High, CVSS 7.4
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
npm undici · Upgrade to 8.10.2 or later · >= 8.10.0, < 8.10.2 · CVE-2026-85152 · GHSA-vp8m-p9jh-q5pm · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1601–1625 of 30,910 matching · newest first
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via WebSocketStream unclean close
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-85014 · GHSA-rx4f-c7p8-82vq · amended
- Low, CVSS 3.5
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Packagist league/flysystem · Upgrade to 3.35.3 or later · <= 3.35.2 · CVE-2026-102601 · GHSA-cxf4-7mrp-vvpr · amended
- High, CVSS 8.7
joi: Quadratic regular-expression backtracking in
Joi.string().isoDate()npm joi · Upgrade to 18.2.6 or 17.13.7 by release line · >= 17.2.0, < 17.13.7; >= 18.0.0, < 18.2.6 · CVE-2026-92599 · GHSA-6h2x-m376-mqjq · amended
- Medium, CVSS 6.7
Electron: Local race condition in Squirrel.Mac update installation on macOS
npm electron · Upgrade to 42.0.0-beta.2 (pre-release), 41.10.5 or 39.8.10 by release line · < 39.8.10; >= 40.0.0-alpha.1, < 41.10.5; >= 42.0.0-alpha.1, < 42.0.0-beta.2 · CVE-2026-102672 · GHSA-vv43-5jgx-7qv8 · amended
- High, CVSS 8.2
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
npm electron · Upgrade to 43.0.0, 42.5.2 or 41.10.4 by release line · < 41.10.4; >= 42.0.0-alpha.1, < 42.5.2; >= 43.0.0-alpha.1, < 43.0.0 · CVE-2026-102673 · GHSA-hq2x-r82h-9wj4 · amended
- High, CVSS 8.2
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102674 · GHSA-gr2m-v5gq-v685 · amended
- High, CVSS 7.4
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102675 · GHSA-j84w-jfhq-vhvj · amended
- High, CVSS 8.3
Electron: can enable Node.js integration in Web Workers despite embedder restrictions
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102676 · GHSA-9qh4-3jw8-366w · amended
- High, CVSS 7.8
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
npm electron · Upgrade to 44.0.0-beta.6 (pre-release), 43.5.0 or 42.10.0 by release line · >= 42.3.3, < 42.10.0; >= 43.0.0-beta.1, < 43.5.0; >= 44.0.0-alpha.1, < 44.0.0-beta.6 · CVE-2026-102677 · GHSA-qmv3-fv6v-rmhq · amended
- Medium, CVSS 6.3
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
Go go.opentelemetry.io/otel/sdk/log · Upgrade to 0.21.0 or later · < 0.21.0 · CVE-2026-81872 · GHSA-hjf4-fphr-2h65 · amended
- Medium, CVSS 5.1
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
Go go.opentelemetry.io/otel/sdk · Upgrade to 1.33.0 or later · >= 1.10.0, < 1.33.0 · CVE-2026-81869 · GHSA-p9f8-wvj8-2fg8 · amended
- Medium, CVSS 6.3
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
npm markdown-it · Upgrade to 15.0.1 or 14.3.1 by release line · >= 15.0.0, <= 15.0.0; < 14.3.1 · GHSA-253c-mchw-3w2r · amended
- Medium, CVSS 5.3
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
npm js-yaml · Upgrade to 5.4.1 or later · >= 5.0.0, <= 5.4.0 · GHSA-r3ph-w7gj-g6xm · amended
- High, CVSS 8.6
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
Packagist phpcsstandards/phpcsutils · Upgrade to 1.2.3 or later · >= 1.0.0-alpha1, < 1.2.3 · CVE-2026-65954 · GHSA-r6hr-vr92-vv28 · amended
- Medium, CVSS 6.8
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)
PyPI oauthlib · Upgrade to 4.0.0 or later · >= 3.0.0, < 4.0.0 · CVE-2026-49265 · GHSA-xpv3-w29h-x7cv · amended
- Medium, CVSS 6.1
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
PyPI oauthlib · Upgrade to 4.0.0 or later · >= 0.6.1, <= 3.3.1 · CVE-2026-49264 · GHSA-hj66-6f7g-4r5v · amended
- Medium, CVSS 5.5
A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process
crates.io sheets-diff · Upgrade to 3.2.0 or later · >= 0.0.0-0, < 3.2.0 · GHSA-w5x2-6474-pqp4
- Unrated
Sending custom to-device messages may panics
crates.io matrix-sdk-crypto · Upgrade to 0.19.0 or later · >= 0.0.0-0, < 0.19.0 · GHSA-45pr-7vv7-f64m
- UnratedExploited · CISA KEV
BIT-wordpress-2026-87902
Bitnami wordpress +1 · Upgrade all 2 to 7.1.2 or later · < 7.1.2 · CVE-2026-87902 · GHSA-7hp8-65ch-5whp · amended
- Medium, CVSS 5.9
Nodemailer: Process-global DNS cache reuses TLS
servernameacross transports, enabling cross-tenant SMTP credential disclosurenpm nodemailer · Upgrade to 10.0.2 or later · >= 5.0.0, < 10.0.2 · CVE-2026-100701 · GHSA-6vj9-mwq6-2f5v · amended
- Medium, CVSS 5.9
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
npm undici · Upgrade to 8.10.2, 7.29.1 or 6.28.1 by release line · >= 6.25.0, < 6.28.1; >= 7.28.0, < 7.29.1; >= 8.1.0, < 8.10.2 · CVE-2026-85024 · GHSA-3wwx-pv8p-q78v · amended
- Medium, CVSS 5.3
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
npm multer · Upgrade to 2.4.0 or later · >= 2.2.0, < 2.4.0 · CVE-2026-88932 · GHSA-3pph-fpjx-jg34 · amended
- Medium, CVSS 5.3
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
npm morgan · Upgrade to 1.12.1 or later · < 1.12.1 · CVE-2026-87859 · GHSA-9f6g-j8ch-79g4 · amended
- High, CVSS 8.7
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
npm @angular/platform-server · Upgrade to 22.1.6, 21.2.23 or 20.3.31 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.6; >= 21.0.0, < 21.2.23; >= 20.0.0, < 20.3.31; <= 19.2.25 · CVE-2026-101895 · GHSA-f67j-2jqw-jpq7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.