Critical, CVSS 10.0
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92940 · GHSA-h85j-hv3c-qfgq · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.9
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92951 · GHSA-c48m-32m9-vx93 · amended
- High, CVSS 8.5
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92958 · GHSA-6rh5-qq4q-97xh · amended
- Critical, CVSS 9.9
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92957 · GHSA-8686-vhfx-7r3j · amended
- Critical, CVSS 9.0
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.4, <= 3.11.6 · CVE-2026-92935 · GHSA-8hr7-r645-pc6w · amended
- Critical, CVSS 10.0
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.6, <= 3.11.6 · CVE-2026-92937 · GHSA-647f-g98j-qq25 · amended
- Critical, CVSS 9.9
vm2 allows a sandboxed plugin to execute native code through
node:sqlitenpm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92938 · GHSA-6w8r-xxw2-g3hx · amended
- Critical, CVSS 9.9
vm2 crypto builtin loads attacker native code through setEngine
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92939 · GHSA-46pr-c5wc-xffx · amended
- Critical, CVSS 9.8
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
npm vm2 · Upgrade to 3.11.7 or later · >= 3.10.2, <= 3.11.6 · CVE-2026-92944 · GHSA-27g9-p43v-cw3v · amended
- Critical, CVSS 10.0
vm2 NodeVM can replace the host process TLS trust store
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92941 · GHSA-98xx-8mx4-x7cm · amended
- High, CVSS 8.1
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 4.5.0, <= 4.5.10 · +3 more packages · CVE-2026-102831 · GHSA-6966-vjj6-99xv · amended
- High, CVSS 7.5
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.22.3, 2.21.7 or 2.18.11 by release line · >= 2.19.0, <= 2.21.6; >= 2.22.0, <= 2.22.2; >= 2.8.0, <= 2.18.10 · +1 more package · CVE-2026-89425 · GHSA-7hhh-6rmp-j9qf · amended
- High, CVSS 7.5
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.22.3, 2.21.7 or 2.18.11 by release line · >= 2.17.0, <= 2.18.10; >= 2.19.0, <= 2.21.6; >= 2.22.0, <= 2.22.2 · +1 more package · CVE-2026-89407 · GHSA-p6pp-m3f8-5c89 · amended
- High, CVSS 7.5
devalue:
stringify/unevalserialize shared memorynpm devalue · Upgrade to 5.9.3 or later · >= 5.1.0, <= 5.9.2 · CVE-2026-92708 · GHSA-j22f-vq7h-c4qm · amended
- High, CVSS 8.2
devalue: Repeated primitive strings cause quadratic expansion in uneval
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123565 · GHSA-mcm9-63f2-9j32 · amended
- High, CVSS 8.2
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123563 · GHSA-r9w8-h9r3-54w4 · amended
- High, CVSS 8.2
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
npm devalue · Upgrade to 5.9.3 or later · >= 5.8.0, < 5.9.3 · CVE-2026-123562 · GHSA-x5rw-q4pp-hg5g · amended
- High, CVSS 7.8
virtualenv bash and fish activation scripts execute commands embedded in paths
PyPI virtualenv · Upgrade to 21.7.13 or later · <= 21.7.12 · CVE-2026-102925 · GHSA-p58f-9548-mpm2 · amended
- High, CVSS 7.3
virtualenv: Command injection via --prompt in activate.bat (batch activator)
PyPI virtualenv · Upgrade to 21.7.12 or later · <= 21.7.11 · CVE-2026-102937 · GHSA-x78j-v8h9-3j2q · amended
- High, CVSS 8.7
pypdf: Possible long runtimes with large amount of embedded files
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-102999 · GHSA-v247-6f48-mgcj · amended
- High, CVSS 8.7
pypdf: Possible long runtimes when generating appearance streams
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-102998 · GHSA-php9-fj8v-98fj · amended
- High, CVSS 8.7
pypdf: Possible large memory usage when retrieving alphabetical page labels
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-103000 · GHSA-w23x-9jrw-r45c · amended
- High, CVSS 8.7
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102997 · GHSA-jw7q-gvrg-4vj3 · amended
- High, CVSS 8.7
pypdf: Possible large memory usage when parsing font data
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102996 · GHSA-g9cg-prrw-2r8q · amended
- High, CVSS 8.7
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102995 · GHSA-fp3h-c4fm-7vvf · amended
A vendor fix does not resolve your finding until you verify it in your own systems.