High, CVSS 7.1
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54007 · GHSA-3vv5-8xxp-4f55 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 965 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5126–5150 of 30,970 matching · newest first
- Medium, CVSS 4.3
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
PyPI open-webui · Upgrade to 0.9.6 or later · <= 0.9.5 · CVE-2026-54006 · GHSA-f3g7-59qc-pqg6 · amended
- Medium, CVSS 6.5
vLLM: OOM Denial of Service via Audio Decompression Bomb
PyPI vllm · Upgrade to 0.24.0 or later · <= 0.23.0 · CVE-2026-54233 · GHSA-6pr9-rp53-2pmc · amended
- Medium, CVSS 5.3
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
PyPI vllm · Upgrade to 0.24.0 or later · <= 0.23.0 · CVE-2026-54236 · GHSA-hgg8-fqqc-vfmw · amended
- Medium, CVSS 5.3
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.5.5, < 0.24.0 · CVE-2026-53923 · GHSA-5jv2-g5wq-cmr4 · amended
- Medium, CVSS 4.8
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.11.0, < 0.24.0 · CVE-2026-12491 · GHSA-8jr5-v98p-w75m · amended
- Medium, CVSS 6.9
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.8.5, <= 0.23.0 · CVE-2026-54235 · GHSA-7h4p-rffg-7823 · amended
- Medium, CVSS 6.1
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
npm chrome-devtools-mcp · Upgrade to 1.1.0 or later · >= 0.20.0, <= 1.0.1 · CVE-2026-53765 · GHSA-3pvj-jv98-qhjq · amended
- Medium, CVSS 5.3
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
npm n8n · Upgrade to 2.26.2, 2.25.7 or 1.123.55 by release line · < 1.123.55; >= 2.26.0, < 2.26.2; >= 2.0.0-rc.0, < 2.25.7 · CVE-2026-56775 · GHSA-664h-gpgq-h6xx · amended
- Medium, CVSS 4.4
Pi Agent: Pi loads project-local extensions without approval
npm @earendil-works/pi-coding-agent · Upgrade to 0.79.0 or later · < 0.79.0 · CVE-2026-54325 · GHSA-mqxh-6gq7-558m · amended
- Medium, CVSS 4.2
Laravel Framework: Temporary Signed URL Path Confusion
Packagist laravel/framework · Upgrade to 13.12.0 or 12.61.1 by release line · >= 13.0.0, < 13.12.0; < 12.61.1 · GHSA-crmm-hgp2-wgrp
- High, CVSS 8.9
Laravel Framework: CRLF injection in default email rule
Packagist laravel/framework · Upgrade to 13.10.0 or 12.60.0 by release line · >= 13.0.0, <= 13.9.0; < 12.60.0 · GHSA-5vg9-5847-vvmq
- Unrated
HTTP Response Queue Poisoning via TOCTOU Race Condition in
http.Agentruntime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48931
- Unrated
Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48930
- Unrated
Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48933
- Unrated
Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48618
- Unrated
Proxy credentials leaked in ERR_PROXY_TUNNEL error message
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48615
- Unrated
Permission Model bypass via FileHandle.utimes() in the promises API
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48935
- Unrated
Unbounded memory growth in
node:http2clients via attacker-controlled ORIGIN framesruntime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48619
- Unrated
Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)
runtime node · Upgrade to 26.3.1 or later · >= 26.0.0, < 26.3.1 · CVE-2026-48936
- Unrated
Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48928
- Unrated
TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections
runtime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48934
- Unrated
HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
runtime node · Upgrade to 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0 · CVE-2026-48937
- Unrated
Permission Model Bypass via
process.report.writeReport()Path Misvalidationruntime node · Upgrade to 26.3.1, 24.17.0 or 22.23.0 by release line · >= 22.0.0, < 22.23.0; >= 24.0.0, < 24.17.0; >= 26.0.0, < 26.3.1 · CVE-2026-48617
- Medium, CVSS 5.3
Gitea: Token scope bypass on web archive download endpoint
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · <= 1.26.1 · CVE-2026-20706 · GHSA-cr4g-f395-h25h
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.