High, CVSS 7.5
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
npm exifreader · Upgrade to 4.41.1 or later · <= 4.41.0 · CVE-2026-85715 · GHSA-pj96-35fp-cfcc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1926–1950 of 30,910 matching · newest first
- Low, CVSS 3.7
MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.9, 3.4.3, 3.3.5 or 2.7.14 by release line · < 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9 · CVE-2026-61700 · GHSA-wxmm-q36w-r9xj · amended
- High, CVSS 8.7
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
NuGet umbraco.cms · Upgrade to 18.0.2, 17.5.3 or 13.15.1 by release line · >= 12.0.0, < 13.15.1; >= 14.0.0-rc1, < 17.5.3; >= 18.0.0, < 18.0.2 · CVE-2026-69197 · GHSA-wr57-hqmp-fgvh · amended
- Medium, CVSS 6.5
sanic chunked trailer request smuggling allows hidden second request execution
PyPI sanic · Upgrade to 25.12.1 or 24.12.1 by release line · < 24.12.1; >= 25.12.0, < 25.12.1 · CVE-2026-85078 · GHSA-wmj6-g64g-j7q5 · amended
- High, CVSS 8.8
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
npm next-tinacms-azure · Upgrade to 15.0.1 or later · <= 15.0.0 · +1 more package · CVE-2026-63506 · GHSA-g74q-6g2f-874x · amended
- Medium, CVSS 4.4
Redocly CLI: Path traversal when using
splitcommandnpm @redocly/cli · Upgrade to 2.33.2 or 1.34.17 by release line · < 1.34.17; >= 2.0.0, < 2.33.2 · CVE-2026-63225 · GHSA-657c-g7qc-r9j2 · amended
- High, CVSS 8.7
Pocketbase: Unhandled panic in worker goroutines
Go github.com/pocketbase/pocketbase · Upgrade to 0.39.7 or 0.22.48 by release line · < 0.22.48; >= 0.23.0, < 0.39.7 · CVE-2026-82410 · GHSA-84vh-m24q-wjjx · amended
- Medium, CVSS 6.5
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Packagist getgrav/grav · Upgrade to 2.0.2 or later · >= 2.0.1, <= 2.0.1 · CVE-2026-61449 · GHSA-8h9x-89f2-m7x3 · amended
- Medium, CVSS 6.5
AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
PyPI asyncssh · Upgrade to 2.24.0 or later · <= 2.23.1 · CVE-2026-62949 · GHSA-rw4j-r22c-9gc3 · amended
- High, CVSS 7.5
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
Maven com.squareup.wire:wire-runtime · Upgrade to 7.0.0-alpha04 (pre-release) or 6.4.5 by release line · <= 6.4.4; >= 7.0.0-alpha01, < 7.0.0-alpha04 · CVE-2026-63126 · GHSA-9rm7-3qhh-h2mc · amended
- Medium, CVSS 6.3
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
npm @orpc/server · Upgrade to 1.14.8 or later · <= 1.14.7 · CVE-2026-77360 · GHSA-j9v4-rhgr-4m5f · amended
- High, CVSS 8.7
RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
Maven com.rabbitmq:amqp-client · Upgrade to 5.34.0 or later · < 5.34.0 · CVE-2026-75516 · GHSA-jh4v-gfqj-7rhx · amended
- Critical, CVSS 9.1
Marten's LINQ provider has SQL injection via unescaped string literals
NuGet marten · Upgrade to 9.13.0 or 8.37.4 by release line · >= 7.0.0, < 8.37.4; >= 9.0.0, < 9.13.0 · CVE-2026-75513 · GHSA-rfx3-98h7-v3xp · amended
- Medium, CVSS 5.3
LiteLLM Proxy has server-side request forgery via the
user_configrequest parameterPyPI litellm · Upgrade to 1.83.9 or later · <= 1.83.8 · CVE-2026-59823 · GHSA-hx8v-g79f-8w5f · amended
- High, CVSS 8.5
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
npm @cyclonedx/cyclonedx-npm · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2026-71538 · GHSA-q69g-4hcv-6jg4 · amended
- Critical, CVSS 9.1
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
npm @vendure/core · Upgrade to 3.7.0 or later · < 3.7.0 · CVE-2026-63472 · GHSA-6j36-r6pr-59x4 · amended
- Medium, CVSS 5.3
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
npm @vendure/core · Upgrade to 3.6.5 or later · >= 1.0.0, < 3.6.5 · CVE-2026-63461 · GHSA-xf65-r35x-wmmv · amended
- High, CVSS 7.5
Vendure: Unauthenticated ReDoS via
regexfilter on SQLite backendsnpm @vendure/core · Upgrade to 3.6.5 or later · <= 3.6.4 · CVE-2026-63460 · GHSA-jgm3-qmp2-c4p7 · amended
- High, CVSS 8.7
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
npm @vendure/dashboard · Upgrade to 3.6.5 or later · < 3.6.5 · CVE-2026-63459 · GHSA-xhq9-whgq-49j5 · amended
- Medium, CVSS 6.9
Nuxt OG Image has unauthenticated SSRF via
fonts[].pathURL parameternpm nuxt-og-image · Upgrade to 6.7.0 or later · >= 6.0.2, < 6.7.0 · CVE-2026-61793 · GHSA-q8hw-4fvp-9rwv · amended
- Medium, CVSS 6.8
RMCP: Custom HTTP headers leak to cross-origin redirect targets
crates.io rmcp · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2026-64684 · GHSA-9g45-5xwm-f3wc · amended
- Medium, CVSS 5.7
tarfile hardlink fallback ignores custom extraction filter rejection via None
Bitnami python-min +2 · Upgrade all 3 to 3.14.9, 3.13.16, 3.12.15 or 2 more by release line · < 3.10.22; >= 3.11.0, < 3.11.17; >= 3.12.0, < 3.12.15; >= 3.13.0, < 3.13.16; >= 3.14.0, < 3.14.9 · CVE-2026-87910 · amended
- Medium, CVSS 5.3
OpenFGA: ListUsers returns a deliberately-excluded user when a
but notexclusion under a type-bound wildcard is intersected (and) with another relation that also grants that userGo github.com/openfga/openfga · Upgrade to 1.18.1 or later · <= 1.18.0 · CVE-2026-61709 · GHSA-g3pg-frfm-pr2m · amended
- Medium, CVSS 4.8
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Packagist getgrav/grav · Upgrade to 2.0.0 or later · >= 2.0.0-rc.9, <= 2.0.0-rc.9 · CVE-2026-58657 · GHSA-ffmg-hfvg-jhg9 · amended
- High, CVSS 8.1
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
npm @nuxtjs/mdc · Upgrade to 0.22.1 or later · < 0.22.1 · CVE-2026-63671 · GHSA-mxm6-v9r6-r94c · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.