Sign inCreate account

Recent vulnerabilities

A short list of the most serious problems of the last months in the frameworks, libraries and AI tools that small teams build on: what each one is in plain words, who is affected, how to check your project and how to fix it. Each entry comes from a primary source (NVD, GitHub advisories, the vendor, CISA).

List updated November 10, 2026. 21 advisories.

Check your project in one command

Run this in your project's folder. It downloads the xsec CLI from its public release, checks its SHA-256 against the release's checksums and only then runs xsec deps, which reads your lockfiles and compares them with this list. Nothing about your project leaves your computer.

Linux (x86_64 or arm64), WSL and CI runners
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps
macOS or Windows, with Docker
docker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'
Already have the CLI?
xsec deps
On every pull request, with the GitHub Action
- uses: actions/checkout@v4 - uses: xtruct-col/xsec-action@v1 with: deps: true

The xsec Action runs the same check on pull requests when your checkout has a lockfile, and fails the check on critical problems (deps-fail-on).

Lockfiles it reads: package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock (classic and berry), bun.lock, requirements*.txt (== pins), poetry.lock, uv.lock, Pipfile.lock, Gemfile.lock, composer.lock, go.sum, Cargo.lock, packages.lock.json (NuGet), gradle.lockfile, pom.xml (literal versions), Package.resolved (Swift), pubspec.lock, mix.lock, and .nvmrc / .node-version for Node.js itself.

This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.

Learn →