Medium, CVSS 5.1
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-84305 · GHSA-cfqr-cjx5-5jcm
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
2351–2375 of 30,910 matching · newest first
- Medium, CVSS 5.4
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
npm sanitize-html · Upgrade to 2.17.7 or later · >= 1.9.0, <= 2.17.6 · CVE-2026-84371 · GHSA-g8qq-57p8-ggw5
- Critical, CVSS 9.3
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79675 · GHSA-m4rf-3fr8-xwx3 · amended
- High, CVSS 7.5
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Packagist league/commonmark · Upgrade to 2.10.0 or later · >= 1.5.0, < 2.10.0 · CVE-2026-86428 · GHSA-8rr7-cvq3-gmfh · amended
- High, CVSS 8.5
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-78680 · GHSA-6hwm-xvph-95vm
- High, CVSS 7.5
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Packagist league/commonmark · Upgrade to 2.9.1 or later · >= 1.5.0, < 2.9.1 · CVE-2026-86429 · GHSA-jjv6-8j6v-6j52 · amended
- High, CVSS 7.2
league/commonmark XSS:
on*event-handler filter inAttributesExtensionbypassed with a U+000C form feedPackagist league/commonmark · Upgrade to 2.9.1 or later · >= 2.7.0, < 2.9.1 · CVE-2026-86431 · GHSA-f8fg-pg57-v4j8 · amended
- High, CVSS 7.5
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Packagist league/commonmark · Upgrade to 2.9.1 or later · >= 0.6.0, < 2.9.1 · CVE-2026-86430 · GHSA-j8pm-gj4c-rq4x · amended
- Medium, CVSS 6.9
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
PyPI tornado · Upgrade to 6.5.8 or later · <= 6.5.7 · GHSA-8423-8fgw-73vq
- Low, CVSS 2.3
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive
**kwargspath inset_cookiePyPI tornado · Upgrade to 6.5.8 or later · >= 6.5.5, < 6.5.8 · GHSA-wwv5-g3v4-889x
- Medium, CVSS 5.3
Django REST framework: Potential bypass of Django
DATA_UPLOAD_MAX_MEMORY_SIZEwhen parsing oversized JSON and urlencoded request bodies via DRFrequest.dataPyPI djangorestframework · Upgrade to 3.17.2 or later · < 3.17.2 · CVE-2026-73228 · GHSA-2m8g-3cmr-wg3w
- Medium, CVSS 4.3
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
PyPI djangorestframework · Upgrade to 3.17.2 or later · <= 3.17.1 · CVE-2026-73229 · GHSA-g47c-3xmw-q6m2
- High, CVSS 7.4
nanoid: Integer Overflow or Wraparound
npm nanoid · Upgrade to 5.1.11 or 3.3.12 by release line · < 3.3.12; >= 4.0.0, < 5.1.11 · CVE-2026-73086 · GHSA-xwg4-73v4-xw9w
- High, CVSS 7.4
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
npm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · >= 11.0.0, < 11.11.0; >= 10.7.0, < 10.34.5 · GHSA-vx52-2968-3vc6
- High, CVSS 7.1
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
npm pnpm · Upgrade to 12.0.0-alpha.5 (pre-release) or later · >= 12.0.0-alpha.0, < 12.0.0-alpha.5 · GHSA-2rx9-3g3h-c2jv · amended
- Medium, CVSS 6.5
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
npm @appium/base-driver · Upgrade to 10.7.0 or later · <= 10.6.0 · CVE-2026-58191 · GHSA-3wgp-x9p5-c7cc
- High, CVSS 8.8
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
PyPI mlflow · Upgrade to 3.15.0 or later · >= 2.1.0, < 3.15.0 · GHSA-gqvg-gmmx-x4hm
- High, CVSS 7.5
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
npm browserslist · Upgrade to 4.28.7 or later · <= 4.28.6 · CVE-2026-73089 · GHSA-c83g-rgw3-j3cx
- High, CVSS 7.5
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
npm browserslist · Upgrade to 4.28.7 or later · <= 4.28.6 · CVE-2026-73088 · GHSA-73wf-gq98-2v4g
- High, CVSS 8.2
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
npm mysql2 · Upgrade to 3.22.0 or later · < 3.22.0 · GHSA-3f6p-5ww8-9rcr
- Medium, CVSS 6.9
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Packagist smarty/smarty · Upgrade to 5.8.2 or 4.5.7 by release line · >= 5.0.0, < 5.8.2; < 4.5.7 · CVE-2026-62993 · GHSA-cq55-c7wv-pxmq · amended
- Medium, CVSS 6.9
Kirby: System path exposure from error messages in the REST API
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · <= 4.9.4; >= 5.0.0, < 5.5.2 · CVE-2026-69127 · GHSA-rf2p-vh74-7vvh · amended
- High, CVSS 7.5
jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input
Maven org.jolokia:jolokia-service-jsr160 · Upgrade to 2.6.2 or later · < 2.6.2 · CVE-2026-84218 · GHSA-c9ff-59g8-m36q · amended
- Medium, CVSS 5.9
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
npm mysql2 · Upgrade to 3.23.1 or later · <= 3.23.0 · GHSA-rgwj-5xj2-c3m3
- High, CVSS 7.1
Kirby: File upload permissions are not checked during processing of chunk data
Packagist getkirby/cms · Upgrade to 5.5.2 or later · >= 5.0.0, < 5.5.2 · CVE-2026-71415 · GHSA-67mx-6wf2-92xp · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.