Unrated
SvelteKit : XSS via untrusted cache-control header in prerendered page
npm @sveltejs/kit · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2026-114061 · GHSA-27mw-82g8-phjj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
601–625 of 30,910 matching · newest first
- High, CVSS 7.1
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
npm obsidian-tc · Upgrade to 1.31.4 or later · >= 1.0.1, <= 1.31.3 · CVE-2026-115478 · GHSA-r3g7-r4hr-m258 · amended
- Medium, CVSS 6.6
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260808010544-26ccb40d390e (pre-release) or later · < 0.0.0-20260808010544-26ccb40d390e · CVE-2026-62204 · GHSA-rpx2-p6hp-x5gj · amended
- High, CVSS 7.5
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260731131820-67bc300b6ea6 (pre-release) or later · < 0.0.0-20260731131820-67bc300b6ea6 · CVE-2026-73054 · GHSA-c8w8-3pqp-wr83 · amended
- Medium, CVSS 5.8
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260731093152-c7522b8db586 (pre-release) or later · < 0.0.0-20260731093152-c7522b8db586 · CVE-2026-73630 · GHSA-4pjg-x8qj-33j5 · amended
- Medium, CVSS 5.8
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260730150429-5b42614311b0 (pre-release) or later · < 0.0.0-20260730150429-5b42614311b0 · CVE-2026-73049 · GHSA-p4qw-vx5p-g984 · amended
- Medium, CVSS 5.8
SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260729005258-4daee87d4152 (pre-release) or later · < 0.0.0-20260729005258-4daee87d4152 · GHSA-xp3q-r38w-vgqm · amended
- Critical, CVSS 9.6
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77363 · GHSA-pqh8-4pj7-32xx · amended
- Medium, CVSS 4.3
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77362 · GHSA-43r2-c7g8-prc8 · amended
- High, CVSS 7.1
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
npm obsidian-tc · Upgrade to 1.31.4 or later · >= 1.13.0, <= 1.31.3 · CVE-2026-115477 · GHSA-737x-cwfr-5vvc · amended
- Critical, CVSS 9.9
obsidian-tc tokens can access arbitrary configured vaults
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77366 · GHSA-84c9-qqpq-2pq5 · amended
- Medium, CVSS 6.5
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77364 · GHSA-cvp8-vvgf-69q4 · amended
- Medium, CVSS 4.7
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
npm obsidian-tc · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2026-77361 · GHSA-c5xx-h28h-f682 · amended
- Medium, CVSS 4.5
virtualenv: Generated files can follow existing destination links
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113721 · GHSA-558c-9hv2-4prj · amended
- High, CVSS 8.1
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
PyPI pillow · Upgrade to 13.0.0 or later · >= 11.1.0, < 13.0.0 · GHSA-78g4-xqwv-q3g8 · amended
- Medium, CVSS 5.4
Nuxt server islands render
useHeadSafeinput without sanitisationnpm nuxt · Upgrade to 4.6.2 or later · >= 3.13.0, < 4.6.2 · CVE-2026-114133 · GHSA-xfq5-w38q-pc2x · amended
- Low, CVSS 2.3
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a
javascript:URL prefixed with an ASCII control character executes frompagesis disablednpm nuxt · Upgrade to 4.6.0 or later · < 4.6.0 · CVE-2026-114130 · GHSA-jjm6-p2m9-9w4x · amended
- Medium, CVSS 6.5
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass
appMiddlewareon dynamic and catch-all routesnpm nuxt · Upgrade to 4.4.4 or 3.21.4 by release line · >= 4.0.0, < 4.4.4; >= 3.11.0, < 3.21.4 · CVE-2026-114131 · GHSA-6gq8-jgmh-3ffp · amended
- Medium, CVSS 6.0
pypdf: Possible long runtimes/large memory usage when retrieving form fields
PyPI pypdf · Upgrade to 6.21.0 or later · < 6.21.0 · CVE-2026-113789 · GHSA-6vvc-x485-93v7 · amended
- Medium, CVSS 6.0
pypdf: Possible large memory usage when parsing arrays and dictionaries
PyPI pypdf · Upgrade to 6.21.0 or later · < 6.21.0 · CVE-2026-113790 · GHSA-f54x-cmq8-qg57 · amended
- Medium, CVSS 6.0
pypdf: Possible large memory usage when parsing content streams
PyPI pypdf · Upgrade to 6.21.0 or later · < 6.21.0 · CVE-2026-113791 · GHSA-cgf9-327m-v77c · amended
- Medium, CVSS 4.2
Electron: SameSite cookie restrictions are not applied to windows opened from links
npm electron · Upgrade to 45.0.0-alpha.6 (pre-release), 44.3.0, 43.7.0 or 42.11.3 by release line · >= 45.0.0-alpha.1, < 45.0.0-alpha.6; >= 44.0.0-alpha.1, < 44.3.0; >= 43.0.0-alpha.1, < 43.7.0; < 42.11.3 · CVE-2026-113796 · GHSA-2p8c-gr87-2676 · amended
- Medium, CVSS 5.4
Electron: Pointer lock permission requests can be attributed to the wrong frame
npm electron · Upgrade to 45.0.0-alpha.13 (pre-release), 44.5.0, 43.7.6 or 42.11.9 by release line · >= 45.0.0-alpha.1, < 45.0.0-alpha.13; >= 44.0.0-alpha.1, < 44.5.0; >= 43.0.0-alpha.1, < 43.7.6; < 42.11.9 · CVE-2026-113798 · GHSA-x562-297c-g43g · amended
- Low, CVSS 3.1
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
npm electron · Upgrade to 45.0.0-alpha.4 (pre-release), 44.1.1, 43.5.1 or 42.11.1 by release line · >= 45.0.0-alpha.1, < 45.0.0-alpha.4; >= 44.0.0-alpha.1, < 44.1.1; >= 43.0.0-alpha.1, < 43.5.1; < 42.11.1 · CVE-2026-113797 · GHSA-98mx-cjp9-gchm · amended
- Low, CVSS 3.9
Electron: Frame subscription trusts GPU-supplied frame geometry
npm electron · Upgrade to 45.0.0-alpha.9 (pre-release), 44.4.3, 43.7.3 or 42.11.6 by release line · < 42.11.6; >= 43.0.0-alpha.1, < 43.7.3; >= 44.0.0-alpha.1, < 44.4.3; >= 45.0.0-alpha.1, < 45.0.0-alpha.9 · CVE-2026-114122 · GHSA-3qxv-5xgr-q7w9 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.