Low, CVSS 3.1
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
npm react-router · Upgrade to 7.15.1 or later · >= 7.12.0, < 7.15.1 · +1 more package · CVE-2026-53663 · GHSA-84g9-w2xq-vcv6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 965 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5276–5300 of 30,970 matching · newest first
- Critical, CVSS 9.8
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
npm @vitest/browser · Upgrade to 5.0.0-beta.4 (pre-release), 4.1.8 or 3.2.5 by release line · >= 5.0.0-beta.0, <= 5.0.0-beta.3; >= 4.0.0, <= 4.1.7; >= 3.0.0, <= 3.2.4 · +1 more package · CVE-2026-53633 · GHSA-g8mr-85jm-7xhm · amended
- Low, CVSS 2.0
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside content when using DOM output modes
npm dompurify · Upgrade to 3.4.8 or later · >= 3.0.0, <= 3.4.7 · CVE-2026-65900 · GHSA-gvmj-g25r-r7wr · amended
- Medium, CVSS 5.1
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content
npm dompurify · Upgrade to 3.4.7 or later · <= 3.4.6 · CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq · amended
- Medium, CVSS 6.1
DOMPurify: Hook mutation of
data.allowedTags/data.allowedAttributespermanently pollutesDEFAULT_ALLOWED_TAGS/DEFAULT_ALLOWED_ATTRnpm dompurify · Upgrade to 3.4.7 or later · < 3.4.7 · CVE-2026-65902 · GHSA-76mc-f452-cxcm · amended
- Medium, CVSS 6.1
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound
instanceofchecksnpm dompurify · Upgrade to 3.4.6 or later · <= 3.4.5 · CVE-2026-49458 · GHSA-hpcv-96wg-7vj8 · amended
- Medium, CVSS 6.1
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
npm dompurify · Upgrade to 3.4.6 or later · <= 3.4.5 · CVE-2026-49459 · GHSA-r47g-fvhr-h676 · amended
- Medium, CVSS 5.3
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
PyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.8.0, <= 2.12.1 · CVE-2026-48525 · GHSA-w7vc-732c-9m39 · amended
- Medium, CVSS 4.2
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
PyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.0.0, <= 2.12.1 · CVE-2026-48522 · GHSA-993g-76c3-p5m4 · amended
- High, CVSS 7.4
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
PyPI pyjwt · Upgrade to 2.13.0 or later · < 2.13.0 · CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx · amended
- Medium, CVSS 5.4
PyJWT: Algorithm allow-list bypass when decoding with
PyJWK/PyJWKClientkeysPyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.9.0, < 2.13.0 · CVE-2026-48523 · GHSA-jq35-7prp-9v3f · amended
- Medium, CVSS 5.4
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
npm nodemailer · Upgrade to 8.0.9 or later · <= 8.0.8 · CVE-2026-82661 · GHSA-268h-hp4c-crq3 · amended
- Medium, CVSS 5.4
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
npm nodemailer · Upgrade to 8.0.9 or later · <= 8.0.8 · CVE-2026-82660 · GHSA-wqvq-jvpq-h66f · amended
- High, CVSS 8.3
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
npm nodemailer · Upgrade to 8.0.8 or later · <= 8.0.7 · CVE-2026-82662 · GHSA-r7g4-qg5f-qqm2 · amended
- Medium, CVSS 6.9
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained
../or./→ Generated URL Collapses Off-Route Under RFC 3986 NormalizationPackagist symfony/symfony +1 · Upgrade all 2 to 8.0.13, 7.4.13, 6.4.41 or 5.4.53 by release line · < 5.4.53; >= 6.0.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48784 · GHSA-h5x3-xfc9-m39h
- Unrated
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.13, 7.4.13 or 6.4.41 by release line · >= 6.1.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48760 · GHSA-v3wm-qf9p-c549
- Unrated
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.13 or 7.4.13 by release line · >= 7.2.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48747 · GHSA-rrj9-5q2j-4gvr
- Medium, CVSS 6.3
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
Packagist symfony/symfony · Upgrade to 8.0.13, 7.4.13, 6.4.41 or 5.4.53 by release line · >= 5.4.0, < 5.4.53; >= 6.4.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · +2 more packages · CVE-2026-48736 · GHSA-38cx-cq6f-5755
- High, CVSS 7.5
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
npm protobufjs · Upgrade to 8.4.1 or 7.6.1 by release line · <= 7.6.0; >= 8.0.0, <= 8.4.0 · CVE-2026-48712 · GHSA-wcpc-wj8m-hjx6 · amended
- Low, CVSS 3.7
PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
PyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.0.0, <= 2.12.1 · CVE-2026-48524 · GHSA-fhv5-28vv-h8m8 · amended
- Unrated
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.13, 7.4.13, 6.4.41 or 5.4.53 by release line · < 5.4.53; >= 6.0.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48489 · GHSA-6h46-9jf5-q59x
- Medium, CVSS 5.3
protobufjs : Schema-derived names can shadow runtime-significant properties
npm protobufjs · Upgrade to 8.6.0 or 7.6.3 by release line · <= 7.6.2; >= 8.0.0, <= 8.5.0 · +1 more package · CVE-2026-54269 · GHSA-f38q-mgvj-vph7 · amended
- High, CVSS 8.7
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
npm form-data · Upgrade to 4.0.6, 3.0.5 or 2.5.6 by release line · < 2.5.6; >= 3.0.0, < 3.0.5; >= 4.0.0, < 4.0.6 · CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx · amended
- High, CVSS 8.3
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
npm @angular/service-worker · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54264 · GHSA-qxh6-94w6-9r5p · amended
- High, CVSS 8.2
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
npm @angular/common · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54268 · GHSA-48r7-hpm6-gfxm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.