High, CVSS 7.5
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · >= 0.3.3, < 0.6.5 · CVE-2026-119194 · GHSA-fm9c-5rcf-2q5p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Forge: Regular expression denial of service in PEM decoding (pem.decode)
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118779 · GHSA-7wch-p9px-956x · amended
- High, CVSS 7.5
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118782 · GHSA-jc66-7q78-782g · amended
- High, CVSS 7.5
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119188 · GHSA-8hrf-8g6f-7xwp · amended
- High, CVSS 7.5
Forge: Denial of service in TLS record processing via call stack exhaustion
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119187 · GHSA-hqq3-7jhf-c5jx · amended
- High, CVSS 7.4
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119190 · GHSA-5x38-2vff-x55p · amended
- High, CVSS 7.4
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
npm @sigstore/oci · Upgrade to 0.7.2 or later · < 0.7.2 · CVE-2026-118763 · GHSA-j63v-mwhm-56jx · amended
- High, CVSS 8.2
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
npm follow-redirects · Upgrade to 1.16.2 or later · >= 1.16.0, < 1.16.2 · CVE-2026-116689 · GHSA-mrwp-f3q8-3g9p · amended
- High, CVSS 7.5
GraphQL-core has denial of service via memory leak in aborted validations
PyPI graphql-core · Upgrade to 3.3.1 or later · >= 3.3.0a3, < 3.3.1 · CVE-2026-119286 · GHSA-mpqx-q82w-9x46 · amended
- High, CVSS 8.4
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
PyPI oauthlib · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-118669 · GHSA-7984-qgvg-3j9c · amended
- Critical, CVSS 9.8
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
npm signalk-server · Upgrade to 2.34.0 or later · >= 2.0.0, < 2.34.0 · +1 more package · CVE-2026-123807 · GHSA-4xm8-rg9h-jhq2 · amended
- Critical, CVSS 9.8
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
Go github.com/imgproxy/imgproxy +3 · Upgrade all 4 to 4.0.16 or later · >= 4.0.0, < 4.0.16 · CVE-2026-123614 · GHSA-hff9-5pqw-6w9f · amended
- High, CVSS 8.1
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96633 · GHSA-6vfx-w7q3-42gq · amended
- High, CVSS 8.2
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · >= 4.6.0, < 5.5.1 · CVE-2026-96631 · GHSA-79wv-8rh2-9vp2 · amended
- High, CVSS 8.2
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96632 · GHSA-rx7m-wxwq-vxr9 · amended
- High, CVSS 7.2
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
Packagist adminneo-org/adminneo · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2026-96630 · GHSA-q5mp-gfjf-cf2j · amended
- Critical, CVSS 9.3
pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
GitHub Actions pypa/gh-action-pypi-publish · Upgrade to 1.14.3 or later · <= 1.14.2 · GHSA-5xjx-3w67-w9x9
- High, CVSS 7.5
AdminNeo: version-cache array injection causes persistent denial of service
Packagist adminneo-org/adminneo · Upgrade to 5.5.0 or later · >= 4.6.2, < 5.5.0 · CVE-2026-59978 · GHSA-jm85-8cpp-9cjc · amended
- High, CVSS 8.8
Parse Server 9.0.0 before 9.10.4 Unauthenticated Class Schema Deletion on MongoDB
Bitnami parse · Upgrade to 9.10.4 or 8.6.101 by release line · < 8.6.101; >= 9.0.0, < 9.10.4 · CVE-2026-116165 · GHSA-qmg9-m772-5rm7
- Critical, CVSS 9.1
Parse Server 9.0.0 before 9.10.5 Authentication Bypass via AuthAdapter Subclasses
Bitnami parse · Upgrade to 9.10.5 or 8.6.102 by release line · < 8.6.102; >= 9.0.0, < 9.10.5 · CVE-2026-116163 · GHSA-rq3w-5c6f-p7wr
- Critical, CVSS 9.4
Distrust compromised intermediate certificates in ssl module
Bitnami python-min +2 · Upgrade all 3 to 3.15.2, 3.14.10, 3.13.18 or 2 more by release line · < 3.11.18; >= 3.12.0, < 3.12.16; >= 3.13.0, < 3.13.18; >= 3.14.0, < 3.14.10; >= 3.15.0, < 3.15.2 · CVE-2026-115557 · amended
- High, CVSS 7.5
joserfc: Unbounded JWE General JSON
recipientsArray Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI joserfc · Upgrade to 1.7.5 or later · < 1.7.5 · CVE-2026-119283 · GHSA-jpxq-7h8p-2q76 · amended
- High, CVSS 7.3
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
npm @nx/gradle +1 · Upgrade all 2 to 23.1.2 or 22.7.9 by release line · >= 21.0.0, < 22.7.9; >= 23.0.0, < 23.1.2 · CVE-2026-119282 · GHSA-qm8w-vx34-5j9j · amended
- High, CVSS 7.5
nix-nar:Decoder::unpackwrites archive entries outside the destination directory (path traversal)crates.io nix-nar · Upgrade to 0.6.0 or later · >= 0.0.0-0, < 0.6.0
- High, CVSS 7.1
ocipkg: unpacking an OCI archive can write and delete files outside the local image store (path traversal)crates.io ocipkg · Upgrade to 0.4.1 or later · >= 0.0.0-0, < 0.4.1
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.