High, CVSS 8.7
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
PyPI pypdf · Upgrade to 6.18.0 or later · < 6.18.0 · CVE-2026-102994 · GHSA-5jq2-8x83-x246 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
pypdf: Possible large memory usage when retrieving Roman page labels
PyPI pypdf · Upgrade to 6.17.0 or later · < 6.17.0 · CVE-2026-102993 · GHSA-qv6h-rv94-w285 · amended
- Critical, CVSS 9.2
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
npm piscina · Upgrade to 6.0.0-rc.5 (pre-release), 5.3.2 or 4.9.4 by release line · >= 5.0.0, < 5.3.2; < 4.9.4; >= 6.0.0-rc.1, < 6.0.0-rc.5 · CVE-2026-102992 · GHSA-67c8-pqhq-4rmx · amended
- High, CVSS 8.2
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
npm basic-ftp · Upgrade to 6.2.1 or later · <= 6.2.0 · CVE-2026-102990 · GHSA-c475-qrg2-pj4r · amended
- Critical, CVSS 10.0
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721043339-eef10568384e (pre-release) or later · < 0.0.0-20260721043339-eef10568384e · CVE-2026-69085 · GHSA-33jq-p8c2-q3q4 · amended
- High, CVSS 7.7
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
PyPI virtualenv · Upgrade to 21.7.12 or later · <= 21.7.11 · CVE-2026-102930 · GHSA-94p9-xgh2-xp45 · amended
- High, CVSS 7.5
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103262 · GHSA-chx6-46f5-w4vp · amended
- High, CVSS 8.2
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103263 · GHSA-c2m8-h5v5-343r · amended
- High, CVSS 8.1
fastify vulnerable to request body replacement via an async validation result collision
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84504 · GHSA-667r-xxjv-c9mm · amended
- High, CVSS 7.5
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
npm fastify · Upgrade to 5.12.2 or later · >= 4.0.0, < 5.12.2 · CVE-2026-76169 · GHSA-p68q-wchp-6fh7 · amended
- High, CVSS 7.5
fastify vulnerable to request validation bypass via skipped boolean false schemas
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84469 · GHSA-hwr6-493r-vm6h · amended
- High, CVSS 7.5
fastify vulnerable to header validation bypass via incomplete schema case normalization
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84428 · GHSA-9q9j-q6p8-xq58 · amended
- High, CVSS 8.2
Astro: Malformed port in the Host header can crash the Node adapter
npm @astrojs/node · Upgrade to 11.1.3 or later · <= 11.1.2 · CVE-2026-102984 · GHSA-qh8j-hqjv-7m4x · amended
- High, CVSS 7.5
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
PyPI gitpython · Upgrade to 3.1.60 or later · <= 3.1.59 · CVE-2026-87819 · GHSA-g5vv-9gxw-82hx · amended
- High, CVSS 8.7
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
PyPI gitpython · Upgrade to 3.1.60 or later · <= 3.1.59 · CVE-2026-87817 · GHSA-239g-whfq-7xj9 · amended
- High, CVSS 7.5
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
crates.io russh · Upgrade to 0.63.1 or later · <= 0.63.0 · CVE-2026-102823 · GHSA-47hw-gvq5-r2gm · amended
- High, CVSS 8.2
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
npm @angular/router · Upgrade to 22.2.0, 21.2.24 or 20.3.32 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.2.0; >= 21.0.0, < 21.2.24; >= 20.0.0, < 20.3.32; <= 19.2.25 · CVE-2026-101896 · GHSA-ff3f-86qr-9cv3 · amended
- High, CVSS 7.5
jackson-databind quadratic forward-reference completion
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.3 or 3.1.7 by release line · >= 3.0.0, <= 3.1.6; >= 3.2.0, <= 3.2.2 · +1 more package · CVE-2026-91777 · GHSA-cxp5-3px4-pw24 · amended
- High, CVSS 7.5
jackson-databind retains every unknown raw type ID
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.3 or 3.1.7 by release line · >= 3.0.0, <= 3.1.6; >= 3.2.0, <= 3.2.2 · +1 more package · CVE-2026-91776 · GHSA-wv8q-qhhj-9h54 · amended
- High, CVSS 7.5
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Packagist league/commonmark · Upgrade to 2.10.2 or later · >= 2.0.0, <= 2.10.1 · CVE-2026-105830 · GHSA-3q6v-r5mr-hxv8 · amended
- High, CVSS 7.4
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
npm @grpc/grpc-js · Upgrade to 1.14.5 or 1.13.6 by release line · < 1.13.6; >= 1.14.0, < 1.14.5 · CVE-2026-101916 · GHSA-m9gg-hp2v-232j · amended
- High, CVSS 7.6
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
npm axios · Upgrade to 1.20.0 or later · >= 1.15.2, < 1.20.0 · CVE-2026-101905 · GHSA-m8m8-qj5v-23w3 · amended
- High, CVSS 7.0
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
npm axios · Upgrade to 1.20.0 or later · >= 1.17.0, < 1.20.0 · CVE-2026-101907 · GHSA-r4gj-5m52-g5wh · amended
- High, CVSS 8.2
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
npm axios · Upgrade to 1.20.0 or later · >= 1.16.1, < 1.20.0 · CVE-2026-101903 · GHSA-c29m-xwm3-cm6r · amended
- High, CVSS 8.2
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
npm axios · Upgrade to 1.20.0 or later · >= 1.15.0, < 1.20.0 · CVE-2026-101906 · GHSA-mghh-pgcx-3jjj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.