High, CVSS 8.9
sharp : Vulnerability in librsvg dependency CVE-2026-96889
npm sharp · Upgrade to 0.35.5 or later · < 0.35.5 · CVE-2026-114111 · GHSA-wq5f-xc86-pv6w · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.2
shell-quote:
quote()command injection via a line terminator in a token after a{ comment }tokennpm shell-quote · Upgrade to 1.11.0 or later · >= 1.8.4, < 1.11.0 · CVE-2026-102422 · GHSA-pqg4-j6r4-53mv · amended
- Critical, CVSS 9.9
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
PyPI langflow · Upgrade to 1.10.1 or later · < 1.10.1 · CVE-2026-10561 · GHSA-8qpj-27x8-pwpq · amended
- Critical, CVSS 9.2
simple-git:
VISUALeditor environment variable is omitted from unsafe editor detectionnpm @simple-git/argv-parser · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2026-102829 · GHSA-v5rq-49vh-5v5c · amended
- Critical, CVSS 9.2
simple-git unsafe-operation guard does not block trailer command configuration
npm simple-git · Upgrade to 4.0.1 or later · >= 3.15.0, < 4.0.1 · CVE-2026-102828 · GHSA-x6jw-m9v5-85vh · amended
- High, CVSS 8.1
simple-git allows command execution through unblocked Git configuration includes
npm simple-git · Upgrade to 4.0.0 or later · <= 3.36.0 · CVE-2026-102826 · GHSA-g4wm-2vf7-vfgr · amended
- High, CVSS 8.1
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
npm simple-git · Upgrade to 4.0.0 or later · <= 3.36.0 · CVE-2026-102827 · GHSA-858h-whjf-mvg5 · amended
- High, CVSS 7.5
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
PyPI pymongo · Upgrade to 4.18.2 or later · < 4.18.2 · CVE-2026-96749 · GHSA-v4x9-3549-crwv · amended
- High, CVSS 8.3
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
PyPI pymongo · Upgrade to 4.18.2 or later · >= 3.5.0, <= 4.18.1 · CVE-2026-96748 · GHSA-vp6j-j7w5-5xjj · amended
- High, CVSS 7.5
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
npm @socket.io/cluster-engine · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-102600 · GHSA-wfpm-5gcm-94cg · amended
- Critical, CVSS 9.8
Seroval:
fromJSON()Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)npm seroval · Upgrade to 1.6.2 or later · >= 0.12.0, <= 1.6.0 · CVE-2026-104846 · GHSA-p6vx-979v-rg4c · amended
- High, CVSS 7.5
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
npm seroval · Upgrade to 1.6.3 or later · <= 1.6.2 · CVE-2026-104845 · GHSA-jp82-f5mq-hwhp · amended
- Critical, CVSS 9.1
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
npm proxy-addr · Upgrade to 2.0.8 or later · >= 1.1.0, < 2.0.8 · CVE-2026-90711 · GHSA-jqcg-44mw-7w3h · amended
- High, CVSS 7.3
@nx/docker: OS command injection in the @nx/docker release pipeline
npm @nx/docker · Upgrade to 23.1.1 or 22.7.8 by release line · >= 21.4.0, < 22.7.8; >= 23.0.0, < 23.1.1 · CVE-2026-104859 · GHSA-6vc5-vf29-ffr2 · amended
- High, CVSS 8.5
Nx: OS command injection via git revisions and remote refs
npm nx · Upgrade to 23.1.1 or 22.7.8 by release line · >= 14.0.0, < 22.7.8; >= 23.0.0, < 23.1.1 · GHSA-w2vw-w76x-qr89 · amended
- High, CVSS 8.5
Nx daemon and plugin worker sockets are accessible to other local users
npm nx · Upgrade to 23.1.2 or 22.7.9 by release line · >= 14.6.0, < 22.7.9; >= 23.0.0, < 23.1.2 · CVE-2026-104854 · GHSA-w3vv-58gj-gw77 · amended
- High, CVSS 7.5
compression vulnerable to Denial of Service via memory leak on premature response close
npm compression · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2026-87776 · GHSA-vc2v-76pw-4v95 · amended
- Critical, CVSS 9.5
vm2: NodeVM custom resolution bypasses external path boundaries
npm vm2 · Upgrade to 3.12.2 or later · <= 3.12.1 · CVE-2026-100721 · GHSA-5h3f-q97h-ccvc · amended
- High, CVSS 8.9
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
npm vm2 · Upgrade to 3.12.2 or later · <= 3.12.1 · CVE-2026-100722 · GHSA-2v2p-6j97-cjg9 · amended
- High, CVSS 7.4
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
npm @graphql-tools/executor-legacy-ws · Upgrade to 1.1.35 or later · <= 1.1.34 · CVE-2026-103921 · GHSA-6fw5-9hq8-w87g · amended
- High, CVSS 8.2
GraphQL Tools has prototype pollution in well-established utility function
mergeDeepnpm @graphql-tools/utils · Upgrade to 12.0.1 or later · <= 12.0.0 · CVE-2026-104852 · GHSA-7mx3-vvmw-hjmv · amended
- High, CVSS 8.7
hickory-resolver: Unbounded TC-retry loop in
NameServerPool::try_send(resource-exhaustion DoS)crates.io hickory-resolver · Upgrade to 0.26.2 or later · >= 0.26.0-beta.1, < 0.26.2 · CVE-2026-123604 · GHSA-6w6g-hm98-mhgm · amended
- High, CVSS 7.5
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
crates.io hickory-resolver · Upgrade to 0.26.2 or later · < 0.26.2 · CVE-2026-93657 · GHSA-5j98-2g5x-46v6 · amended
- High, CVSS 8.8
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
PyPI fsspec · Upgrade to 2026.6.0 or later · >= 0.9.0, < 2026.6.0 · CVE-2026-104851 · GHSA-27vj-qcqg-25rc · amended
- Critical, CVSS 9.3
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
npm @capacitor/android +2 · Upgrade all 3 to 8.5.1, 8.4.3, 7.6.9 or 6.2.2 by release line; some affected versions have no fix yet · >= 6.0.0, < 6.2.2; >= 7.0.0, < 7.6.9; >= 8.5.0, < 8.5.1; >= 8.3.5, < 8.4.3; >= 8.0.0, <= 8.3.4 · CVE-2026-103922 · GHSA-rvm3-566m-v7fv · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.