High, CVSS 8.7
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
npm @hapi/content · Upgrade to 6.0.1 or later · <= 6.0.0 · CVE-2026-115728 · GHSA-jg4p-7fhp-p32p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8226–8250 of 31,057 matching · newest first
- Low, CVSS 2.1
Parse Server: File upload Content-Type override via extension mismatch
npm parse-server · Upgrade to 9.7.1-alpha.4 (pre-release) or 8.6.73 by release line · >= 9.0.0, < 9.7.1-alpha.4; <= 8.6.72 · CVE-2026-35200 · GHSA-vr5f-2r24-w5hc · amended
- High, CVSS 7.5
Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers
Maven tools.jackson.core:jackson-core · Upgrade to 3.1.1 or later · >= 3.0.0, <= 3.1.0 · GHSA-2m67-wjpj-xhg9
- Medium, CVSS 5.3
Hugo: Certain markdown links are not properly escaped
Go github.com/gohugoio/hugo · Upgrade to 0.159.2 or later · >= 0.60.0, < 0.159.2 · CVE-2026-35166 · GHSA-mcv8-8m8x-48pg
- High, CVSS 8.8
BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation
PyPI bentoml · Upgrade to 1.4.38 or later · <= 1.4.37 · CVE-2026-35044 · GHSA-v959-cwq9-7hr6 · amended
- High, CVSS 7.8
BentoML: Command Injection in cloud deployment setup script
PyPI bentoml · Upgrade to 1.4.38 or later · <= 1.4.37 · CVE-2026-35043 · GHSA-fgv4-6jr3-jgfw · amended
- Critical, CVSS 9.4
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
PyPI litellm · Upgrade to 1.83.0 or later · < 1.83.0 · CVE-2026-35030 · GHSA-jjhc-v7c2-5hh6 · amended
- High, CVSS 8.7
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
PyPI litellm · Upgrade to 1.83.0 or later · < 1.83.0 · CVE-2026-35029 · GHSA-53mr-6c8q-9789 · amended
- Critical, CVSS 9.8
goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Go github.com/patrickhener/goshs · Upgrade to 1.1.5-0.20260401172448-237f3af891a9 (pre-release) or later · < 1.1.5-0.20260401172448-237f3af891a9 · CVE-2026-35471 · GHSA-6qcc-6q27-whp8
- High, CVSS 8.8
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
Packagist devcode-it/openstamanager · Upgrade to 2.10.2 or later · <= 2.10.1 · CVE-2026-35470 · GHSA-mmm5-3g4x-qw39
- High, CVSS 7.5
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
PyPI mesop · Upgrade to 1.2.5 or later · >= 1.2.3, < 1.2.5 · CVE-2026-34824 · GHSA-3jr7-6hqp-x679 · amended
- High, CVSS 8.7
Budibase: Command Injection in Bash Automation Step
npm @budibase/server · Upgrade to 3.33.4 or later · < 3.33.4 · CVE-2026-25044 · GHSA-gjw9-34gf-rp6m · amended
- Low, CVSS 2.3
Electron: Use-after-free in offscreen shared texture release() callback
npm electron · Upgrade to 42.0.0-alpha.5 (pre-release), 41.1.0, 40.8.5 or 39.8.5 by release line · >= 33.0.0-alpha.1, < 39.8.5; >= 40.0.0-alpha.1, < 40.8.5; >= 41.0.0-alpha.1, < 41.1.0; >= 42.0.0-alpha.1, < 42.0.0-alpha.5 · CVE-2026-34764 · GHSA-8x5q-pvf5-64mp · amended
- Medium, CVSS 6.5
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
PyPI vllm · Upgrade to 0.19.0 or later · >= 0.7.0, < 0.19.0 · CVE-2026-34755 · GHSA-pq5c-rjhq-qp7p · amended
- Medium, CVSS 5.4
vLLM: Server-Side Request Forgery (SSRF) in
download_bytes_from_urlPyPI vllm · Upgrade to 0.19.0 or later · >= 0.16.0, < 0.19.0 · CVE-2026-34753 · GHSA-pf3h-qjgv-vcpr · amended
- High, CVSS 8.7
OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
PyPI openexr · Upgrade to 3.4.8; some affected versions have no fix yet · >= 3.4.0, <= 3.4.7; >= 3.3.0, <= 3.3.8; >= 3.2.0, <= 3.2.6 · CVE-2026-34543 · GHSA-vc68-257w-m432 · amended
- High, CVSS 8.4
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
PyPI openexr · Upgrade to 3.4.8; some affected versions have no fix yet · >= 3.4.0, <= 3.4.7; >= 3.3.0, <= 3.3.8; >= 3.2.0, <= 3.2.6 · CVE-2026-34544 · GHSA-h762-rhv3-h25v · amended
- Medium, CVSS 6.9
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler
npm @nyariv/sandboxjs · Upgrade to 0.8.36 or later · <= 0.8.35 · CVE-2026-34217 · GHSA-hg73-4w7g-q96w · amended
- Medium, CVSS 6.9
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
npm @nyariv/sandboxjs · Upgrade to 0.8.36 or later · <= 0.8.35 · CVE-2026-34211 · GHSA-8pfc-jjgw-6g26 · amended
- Critical, CVSS 10.0
SandboxJS: Sandbox integrity escape
npm @nyariv/sandboxjs · Upgrade to 0.8.36 or later · < 0.8.36 · CVE-2026-34208 · GHSA-2gg9-6p7w-6cpj · amended
- Medium, CVSS 6.1
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
npm signalk-server · Upgrade to 2.24.0 or later · >= 2.20.0, < 2.24.0 · CVE-2026-34083 · GHSA-cxj8-ggf2-p57c · amended
- Medium, CVSS 5.9
LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
PyPI jupyterhub-ltiauthenticator · Upgrade to 1.6.3 or later · <= 1.6.2 · CVE-2026-34052 · GHSA-8mxq-7xr7-2fxj · amended
- Medium, CVSS 6.9
Signal K Server: Unauthenticated Source Priorities Manipulation
npm signalk-server · Upgrade to 2.24.0-beta.1 (pre-release) or later · < 2.24.0-beta.1 · CVE-2026-33951 · GHSA-gfmv-vh34-h2x5 · amended
- Critical, CVSS 9.4
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
npm signalk-server · Upgrade to 2.24.0-beta.4 (pre-release) or later · < 2.24.0-beta.4 · CVE-2026-33950 · GHSA-x8hc-fqv3-7gwf · amended
- High, CVSS 8.6
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
PyPI curl-cffi · Upgrade to 0.15.0 or later · < 0.15.0 · CVE-2026-33752 · GHSA-qw2m-4pqf-rmpp · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.