High, CVSS 7.5
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
crates.io quinn-proto · Upgrade to 0.11.15 or later · >= 0.1.0, < 0.11.15 · GHSA-4w2j-m93h-cj5j
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
npm react-router · Upgrade to 7.18.0 or later · >= 7.0.0, < 7.18.0 · CVE-2026-55685 · GHSA-chx6-hx7r-mcp5 · amended
- High, CVSS 8.2
LiquidJS:
popfilter bypassesmemoryLimitaccounting that its array-filter siblings enforcenpm liquidjs · Upgrade to 10.27.1 or later · <= 10.27.0 · CVE-2026-55575 · GHSA-g357-x5c3-c72p · amended
- High, CVSS 8.2
electron-updater: Cross-origin redirect leaks
PRIVATE-TOKENand mixed-caseAuthorizationcredentials inbuilder-util-runtimenpm builder-util-runtime · Upgrade to 9.7.0 or later · < 9.7.0 · CVE-2026-54673 · GHSA-p2f4-r6v6-j797 · amended
- High, CVSS 7.8
electron-updater: Uncontrolled search path elements within
AppImagebuilt byapp-builder-libnpm app-builder-lib · Upgrade to 26.15.0 or later · < 26.15.0 · CVE-2026-54672 · GHSA-7g7r-gx96-252g · amended
- High, CVSS 7.5
find-my-way: DDoS with HTTP2
npm find-my-way · Upgrade to 9.7.0 or later · <= 9.6.0 · CVE-2026-47219 · GHSA-c96f-x56v-gq3h · amended
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
PyPI pypdf · Upgrade to 6.14.2 or later · < 6.14.2 · CVE-2026-59935 · GHSA-g867-7843-wf8q · amended
- High, CVSS 8.7
pypdf: Possible infinite loop for not terminated inline images
PyPI pypdf · Upgrade to 6.14.1 or later · < 6.14.1 · CVE-2026-59936 · GHSA-5xf7-4p34-54qr · amended
- High, CVSS 7.5
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
npm postcss · Upgrade to 8.5.12 or later · <= 8.5.11 · CVE-2026-45623 · GHSA-6g55-p6wh-862q · amended
- High, CVSS 7.5
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59933 · GHSA-xh5m-36r6-47m3
- High, CVSS 7.5
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59932 · GHSA-2mrg-gjxq-2gvr
- High, CVSS 7.7
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Packagist phpoffice/phpspreadsheet · Upgrade to 5.8.1, 3.10.7, 2.4.7 or 2 more by release line · >= 4.0.0, <= 5.8.0; >= 3.3.0, <= 3.10.6; >= 2.2.0, <= 2.4.6; >= 2.0.0, <= 2.1.17; <= 1.30.5 · CVE-2026-59931 · GHSA-6hq5-7373-42rg
- Critical, CVSS 9.1
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
npm next-auth · Upgrade to 5.0.0-beta.32 (pre-release) or later · >= 5.0.0-beta.0, <= 5.0.0-beta.31 · CVE-2026-73421 · GHSA-8fpg-xm3f-6cx3 · amended
- High, CVSS 7.5
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73418 · GHSA-xmf8-cvqr-rfgj · amended
- Critical, CVSS 9.1
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
npm @auth/core · Upgrade to 0.41.3 or later · >= 0.1.0, < 0.41.3 · +1 more package · CVE-2026-73420 · GHSA-7rqj-j65f-68wh · amended
- High, CVSS 8.6
JupyterLab: Cross-site scripting (XSS) via crafted settings file (
overrides.json)PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; >= 3.3.0, <= 4.5.9 · CVE-2026-73417 · GHSA-pppj-hq3g-57pj · amended
- High, CVSS 7.5
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; <= 4.5.9 · CVE-2026-73415 · GHSA-gx64-gj6p-pc4c · amended
- High, CVSS 7.7
JupyterLab: Allowlist/blocklist check in
PyPIExtensionManager.install()not enforced for direct callers (missingawait)PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; <= 4.5.9 · CVE-2026-73626 · GHSA-whvh-wf3x-g77j · amended
- High, CVSS 8.3
Next.js: Server-Side Request Forgery in Server Actions on custom servers
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 14.1.1, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64649 · GHSA-89xv-2m56-2m9x · amended
- High, CVSS 8.3
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64645 · GHSA-p9j2-gv94-2wf4 · amended
- High, CVSS 8.3
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
npm next · Upgrade to 16.2.11 or later · >= 16.0.0, < 16.2.11 · CVE-2026-64642 · GHSA-6gpp-xcg3-4w24 · amended
- High, CVSS 8.2
Next.js: Denial of Service in App Router using Server Actions
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64641 · GHSA-m99w-x7hq-7vfj · amended
- High, CVSS 7.5
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Maven org.eclipse.jetty:jetty-server · Upgrade to 11.0.23 or 10.0.23 by release line · >= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23 · CVE-2024-7708 · GHSA-9299-c6m4-mjhc
- High, CVSS 8.7
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
Maven org.eclipse.jetty.ee9:jetty-ee9-security · Upgrade to 12.1.10 or 12.0.36 by release line · >= 12.0.0, <= 12.0.35; >= 12.1.0, <= 12.1.9 · +2 more packages · CVE-2026-10050 · GHSA-2fvj-hgj9-j2gr
- High, CVSS 8.8Exploited · CISA KEV
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
PyPI litellm · Upgrade to 1.84.0 or later · < 1.84.0 · CVE-2026-59822 · GHSA-7488-6r32-c95q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.