Medium, CVSS 6.9
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
PyPI pypdf · Upgrade to 6.15.0 or later · < 6.15.0 · CVE-2026-82398 · GHSA-fc8x-2rww-xw9m
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2326–2350 of 30,910 matching · newest first
- Medium, CVSS 5.4
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Packagist studio-42/elfinder · Upgrade to 2.1.70 or later · < 2.1.70 · CVE-2026-81890 · GHSA-9hjf-w35w-6vx2 · amended
- High, CVSS 7.1
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
npm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · < 10.34.5; >= 11.0.0, < 11.11.0 · CVE-2026-82392 · GHSA-c59q-g84q-2gj5
- High, CVSS 7.5
pnpm: A tarball dependency's manifest
nameescapes node_modules → arbitrary file write/overwrite on installnpm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · < 10.34.5; >= 11.0.0, < 11.11.0 · CVE-2026-82393 · GHSA-vq4v-j7r6-jq4m
- Medium, CVSS 6.9
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81722 · GHSA-ww6m-cw3f-q94g
- Medium, CVSS 6.9
NLTK: Downloader.download follows hardlinks and overwrites outside-root files
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81727 · GHSA-f794-5jv7-7672
- High, CVSS 8.3
NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-81726 · GHSA-8mgp-746c-j5xp · amended
- Medium, CVSS 6.3
NLTK: Quadratic CPU Exhaustion in
XMLCorpusView._read_xml_fragment()PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81723 · GHSA-vp2x-qp44-57v7
- Medium, CVSS 6.9
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-12876 · GHSA-ff5c-cp5c-9wjf
- Medium, CVSS 6.9
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-81724 · GHSA-cw6x-m8jw-qmrh
- Low, CVSS 3.3
ImageMagick: Memory Leak when providing invalid options to the cli
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-66011 · GHSA-cvhv-g4rq-3hmw · amended
- Medium, CVSS 5.7
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
npm @humanfs/node · Upgrade to 0.16.8 or later · < 0.16.8 · GHSA-p498-v437-472g
- High, CVSS 7.8
Faker: helpers.fake exploitable into arbritary code execution
npm @faker-js/faker · Upgrade to 10.5.0 or later · <= 10.4.0 · CVE-2026-73231 · GHSA-qxc2-j82w-r537
- High, CVSS 7.7
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260704035520-68cc0f537dfa (pre-release) or later · < 0.0.0-20260704035520-68cc0f537dfa · CVE-2026-59832 · GHSA-275h-v5h9-vr82 · amended
- High, CVSS 7.5
SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260704035518-d0f0fe146fb0 (pre-release) or later · < 0.0.0-20260704035518-d0f0fe146fb0 · CVE-2026-59834 · GHSA-h89q-4j2h-7h88 · amended
- Medium, CVSS 6.1
Apache Spark History Server allows stored cross-site scripting through unescaped application names
Maven org.apache.spark:spark-core_2.12 +2 · Upgrade all 3 to 3.5.8 or later · >= 3.0.0, < 3.5.8 · CVE-2026-32773 · GHSA-9437-39hj-3c93 · amended
- Unrated
Use-after-free in
clearandretainwhen an element'sDroppanicscrates.io skiplist · Upgrade to 1.1.1 or later · >= 0.0.0-0, < 1.1.1 · GHSA-x6j6-3ffp-qrfr
- High, CVSS 8.7
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
Go google.golang.org/grpc · Upgrade to 1.83.1 or later · <= 1.83.0 · CVE-2026-84304 · GHSA-vp52-pcj8-j9qc · amended
- High, CVSS 7.3
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Packagist typo3/cms-backend · Upgrade to 13.4.34 or later · >= 13.0.0, < 13.4.34 · +1 more package · CVE-2026-19418 · GHSA-68jx-f42c-7599 · amended
- Medium, CVSS 6.5
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Packagist filament/filament · Upgrade to 5.7.6 or 4.12.6 by release line · >= 4.0.0, < 4.12.6; >= 5.0.0, < 5.7.6 · CVE-2026-84306 · GHSA-r3j6-gpjw-qfjr · amended
- Low, CVSS 3.7
Filament: Password validity disclosure for accounts denied panel access on login page
Packagist filament/filament · Upgrade to 5.7.5 or 4.12.5 by release line · >= 4.0.0, < 4.12.5; >= 5.0.0, < 5.7.5 · CVE-2026-84307 · GHSA-xwpv-pqxp-5v36 · amended
- High, CVSS 8.1
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
Packagist filament/filament · Upgrade to 5.7.0 or 4.12.0 by release line · >= 4.0.0, < 4.12.0; >= 5.0.0, < 5.7.0 · CVE-2026-77567 · GHSA-52xp-w8hr-xv3c · amended
- Medium, CVSS 4.8
pypdf: Possible long runtimes/large memory usage when retrieving outlines
PyPI pypdf · Upgrade to 6.16.1 or later · < 6.16.1 · CVE-2026-84310 · GHSA-23w6-3w8w-8484
- Medium, CVSS 4.8
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
PyPI pypdf · Upgrade to 6.16.1 or later · < 6.16.1 · CVE-2026-84311 · GHSA-763m-79hh-57f2
- Medium, CVSS 6.9
pypdf: Possible infinite loop for TreeObject.insert_child
PyPI pypdf · Upgrade to 6.16.0 or later · < 6.16.0 · CVE-2026-84309 · GHSA-jp53-mhqp-8xcg
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.