < 1.7.7 · +2 more packages · CVE-2026-110861 · GHSA-44jh-23m7-hpcf · amended
- High, CVSS 7.4
better-auth: OAuth Proxy lets an attacker sign in as another user
npm better-auth · Upgrade to 1.7.7 or later · >= 1.5.0-beta.12, < 1.7.7 · CVE-2026-110864 · GHSA-r4xp-prcw-77qf · amended
- Critical, CVSS 9.1
better-auth: OAuth state can be used as a Magic Link to sign in as another user
npm better-auth · Upgrade to 1.7.7 or later · >= 1.4.0-beta.18, < 1.7.7 · CVE-2026-114607 · GHSA-965c-763c-88jm · amended
- Medium, CVSS 6.8
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
PyPI litellm · Upgrade to 1.85.0 or later · >= 1.65.5, < 1.85.0 · GHSA-hhww-mrg2-969h · amended
- High, CVSS 7.1
GitPython: arbitrary file read via attacker-controlled branch name in
Head.checkout()(incomplete fix of CVE-2026-78679)PyPI gitpython · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-110859 · GHSA-23mf-xhv8-69c2 · amended
- Unrated
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
PyPI gitpython · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-110860 · GHSA-gq48-pqfc-9p58 · amended
- High, CVSS 8.1
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
PyPI gitpython · Upgrade to 3.2.0 or later · >= 3.1.30, < 3.2.0 · CVE-2026-110858 · GHSA-f9j4-qggq-h239 · amended
- High, CVSS 7.5
GitPython command wrappers omit unsafe protocol and option checks
PyPI gitpython · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-110857 · GHSA-w8jc-g24h-crhw · amended
- Medium, CVSS 6.5
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
PyPI gitpython · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-110855 · GHSA-fx3j-rwgx-fr94 · amended
- High, CVSS 8.7
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
PyPI gitpython · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-110856 · GHSA-m64x-33q8-m5h7 · amended
- Medium, CVSS 5.9
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
npm nodemailer · Upgrade to 10.0.13 or later · >= 3.0.0, < 10.0.13 · CVE-2026-110869 · GHSA-4ffr-jq9g-5ffx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.