Medium, CVSS 5.3
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.13.0, < 2.14.0 · CVE-2026-102265 · GHSA-8wjv-2p76-3863 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1576–1600 of 30,910 matching · newest first
- Medium, CVSS 4.8
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-102269 · GHSA-hxm8-2xgr-2p9m · amended
- Critical, CVSS 9.1
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-102268 · GHSA-ffc3-869f-jxw9 · amended
- High, CVSS 7.4
PyJWT accepts public JWK containers as HMAC secrets
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.13.0, <= 2.13.0 · CVE-2026-102273 · GHSA-w2cx-738m-mc7w · amended
- High, CVSS 7.4
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-102267 · GHSA-9v7f-9g4p-ffgj · amended
- High, CVSS 7.4
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.4.0, < 2.14.0 · CVE-2026-102271 · GHSA-p4g4-x82p-q773 · amended
- High, CVSS 7.4
PyJWT BOM Bypass
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.13.0, <= 2.13.0 · CVE-2026-102272 · GHSA-r6x4-923q-g947 · amended
- Medium, CVSS 5.3
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-101917 · GHSA-2gx3-rcp4-g85q · amended
- Medium, CVSS 5.9
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-114104 · GHSA-p634-w6r4-rjp2 · amended
- Medium, CVSS 5.3
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-114103 · GHSA-c6fg-446q-cg94 · amended
- High, CVSS 7.5
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-114102 · GHSA-8238-w5pm-2374 · amended
- Medium, CVSS 5.4
Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
crates.io ammonia · Upgrade to 4.1.4, 4.0.3 or 3.3.3 by release line · < 3.3.3; >= 4.0.0, < 4.0.3; >= 4.1.2, < 4.1.4 · CVE-2026-102342 · GHSA-m6mh-2hw2-555x
- High, CVSS 7.5
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-92000 · GHSA-rcw4-f5rp-g42v · amended
- High, CVSS 7.1
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-102282 · GHSA-j5f4-cc29-5x44 · amended
- Low, CVSS 3.1
Laravel: XSS in Debug Page Information
Packagist laravel/framework · Upgrade to 13.30.0 or 12.69.0 by release line · < 12.69.0; >= 13.0.0, < 13.30.0 · CVE-2026-102279 · GHSA-jh5r-qr3c-85q8 · amended
- Medium, CVSS 5.9
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
npm nodemailer · Upgrade to 10.0.2 or later · < 10.0.2 · CVE-2026-100702 · GHSA-8vvx-rff5-p5rq · amended
- Medium, CVSS 5.9
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.9.0, <= 2.13.0 · CVE-2026-102274 · GHSA-w6j9-cwv2-h6wq · amended
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via orphaned RetryHandler response body
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.11.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-18149 · GHSA-pmjh-fq2x-6v4x · amended
- Low, CVSS 3.7
undici vulnerable to downstream response splitting via retry interceptor
npm undici · Upgrade to 8.10.2, 7.29.1 or 6.28.1 by release line · < 6.28.1; >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-18540 · GHSA-r53p-7pc4-xj5r · amended
- High, CVSS 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
npm undici · Upgrade to 8.10.2, 7.29.1 or 6.28.1 by release line · >= 6.7.0, < 6.28.1; >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-19534 · GHSA-rfgv-xxqx-mfg5 · amended
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.15.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84890 · GHSA-3xpg-4rpp-hhhm · amended
- Medium, CVSS 6.5
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84933 · GHSA-2jfj-6hjv-fm6j · amended
- Low, CVSS 3.7
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.1.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84947 · GHSA-2gqq-gqf2-x968 · amended
- High, CVSS 7.4
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.24.1, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84961 · GHSA-w293-vg96-wgc3 · amended
- Low, CVSS 3.7
undici vulnerable to caching and replay of unsafe HTTP method responses
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-85008 · GHSA-8436-99hf-9mmv · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.