High, CVSS 7.5
pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · < 0.6.5 · CVE-2026-119196 · GHSA-2qm8-x737-gmw5 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
201–225 of 30,910 matching · newest first
- High, CVSS 7.5
pyasn1 has quadratic-complexity denial of service in binary REAL decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · < 0.6.5 · CVE-2026-119197 · GHSA-mm57-4v3p-rchx · amended
- High, CVSS 7.5
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · < 0.6.5 · CVE-2026-119195 · GHSA-9m75-vc3g-4x39 · amended
- High, CVSS 7.5
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
PyPI pyasn1 · Upgrade to 0.6.5 or later · >= 0.3.3, < 0.6.5 · CVE-2026-119194 · GHSA-fm9c-5rcf-2q5p · amended
- Low, CVSS 3.7
Forge: ASN.1 OID first arc truncation in asn1.oidToDer
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118775 · GHSA-4642-5mcj-2rqw · amended
- Medium, CVSS 4.8
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118777 · GHSA-6wvx-3r32-xmcg · amended
- Medium, CVSS 5.9
Forge: TLS client crash when the server sends no certificate
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118778 · GHSA-525v-9gp9-w22h · amended
- High, CVSS 7.5
Forge: Regular expression denial of service in PEM decoding (pem.decode)
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118779 · GHSA-7wch-p9px-956x · amended
- Low, CVSS 2.9
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118781 · GHSA-h6cr-wjv9-3cpp · amended
- Low, CVSS 3.7
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118780 · GHSA-4487-j8r4-4g2f · amended
- Medium, CVSS 5.9
Forge: AES-GCM authentication bypass via unvalidated tagLength option
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119186 · GHSA-5cwg-6vw7-rj6p · amended
- High, CVSS 7.5
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118782 · GHSA-jc66-7q78-782g · amended
- High, CVSS 7.5
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119188 · GHSA-8hrf-8g6f-7xwp · amended
- High, CVSS 7.5
Forge: Denial of service in TLS record processing via call stack exhaustion
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119187 · GHSA-hqq3-7jhf-c5jx · amended
- High, CVSS 7.4
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119190 · GHSA-5x38-2vff-x55p · amended
- Medium, CVSS 5.4
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling
Packagist phpunit/phpunit · Upgrade to 13.4.4 or later · >= 13.4.0, < 13.4.4 · CVE-2026-119193 · GHSA-9vw2-f4vp-x7gf · amended
- Medium, CVSS 4.8
Nuxt dev server exposes generated appSecret through Vite file serving
npm @nuxt/vite-builder · Upgrade to 4.6.3 or later · >= 4.6.0, < 4.6.3 · CVE-2026-119201 · GHSA-3xf4-9g3c-4h4w · amended
- Medium, CVSS 6.5
Nuxt: Dot segments in the request path bypass
server/middlewarepath checks and server route rules on page routesnpm nuxt +1 · Upgrade all 2 to 4.6.3 or later · >= 4.6.0, < 4.6.3 · CVE-2026-119200 · GHSA-9v7c-q64q-vv33 · amended
- Medium, CVSS 5.9
Nuxt dev server arbitrary file read through client error reports
npm @nuxt/vite-builder · Upgrade to 4.6.3 or later · >= 4.6.0, < 4.6.3 · CVE-2026-119198 · GHSA-x287-wcfc-q46c · amended
- Medium, CVSS 5.9
Nuxt dev server exposes private runtime config through the Nitro dev bundle
npm @nuxt/vite-builder · Upgrade to 4.6.3 or later · >= 3.0.0, < 4.6.3 · CVE-2026-119199 · GHSA-648h-gw55-m2g7 · amended
- High, CVSS 7.4
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
npm @sigstore/oci · Upgrade to 0.7.2 or later · < 0.7.2 · CVE-2026-118763 · GHSA-j63v-mwhm-56jx · amended
- Medium, CVSS 5.9
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.11, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · CVE-2026-119276 · GHSA-h599-m3w5-9m7x · amended
- Medium, CVSS 5.9
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.10, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.10 · CVE-2026-119279 · GHSA-797x-p4mc-jwpm · amended
- Low, CVSS 3.7
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.11, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · CVE-2026-119280 · GHSA-4jq2-8v3c-97w8 · amended
- Medium, CVSS 5.9
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.11, 3.4.5 or 3.3.7 by release line · >= 3.0.0, < 3.3.7; >= 3.4.0, < 3.4.5; >= 3.5.0, < 3.5.11 · CVE-2026-119210 · GHSA-fhx5-2xqw-2cgm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.