Medium, CVSS 5.3
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
npm nodemailer · Upgrade to 10.0.13 or later · >= 3.0.0, < 10.0.13 · CVE-2026-110870 · GHSA-g73g-hqqh-jr95 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
501–525 of 30,910 matching · newest first
- Medium, CVSS 5.9
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
npm nodemailer · Upgrade to 10.0.10 or later · >= 3.0.0, < 10.0.10 · CVE-2026-110872 · GHSA-4g23-2xm8-66gc · amended
- High, CVSS 7.7
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
PyPI litellm · Upgrade to 1.104.0rc2 (pre-release), 1.103.1, 1.102.2 or 2 more by release line · >= 1.91.0, < 1.100.4; >= 1.101.0, < 1.101.3; >= 1.102.0, < 1.102.2; >= 1.103.0, < 1.103.1; >= 1.104.0rc1, < 1.104.0rc2 · CVE-2026-114612 · GHSA-7hp6-4w63-5g45 · amended
- High, CVSS 7.5
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
PyPI msgpack · Upgrade to 1.2.3 or later · < 1.2.3 · CVE-2026-114613 · GHSA-j586-36cw-2gc2 · amended
- High, CVSS 8.6
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-109956 · GHSA-j456-xh4h-cpf2 · amended
- Critical, CVSS 9.1
Authlib: empty signatures validation in JWS JSON deserialization
PyPI authlib · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-96760 · GHSA-6v38-4h7w-rj9h · amended
- High, CVSS 8.1
better-auth: Device login approval does not show the requesting client or permissions
npm better-auth · Upgrade to 1.7.0-rc.3 (pre-release) or later · >= 1.3.8-beta.3, < 1.7.0-rc.3 · CVE-2026-109346 · GHSA-q84f-53jg-9ppm · amended
- Medium, CVSS 5.4
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
PyPI pylint · Upgrade to 4.0.9 or later · < 4.0.9 · CVE-2026-114608 · GHSA-22qq-2fwx-7p67 · amended
- Medium, CVSS 5.3
Satori-generated SVG has improper escaping
npm satori · Upgrade to 0.33.5 or later · >= 0.0.27, < 0.33.5 · CVE-2026-94545 · GHSA-wx4j-mvgx-mqwp · amended
- High, CVSS 8.7
vllm p2p never connected zmq_exhaustion
PyPI vllm · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-94624 · GHSA-frvg-qw88-hww9 · amended
- High, CVSS 8.6
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
PyPI rembg · Upgrade to 2.0.82 or later · < 2.0.82 · CVE-2026-115924 · GHSA-qr6x-7v33-6qmg · amended
- Low, CVSS 3.1
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · < 26.10.0rc1 · CVE-2026-83813 · GHSA-jj36-9pvh-vj5r · amended
- Medium, CVSS 6.5
Ghost: Authorization Bypass in Comment Like Feature
npm ghost · Upgrade to 6.44.1 or later · >= 5.9.0, < 6.44.1 · CVE-2026-103288 · GHSA-qrh6-cwg3-343x · amended
- Medium, CVSS 4.9
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260808051406-3542530c505f (pre-release) or later · < 0.0.0-20260808051406-3542530c505f · CVE-2026-60083 · GHSA-c8r8-95hg-mp34 · amended
- Medium, CVSS 6.5
fpdf2: Exponential SVG ' ' expansion causes CPU and memory exhaustion in 'FPDF.image()'
PyPI fpdf2 · Upgrade to 2.8.8 or later · >= 2.5.0, < 2.8.8 · CVE-2026-114610 · GHSA-wqw6-wpr3-45rh · amended
- Medium, CVSS 5.8
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
PyPI fpdf2 · Upgrade to 2.8.8 or later · < 2.8.8 · CVE-2026-114609 · GHSA-rw7v-4hrq-x6r9 · amended
- High, CVSS 8.2
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation
Maven com.google.guava:guava · Upgrade to 33.7.2 or later · >= 4.0, < 33.7.2 · CVE-2026-102554 · GHSA-xxph-c9ww-hj94 · amended
- High, CVSS 8.5
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
PyPI oauthlib · Upgrade to 4.0.1 or later · >= 3.3.0, < 4.0.1 · CVE-2026-49272 · GHSA-3jp2-3mrg-2vxc · amended
- Critical, CVSS 9.3
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
PyPI monai · Upgrade to 1.6.1 or later · < 1.6.1 · CVE-2026-48705 · GHSA-6hp3-vr39-rqw8 · amended
- Unrated
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
npm dcmjs · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-46350 · GHSA-px68-xx5g-48q5 · amended
- High, CVSS 7.6
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Go github.com/wailsapp/wails/v2 · Upgrade to 2.13.0 or later · >= 2.0.0, < 2.13.0 · CVE-2026-34157 · GHSA-47hv-j4px-h3c9 · amended
- High, CVSS 8.8
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Packagist dolibarr/dolibarr · Upgrade to 23.0.2 or 22.0.5 by release line · < 22.0.5; >= 23.0.0, < 23.0.2 · CVE-2026-33944 · GHSA-v5fq-cf5m-vwv7 · amended
- High, CVSS 8.1
Ajenti has potential Remote Code Execution
PyPI aj · Upgrade to 2.2.13 or later · < 2.2.13 · CVE-2026-27975 · GHSA-vcw3-r3fx-j444 · amended
- Unrated
Use-after-free of caller-owned server name in client connection constructors
crates.io rustls-ffi · Upgrade to 0.15.7 or later · >= 0.12.0, < 0.15.7 · GHSA-rc3f-4j82-cmrg
- High, CVSS 7.8
Arbitrary code execution when rerunning tests from a portable recording
crates.io cargo-nextest · Upgrade to 0.9.150 or later · >= 0.9.125, < 0.9.150 · GHSA-vc25-qg58-w57c
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.