High, CVSS 7.1
Astro: Reflected XSS via unescaped slot name
npm astro · Upgrade to 6.3.3 or later · < 6.3.3 · CVE-2026-50146 · GHSA-8hv8-536x-4wqp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 965 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5226–5250 of 30,970 matching · newest first
- Medium, CVSS 5.1
Nuxt: Reflected XSS in
javascript:ordata:URLnpm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.0.0, < 3.21.7 · CVE-2026-53722 · GHSA-934w-87qh-qr26 · amended
- Medium, CVSS 5.5
Nuxt dev server vite-node IPC socket is world-connectable on Linux
npm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.18.0, < 3.21.7 · CVE-2026-56301 · GHSA-534h-c3cw-v3h9 · amended
- High, CVSS 8.8
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
npm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.11.0, < 3.21.7 · CVE-2026-53721 · GHSA-mm7m-92g8-7m47 · amended
- Medium, CVSS 5.1
Nuxt: URL-handling weaknesses in
navigateToandreloadNuxtApp: SSR open redirect, client-side script execution via theopenoption, and protocol-relative bypass inreloadNuxtAppnpm nuxt · Upgrade to 4.4.7 or 3.21.7 by release line · >= 4.0.0, < 4.4.7; >= 3.5.0, < 3.21.7 · CVE-2026-56326 · GHSA-c9cv-mq2m-ppp3 · amended
- Medium, CVSS 6.9
pypdf: Possible large memory usage for form XObjects during text extraction
PyPI pypdf · Upgrade to 6.12.2 or later · < 6.12.2 · CVE-2026-49461 · GHSA-j543-4vmf-qm7v · amended
- Medium, CVSS 5.1
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
PyPI pypdf · Upgrade to 6.12.2 or later · < 6.12.2 · CVE-2026-49460 · GHSA-5hgr-hg42-57jg · amended
- Medium, CVSS 6.9
pypdf: Manipulated XMP metadata streams can exhaust RAM
PyPI pypdf · Upgrade to 6.12.1 or later · < 6.12.1 · CVE-2026-48735 · GHSA-wjqc-6w8f-h24c · amended
- High, CVSS 8.1
Koillection has an authenticated Server-Side Request Forgery issue
Packagist koillection/koillection · Upgrade to 1.8.4 or later · < 1.8.4 · CVE-2026-50888 · GHSA-gmxh-hjfv-qc2w
- High, CVSS 8.6
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
Maven org.springframework.ai:spring-ai-gemfire-store +2 · Upgrade all 3 to 1.1.8 or 1.0.9 by release line · >= 1.0.0, <= 1.0.8; >= 1.1.0, <= 1.1.7 · CVE-2026-47835 · GHSA-cmwh-w62w-r2mf
- Critical, CVSS 9.8
Remotion: remote code execution (RCE) vulnerability
npm remotion · Upgrade to 4.0.410 or later · < 4.0.410 · CVE-2026-30120 · GHSA-2jqp-f4gr-44fr · amended
- Critical, CVSS 9.1
Remotion: arbitrary file write vulnerability
npm remotion · Upgrade to 4.0.410 or later · < 4.0.410 · CVE-2026-30121 · GHSA-g6pc-6676-c23j · amended
- Low, CVSS 2.3
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via
/.well-known/appspecific/com.chrome.devtools.jsonnpm nuxt · Upgrade to 4.4.7 or later · >= 4.0.0-alpha.1, < 4.4.7 · GHSA-rq7w-g337-39qq · amended
- High, CVSS 7.0
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
npm aws-cdk-lib · Upgrade to 2.246.0 or later · < 2.246.0 · CVE-2026-11417 · GHSA-999r-qq7v-r334 · amended
- Medium, CVSS 6.9
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-50560 · GHSA-563q-j3cm-6jxm
- Medium, CVSS 5.3
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
Maven io.netty:netty-codec-http · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-50020 · GHSA-hvcg-qmg6-jm4c
- High, CVSS 7.5
Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-50011 · GHSA-5w86-c3rq-vjj7
- High, CVSS 7.5
Netty: Wrapping plain trust manager silently disables hostname verification
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, < 4.2.15.Final; <= 4.1.134.Final · CVE-2026-50010 · GHSA-c653-97m9-rcg9
- Medium, CVSS 4.8
Netty: QUIC stateless reset token material exposed through header-visible connection IDs
Maven io.netty:netty-codec-classes-quic · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-50009 · GHSA-cq4q-cv5g-r8q5
- High, CVSS 7.5
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-48748 · GHSA-4grm-h2qv-h6w6
- Medium, CVSS 5.3
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
npm markdown-it · Upgrade to 14.2.0 or later · <= 14.1.1 · CVE-2026-48988 · GHSA-6v5v-wf23-fmfq · amended
- High, CVSS 7.5
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
PyPI starlette · Upgrade to 1.3.1 or later · >= 0.4.1, < 1.3.1 · CVE-2026-54283 · GHSA-82w8-qh3p-5jfq · amended
- Medium, CVSS 5.3
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
npm @opentelemetry/core · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-54285 · GHSA-8988-4f7v-96qf · amended
- Low, CVSS 3.7
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
PyPI starlette · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-54282 · GHSA-jp82-jpqv-5vv3 · amended
- Medium, CVSS 5.9
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
PyPI tornado · Upgrade to 6.5.7 or later · <= 6.5.6 · CVE-2026-91992 · GHSA-pw6j-qg29-8w7f · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.