Medium, CVSS 4.8
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
Go github.com/go-chi/chi/v5 · Upgrade to 5.4.0 or later · <= 5.3.2 · CVE-2026-114437 · GHSA-j6qf-3m9c-vwj3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
576–600 of 30,910 matching · newest first
- Medium, CVSS 6.1
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
npm odf-kit · Upgrade to 0.14.2 or later · >= 0.9.8, < 0.14.2 · GHSA-2rqm-h6hv-g79v · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for repeated references to the same missing object
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115572 · GHSA-6c7f-9265-g8fw · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115585 · GHSA-jr96-gvgh-j3r4 · amended
- High, CVSS 7.1
pypdf: Possible long runtimes for large xref table header limits
PyPI pypdf · Upgrade to 6.21.2 or later · < 6.21.2 · CVE-2026-115580 · GHSA-gmh7-3g9r-mjh5 · amended
- Medium, CVSS 5.8
Tokio: Race condition in
tokio::time::Intervalcrates.io tokio · Upgrade to 1.54.1 or later · >= 1.54.0, <= 1.54.0 · CVE-2026-115567 · GHSA-5wjr-9356-4wc8 · amended
- High, CVSS 7.4
Electron: Mitigation for compromised eMudhra intermediate certificates
npm electron · Upgrade to 45.0.0-beta.6 (pre-release), 44.9.1, 43.8.1 or 42.11.16 by release line · >= 45.0.0-alpha.1, < 45.0.0-beta.6; >= 44.0.0-alpha.1, < 44.9.1; >= 43.0.0-alpha.1, < 43.8.1; < 42.11.16 · CVE-2026-115570 · GHSA-jr5w-w6x2-84p9 · amended
- High, CVSS 7.5
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
npm body-parser · Upgrade to 2.4.0 or 1.20.9 by release line · >= 2.0.0, < 2.4.0; < 1.20.9 · CVE-2026-111181 · GHSA-27r3-jxmh-p828 · amended
- High, CVSS 7.3
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
crates.io gix · Upgrade to 0.90.0 or later · >= 0.88.0, <= 0.89.0 · GHSA-q54r-jf2p-rfr2 · amended
- Medium, CVSS 6.5
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Packagist livewire/livewire · Upgrade to 4.4.8 or later · >= 4.3.0, < 4.4.8 · GHSA-mhf7-xp6r-6qrc · amended
- Medium, CVSS 5.3
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Go github.com/labstack/echo/v5 · Upgrade to 5.4.1 or later · >= 5.0.0, < 5.4.1 · CVE-2026-118265 · GHSA-h53f-rm2w-w7rg · amended
- High, CVSS 8.2
Echo: WebSocket proxy can retain connections and handlers after client disconnect
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.15.0, < 4.16.1 · +1 more package · CVE-2026-118262 · GHSA-9969-6676-49h5 · amended
- High, CVSS 8.2
Echo: Decompress permits unbounded gzip expansion in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118261 · GHSA-h7wr-284f-5qvc · amended
- Critical, CVSS 9.1
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · +1 more package · CVE-2026-118264 · GHSA-cxf3-9h37-7rr8 · amended
- Medium, CVSS 6.3
Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
Go github.com/labstack/echo/v5 · Upgrade to 5.4.1 or later · >= 5.0.0, < 5.4.1 · CVE-2026-118263 · GHSA-x9ff-22gv-65f4 · amended
- High, CVSS 8.2
Echo: BodyDump captures request and response bodies without size limits in v4
Go github.com/labstack/echo/v4 · Upgrade to 4.16.1 or later · >= 4.0.0, < 4.16.1 · CVE-2026-118260 · GHSA-f48p-c9v4-h7xv · amended
- High, CVSS 8.6
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
npm @strands-agents/sdk · Upgrade to 1.5.0 or later · < 1.5.0 · +1 more package · CVE-2026-115419 · GHSA-4v6f-7vjh-6x4m · amended
- High, CVSS 7.1
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
PyPI virtualenv +1 · Upgrade all 2 to 21.14.13 or later · >= 21.14.9, < 21.14.13 · CVE-2026-115586 · GHSA-cx6f-vjhg-g3cc · amended
- Unrated
Mistune: Path Traversal and XSS in Include directive
PyPI mistune · Upgrade to 3.3.0 or later · <= 3.2.0 · CVE-2026-115355 · GHSA-h7ww-273w-6cm8 · amended
- Medium, CVSS 4.9
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115774 · GHSA-2qrf-pqgx-qh9v · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115776 · GHSA-53xc-49m8-p798 · amended
- High, CVSS 7.5
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115778 · GHSA-cwm5-jh59-mwxr · amended
- High, CVSS 8.7
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115775 · GHSA-3476-c5c2-fr73 · amended
- Medium, CVSS 5.4
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
PyPI twisted · Upgrade to 26.10.0rc1 (pre-release) or later · <= 26.4.0 · CVE-2026-115877 · GHSA-q7qq-6mhp-9rc4 · amended
- Medium, CVSS 6.5
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
PyPI vllm · Upgrade to 0.31.0 or later · < 0.31.0 · CVE-2026-114050 · GHSA-p92p-rxj5-7p2x · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.