High, CVSS 8.7
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.3.0, < 13.0.0 · CVE-2026-112897 · GHSA-q45j-58j2-45rg · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
751–775 of 30,910 matching · newest first
- High, CVSS 8.8
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112896 · GHSA-pchr-8j38-3x4p · amended
- High, CVSS 8.7
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-112895 · GHSA-p4wg-p73j-c528 · amended
- Medium, CVSS 6.5
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 8.2.0, < 13.0.0 · CVE-2026-112395 · GHSA-462x-pgg6-55fp · amended
- High, CVSS 8.8
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 8.1.0, < 13.0.0 · CVE-2026-112404 · GHSA-c6hw-5grf-ff96 · amended
- Critical, CVSS 9.2
Pillow: Heap buffer overflow in ImagingJpegDecode
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112403 · GHSA-8g5g-8vmr-9782 · amended
- Medium, CVSS 5.9
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
npm @angular/common · Upgrade to 21.0.3 or 20.3.34 by release line; some affected versions have no fix yet · >= 21.0.0, < 21.0.3; >= 20.0.0, < 20.3.34; <= 19.2.25 · CVE-2026-111753 · GHSA-jfgx-762w-99vr · amended
- High, CVSS 7.5
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
npm markdown-it · Upgrade to 15.0.3 or 14.3.3 by release line · >= 14.1.0, < 14.3.3; >= 15.0.0, < 15.0.3 · CVE-2026-111758 · GHSA-gfr2-rv44-r23c · amended
- Low, CVSS 3.7
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
npm markdown-it · Upgrade to 15.0.3 or 14.3.3 by release line · < 14.3.3; >= 15.0.0, < 15.0.3 · CVE-2026-111766 · GHSA-vfgh-jcmw-g37q · amended
- High, CVSS 7.7
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
npm @modelcontextprotocol/server · Upgrade to 2.3.0 or later · >= 2.0.0, < 2.3.0 · CVE-2026-111770 · GHSA-jm63-cq47-j5jp · amended
- High, CVSS 7.5
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
npm @modelcontextprotocol/sdk · Upgrade to 1.32.0 or later · >= 1.3.0, < 1.32.0 · +1 more package · CVE-2026-111768 · GHSA-46jr-4wx8-v453 · amended
- Medium, CVSS 6.3
AIOHTTP: Absolute-form request targets can spoof Request.scheme
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111748 · GHSA-f9xw-jh8m-3mwq · amended
- Low, CVSS 2.3
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111749 · GHSA-gx76-c99x-2c96 · amended
- Medium, CVSS 6.9
AIOHTTP: Connector pool exhaustion via Max-Age overflow
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111065 · GHSA-6cjc-53gc-5rqm · amended
- Medium, CVSS 6.3
AIOHTTP: Pure-Python parser request smuggling
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111750 · GHSA-pqxq-w44r-73xw · amended
- High, CVSS 8.2
AIOHTTP: File descriptor exhaustion in multipart requests
PyPI aiohttp · Upgrade to 3.14.4 or later · >= 2.0.0, < 3.14.4 · CVE-2026-111066 · GHSA-9xw5-w5jj-pvcg · amended
- Medium, CVSS 6.3
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
npm launch-editor · Upgrade to 2.14.2 or later · <= 2.14.1 · +2 more packages · CVE-2026-112944 · GHSA-r825-w8mm-5pxw · amended
- High, CVSS 7.5
launch-editor:
fs.existsSync()existence check can be bypassed on Windowsnpm launch-editor · Upgrade to 2.14.2 or later · <= 2.14.1 · +2 more packages · CVE-2026-112942 · GHSA-587h-7wmj-h5pm · amended
- Medium, CVSS 6.8
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
npm @modelcontextprotocol/sdk · Upgrade to 1.32.0 or later · >= 1.6.0, < 1.32.0 · +3 more packages · CVE-2026-111771 · GHSA-rvq5-wwqv-78pq · amended
- Critical, CVSS 9.1
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
PyPI uv · Upgrade to 0.13.4 or later · < 0.13.4 · GHSA-hq85-5cpj-mr62 · amended
- Critical, CVSS 9.1
certifi bundles emSign root CAs with compromised intermediate CA keys
PyPI certifi · Upgrade to 2026.10.18 or later · >= 2019.3.9, < 2026.10.18 · GHSA-6q48-6c7w-9gw2 · amended
- Medium, CVSS 6.3
launch-editor: escapeCmdArgs() omits % escaping on Windows
npm launch-editor · Upgrade to 2.14.2 or later · <= 2.14.1 · +2 more packages · CVE-2026-112943 · GHSA-698v-4r3x-3vcv · amended
- High, CVSS 8.6
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
npm @modelcontextprotocol/sdk · Upgrade to 1.32.0 or later · >= 1.24.0, < 1.32.0 · CVE-2026-111767 · GHSA-22jm-h49p-29qw · amended
- Medium, CVSS 6.5
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
npm @modelcontextprotocol/sdk · Upgrade to 1.32.0 or later · < 1.32.0 · +1 more package · CVE-2026-111769 · GHSA-6prh-2h8m-c8cw · amended
- Medium, CVSS 6.9
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113653 · GHSA-xf6w-q65w-4f2w · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.