Knowledge cutoff

GPT-5 Mini knowledge cutoff: what it doesn’t know about your stack

GPT-5 Mini’s knowledge cutoff is May 31, 2024, 2 years and 5 months ago, per OpenAI’s API docs. Anything that shipped, broke or reached end of life since then is news to it.

Knowledge cutoff: May 31, 2024
Released: August 7, 2025
In coding agents: Cursor and GitHub Copilot
Status: Deprecated

“May 31, 2024 knowledge cutoff”

OpenAI shuts its snapshot down in the API on December 11, 2026.

Source: OpenAI API docs: GPT-5 Mini model page, checked Oct 14, 2026. The terms and dates are OpenAI’s own.

What changed since May 31, 2024

Since May 31, 2024, CISA has added 60 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog, GitHub has published 123 critical advisories for widely used npm and PyPI packages, 57 release lines have reached end of life and 53 new release lines have shipped. GPT-5 Mini can’t know about any of it unless a tool gives it live data.

60Exploited in the wild
123Critical advisories
57Reached end of life
53New release lines

Exploited in the wild60

The most notable, one per product or package, newest first.

CVE-2026-48710 added to CISA’s exploited list (Starlette)
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path…
Sep 2, 2026, CISA KEV
CVE-2026-34486 added to CISA’s exploited list (Apache Tomcat)
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.
Aug 4, 2026, CISA KEV
CVE-2026-45321 added to CISA’s exploited list (TanStack)
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware…
May 27, 2026, CISA KEV
CVE-2026-33634 added to CISA’s exploited list (Trivy)
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all…
Mar 26, 2026, CISA KEV
CVE-2025-11953 added to CISA’s exploited list (React Native CLI)
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro…
Feb 5, 2026, CISA KEV

Show the other 55

CVE-2016-3081 added to CISA’s exploited list (Apache Struts)
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is…
Oct 8, 2026, CISA KEV
CVE-2023-22894 added to CISA’s exploited list (Strapi)
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details…
Oct 8, 2026, CISA KEV
CVE-2026-87902 added to CISA’s exploited list (WordPress)
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable…
Sep 25, 2026, CISA KEV
CVE-2026-71362 added to CISA’s exploited list (Magento)
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to…
Sep 24, 2026, CISA KEV
CVE-2026-42016 added to CISA’s exploited list (JFrog Artifactory)
JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer…
Sep 11, 2026, CISA KEV
CVE-2026-42018 added to CISA’s exploited list (JFrog Artifactory)
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access…
Sep 11, 2026, CISA KEV
CVE-2026-85706 added to CISA’s exploited list (GitLab)
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper…
Sep 11, 2026, CISA KEV
CVE-2026-75650 added to CISA’s exploited list (Magento)
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to…
Sep 8, 2026, CISA KEV
CVE-2026-59822 added to CISA’s exploited list (LiteLLM)
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an…
Sep 2, 2026, CISA KEV
CVE-2026-49869 added to CISA’s exploited list (Kestra)
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without…
Sep 2, 2026, CISA KEV
CVE-2026-82329 added to CISA’s exploited list (JFrog Artifactory)
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain…
Sep 2, 2026, CISA KEV
CVE-2026-66384 added to CISA’s exploited list (JFrog Artifactory)
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability.
Aug 27, 2026, CISA KEV
CVE-2026-60004 added to CISA’s exploited list (Gitea)
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an…
Aug 25, 2026, CISA KEV
CVE-2026-64849 added to CISA’s exploited list (MLflow)
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and…
Aug 19, 2026, CISA KEV
CVE-2025-62593 added to CISA’s exploited list (Ray)
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution.
Aug 17, 2026, CISA KEV
CVE-2026-72898 added to CISA’s exploited list (Metabase)
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can…
Aug 11, 2026, CISA KEV
CVE-2026-63077 added to CISA’s exploited list (TeamCity)
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Aug 5, 2026, CISA KEV
CVE-2026-9198 added to CISA’s exploited list (Langflow)
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Aug 4, 2026, CISA KEV
CVE-2026-60137 added to CISA’s exploited list (WordPress)
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter.
Jul 21, 2026, CISA KEV
CVE-2026-63030 added to CISA’s exploited list (WordPress)
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Jul 21, 2026, CISA KEV
CVE-2026-0770 added to CISA’s exploited list (Langflow)
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected…
Jul 21, 2026, CISA KEV
CVE-2026-55255 added to CISA’s exploited list (Langflow)
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user…
Jul 7, 2026, CISA KEV
CVE-2026-42271 added to CISA’s exploited list (LiteLLM)
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run…
Jun 8, 2026, CISA KEV
CVE-2026-48027 added to CISA’s exploited list (Nx Console)
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published.
May 27, 2026, CISA KEV
CVE-2026-9082 added to CISA’s exploited list (Drupal)
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the…
May 22, 2026, CISA KEV
CVE-2025-34291 added to CISA’s exploited list (Langflow)
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as…
May 21, 2026, CISA KEV
CVE-2026-42208 added to CISA’s exploited list (LiteLLM)
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized…
May 8, 2026, CISA KEV
CVE-2026-39987 added to CISA’s exploited list (Marimo)
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Apr 23, 2026, CISA KEV
CVE-2024-27199 added to CISA’s exploited list (TeamCity)
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
Apr 20, 2026, CISA KEV
CVE-2026-34197 added to CISA’s exploited list (Apache ActiveMQ)
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Apr 16, 2026, CISA KEV
CVE-2026-33017 added to CISA’s exploited list (Langflow)
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Mar 25, 2026, CISA KEV
CVE-2025-32432 added to CISA’s exploited list (Craft CMS)
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
Mar 20, 2026, CISA KEV
CVE-2025-54068 added to CISA’s exploited list (Laravel Livewire)
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
Mar 20, 2026, CISA KEV
CVE-2025-68613 added to CISA’s exploited list (n8n)
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Mar 11, 2026, CISA KEV
CVE-2021-22175 added to CISA’s exploited list (GitLab)
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
Feb 18, 2026, CISA KEV
CVE-2021-39935 added to CISA’s exploited list (GitLab)
GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side…
Feb 3, 2026, CISA KEV
CVE-2025-31125 added to CISA’s exploited list (Vite)
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import.
Jan 22, 2026, CISA KEV
CVE-2025-54313 added to CISA’s exploited list (eslint-config-prettier)
Prettier eslint-config-prettier contains an embedded malicious code vulnerability.
Jan 22, 2026, CISA KEV
CVE-2025-8110 added to CISA’s exploited list (Gogs)
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Jan 12, 2026, CISA KEV
CVE-2025-14847 added to CISA’s exploited list (MongoDB)
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers.
Dec 29, 2025, CISA KEV
CVE-2025-55182 added to CISA’s exploited list (React)
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React…
Dec 5, 2025, CISA KEV
CVE-2025-54236 added to CISA’s exploited list (Magento)
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the…
Oct 24, 2025, CISA KEV
CVE-2021-43798 added to CISA’s exploited list (Grafana)
Grafana contains a path traversal vulnerability that could allow access to local files.
Oct 9, 2025, CISA KEV
CVE-2017-1000353 added to CISA’s exploited list (Jenkins)
Jenkins contains a remote code execution vulnerability.
Oct 2, 2025, CISA KEV
CVE-2016-10033 added to CISA’s exploited list (PHP)
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input.
Jul 7, 2025, CISA KEV
CVE-2025-35939 added to CISA’s exploited list (Craft CMS)
Craft CMS contains an external control of assumed-immutable web parameter vulnerability.
Jun 2, 2025, CISA KEV
CVE-2024-56145 added to CISA’s exploited list (Craft CMS)
Craft CMS contains a code injection vulnerability.
Jun 2, 2025, CISA KEV
CVE-2025-3248 added to CISA’s exploited list (Langflow)
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code…
May 5, 2025, CISA KEV
CVE-2024-38475 added to CISA’s exploited list (Apache HTTP Server)
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to…
May 1, 2025, CISA KEV
CVE-2025-24813 added to CISA’s exploited list (Apache Tomcat)
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial…
Apr 1, 2025, CISA KEV
CVE-2025-30066 added to CISA’s exploited list (tj-actions/changed-files)
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions…
Mar 18, 2025, CISA KEV
CVE-2025-23209 added to CISA’s exploited list (Craft CMS)
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
Feb 20, 2025, CISA KEV
CVE-2021-41277 added to CISA’s exploited list (Metabase)
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
Nov 12, 2024, CISA KEV
CVE-2024-23897 added to CISA’s exploited list (Jenkins)
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
Aug 19, 2024, CISA KEV
CVE-2024-34102 added to CISA’s exploited list (Magento)
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Jul 17, 2024, CISA KEV

Critical advisories123

The most notable, one per product or package, newest first.

handlebars: JavaScript injection (critical)
Fixed in 4.7.10.
Oct 8, 2026, GitHub Advisory Database
next: remote code execution in next/og ImageResponse (critical)
Fixed in 16.3.6.
Sep 30, 2026, GitHub Advisory Database
litellm: server-side template injection in the /prompts/test endpoint (critical)
Fixed in 1.83.7.
Aug 27, 2026, GitHub Advisory Database
next-auth: configuration errors can cause existence-based auth checks to fail open (critical)
Jul 23, 2026, GitHub Advisory Database
langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit (critical)
Fixed in 1.9.2.
Jun 19, 2026, GitHub Advisory Database

Show the other 118

handlebars: JavaScript injection via Own Property check bypass (critical)
Fixed in 4.7.10.
Oct 8, 2026, GitHub Advisory Database
payload: unauthorized update to collection documents (critical)
Fixed in 3.90.0.
Oct 7, 2026, GitHub Advisory Database
payload: Payload authentication token field handling issue (critical)
Fixed in 3.90.0.
Oct 7, 2026, GitHub Advisory Database
langflow: OS command injection (critical)
Fixed in 1.10.3.
Oct 7, 2026, GitHub Advisory Database
payload: field access control bypass on auth collections (critical)
Fixed in 3.90.0.
Oct 6, 2026, GitHub Advisory Database
payload: SQL injection in SQLite and Postgres (critical)
Fixed in 3.88.0.
Oct 6, 2026, GitHub Advisory Database
langflow: PythonREPLComponent executes unsandboxed Python code, enabling… (critical)
Fixed in 1.10.1.
Oct 6, 2026, GitHub Advisory Database
simple-git: simple-git unsafe-operation guard does not block trailer command… (critical)
Fixed in 4.0.1.
Oct 5, 2026, GitHub Advisory Database
seroval: fromJSON() Promise thenable assimilation invokes plugin-produced… (critical)
Fixed in 1.6.2.
Oct 5, 2026, GitHub Advisory Database
proxy-addr: IP spoofing via IPv4-mapped IPv6 trust subnet (critical)
Fixed in 2.0.8.
Oct 5, 2026, GitHub Advisory Database
langflow: weak Fernet key via random.seed() (critical)
Fixed in 1.10.1.
Oct 5, 2026, GitHub Advisory Database
langflow: unauthenticated Flow execution via webhook authentication bypass (critical)
Fixed in 1.9.1.
Oct 5, 2026, GitHub Advisory Database
pyjwt: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public… (critical)
Fixed in 2.14.0.
Sep 29, 2026, GitHub Advisory Database
anyio: TLSStream IDNA 2003 host name encoding enables potential TLS… (critical)
Fixed in 4.14.2.
Sep 18, 2026, GitHub Advisory Database
astro: remote code execution through AVIF image optimization (critical)
Fixed in 7.2.8.
Sep 8, 2026, GitHub Advisory Database
next: unauthenticated remote code execution in image optimization API (critical)
Fixed in 15.5.24 and 16.3.3.
Sep 8, 2026, GitHub Advisory Database
next: unauthenticated remote code execution on windows-hosted servers (critical)
Fixed in 15.5.24 and 16.3.3.
Sep 8, 2026, GitHub Advisory Database
gitpython: Dormant multi-line git-config values are corrupted into live injected… (critical)
Fixed in 3.1.59.
Sep 8, 2026, GitHub Advisory Database
nltk: Allowlisted pickle loaders still permit code execution in current source (critical)
Fixed in 3.10.3.
Sep 8, 2026, GitHub Advisory Database
nltk: unsafe Pickle deserialization in TransitionParser Allows remote code… (critical)
Fixed in 3.10.0.
Sep 8, 2026, GitHub Advisory Database
python-jose: python-jose algorithm confusion guard bypassed (critical)
Sep 3, 2026, GitHub Advisory Database
nltk: JVM argument injection bypass (critical)
Fixed in 3.10.3.
Sep 1, 2026, GitHub Advisory Database
chainlit: command injection (critical)
Fixed in 2.12.0.
Aug 25, 2026, GitHub Advisory Database
crypto-js: Insufficient Entropy in Cryptographic secret Generation (critical)
Fixed in 4.0.0.
Aug 7, 2026, GitHub Advisory Database
@nuxt/devtools: unauthenticated Nuxt DevTools RPC allows arbitrary command execution on… (critical)
Fixed in 3.3.1.
Aug 5, 2026, GitHub Advisory Database
sequelize: SQL injection (Oracle DB) (critical)
Fixed in 6.37.4.
Aug 3, 2026, GitHub Advisory Database
sentence-transformers: sentence-transformers local model loading bypasses trust_remote_code… (critical)
Fixed in 5.6.0.
Jul 31, 2026, GitHub Advisory Database
seroval: seroval.fromJSON() Promise resolver type confusion invokes… (critical)
Fixed in 1.5.3.
Jul 24, 2026, GitHub Advisory Database
@auth/core: email normalizer validates the address before Unicode normalization (critical)
Fixed in 0.41.3.
Jul 23, 2026, GitHub Advisory Database
tar: Decompression/parse DoS via unlimited input (critical)
Fixed in 7.5.19.
Jul 20, 2026, GitHub Advisory Database
better-auth: OAuth refresh-token replay (critical)
Fixed in 1.6.11.
Jul 7, 2026, GitHub Advisory Database
chainlit: session hijacking vulnerability (critical)
Fixed in 2.10.1.
Jun 22, 2026, GitHub Advisory Database
jupyter-server: stored XSS in NbconvertFileHandler / NbconvertPostHandler (critical)
Fixed in 2.20.0.
Jun 18, 2026, GitHub Advisory Database
langflow: unauthenticated file upload (critical)
Fixed in 1.9.1.
Jun 17, 2026, GitHub Advisory Database
litellm: authentication bypass via host header injection (critical)
Fixed in 1.84.0.
Jun 16, 2026, GitHub Advisory Database
vllm: OpenAI auth bypass (critical)
Fixed in 0.22.0.
Jun 16, 2026, GitHub Advisory Database
langflow: unauthenticated RCE in Shareable Playgrounds (critical)
Fixed in 1.9.2.
Jun 16, 2026, GitHub Advisory Database
electron: Buffer performs incorrect byte length calculations resulting in heap… (critical)
Fixed in 42.3.3.
Jun 15, 2026, GitHub Advisory Database
mlflow: environment variable injection in AI gateway secrets enables… (critical)
Fixed in 3.11.0.
Jun 3, 2026, GitHub Advisory Database
vitest: arbitrary file can be read and executed (critical)
Fixed in 4.1.0 and 3.2.6.
Jun 1, 2026, GitHub Advisory Database
mlflow: unauthorized access to multipart upload endpoints (critical)
Fixed in 3.10.0.
May 26, 2026, GitHub Advisory Database
mlflow: improper origin validation in MLflow Assistant /ajax-api endpoints… (critical)
Fixed in 3.10.0.
May 19, 2026, GitHub Advisory Database
sanitize-html: Apostrophe has default XSS via xmp raw-text passthrough in sanitize-html (critical)
Fixed in 2.17.4.
May 14, 2026, GitHub Advisory Database
n8n: XML node prototype pollution patch bypass (critical)
Fixed in 1.123.43 and 2.22.1.
May 14, 2026, GitHub Advisory Database
n8n: arbitrary file read via Git node (critical)
Fixed in 1.123.43 and 2.22.1.
May 14, 2026, GitHub Advisory Database
n8n: HTTP request node pagination prototype pollution to RCE (critical)
Fixed in 1.123.43 and 2.22.1.
May 14, 2026, GitHub Advisory Database
@strapi/strapi: Strapi may leak sensitive data (critical)
Fixed in 5.37.0.
May 14, 2026, GitHub Advisory Database
langflow: Langflow Knowledge Bases API is Vulnerable to path traversal (critical)
Fixed in 1.9.0.
May 5, 2026, GitHub Advisory Database
n8n: XML node prototype pollution that to RCE (critical)
Fixed in 2.18.1 and 2.17.4.
Apr 29, 2026, GitHub Advisory Database
n8n: prototype pollution in XML webhook Body parser that Leads to RCE (critical)
Fixed in 1.123.32 and 2.18.1.
Apr 29, 2026, GitHub Advisory Database
@clerk/nextjs: middleware-based route protection bypass (critical)
Fixed in 5.7.6 and 6.39.2.
Apr 16, 2026, GitHub Advisory Database
better-auth: two-Factor authentication bypass (critical)
Fixed in 1.4.9.
Apr 3, 2026, GitHub Advisory Database
litellm: authentication bypass via OIDC userinfo cache key collision (critical)
Fixed in 1.83.0.
Apr 3, 2026, GitHub Advisory Database
mlflow: FastAPI job endpoints under /ajax-api/3.0/jobs/* are not protected (critical)
Apr 3, 2026, GitHub Advisory Database
payload: pre-authentication account takeover (critical)
Fixed in 3.79.1.
Apr 1, 2026, GitHub Advisory Database
fastmcp: SSRF & path traversal vulnerability (critical)
Fixed in 3.2.0.
Mar 31, 2026, GitHub Advisory Database
mlflow: command injection when serving models with enable_mlserver=True (critical)
Fixed in 3.9.0.
Mar 31, 2026, GitHub Advisory Database
mlflow: MLflow command injection vulnerability (critical)
Fixed in 3.8.1.
Mar 30, 2026, GitHub Advisory Database
mlflow: MLFlow path traversal vulnerability (critical)
Mar 30, 2026, GitHub Advisory Database
handlebars: JavaScript injection via AST type confusion (critical)
Fixed in 4.7.9.
Mar 27, 2026, GitHub Advisory Database
n8n: prototype pollution in XML and GSuiteAdmin node parameters lead to RCE (critical)
Fixed in 2.14.1 and 2.13.3.
Mar 26, 2026, GitHub Advisory Database
langflow: authenticated code execution in Agentic Assistant validation (critical)
Fixed in 1.9.0.
Mar 26, 2026, GitHub Advisory Database
n8n: multiple remote code execution vulnerabilities in Merge node AlaSQL SQL… (critical)
Fixed in 2.14.1 and 2.13.3.
Mar 25, 2026, GitHub Advisory Database
litellm: two LiteLLM versions published containing credential harvesting malware (critical)
Mar 25, 2026, GitHub Advisory Database
langflow: arbitrary file write (RCE) via v2 API (critical)
Fixed in 1.9.0.
Mar 19, 2026, GitHub Advisory Database
jspdf: HTML injection in New Window paths (critical)
Fixed in 4.2.1.
Mar 17, 2026, GitHub Advisory Database
authlib: signature verification bypass (critical)
Fixed in 1.6.9.
Mar 16, 2026, GitHub Advisory Database
simple-git: blockUnsafeOperationsPlugin bypass (critical)
Fixed in 3.32.3.
Mar 10, 2026, GitHub Advisory Database
langflow: remote code execution in CSV agent (critical)
Feb 27, 2026, GitHub Advisory Database
n8n: expression sandbox escape Leads to RCE (critical)
Fixed in 1.123.22 and 2.9.3.
Feb 25, 2026, GitHub Advisory Database
n8n: arbitrary command execution via file write and Git Operations (critical)
Fixed in 1.123.8 and 2.2.0.
Feb 25, 2026, GitHub Advisory Database
n8n: potential remote code execution via Merge node (critical)
Fixed in 1.123.22 and 2.9.3.
Feb 25, 2026, GitHub Advisory Database
n8n: sandbox escape in its JavaScript Task runner (critical)
Fixed in 1.123.22 and 2.9.3.
Feb 25, 2026, GitHub Advisory Database
n8n: unauthenticated expression evaluation via Form node (critical)
Fixed in 1.123.22 and 2.9.3.
Feb 25, 2026, GitHub Advisory Database
mlflow: MLflow use of default password authentication bypass vulnerability (critical)
Feb 21, 2026, GitHub Advisory Database
fast-xml-parser: entity encoding bypass via regex injection in DOCTYPE entity names (critical)
Fixed in 5.3.5 and 4.5.4.
Feb 20, 2026, GitHub Advisory Database
nltk: Zip Slip vulnerability (critical)
Fixed in 3.9.3.
Feb 18, 2026, GitHub Advisory Database
n8n: Python sandbox escape (critical)
Fixed in 2.4.8.
Feb 4, 2026, GitHub Advisory Database
n8n: arbitrary file write leading to RCE (critical)
Fixed in 1.118.0 and 2.4.0.
Feb 4, 2026, GitHub Advisory Database
n8n: OS command injection in Git node (critical)
Fixed in 2.5.0 and 1.123.10.
Feb 4, 2026, GitHub Advisory Database
n8n: n8n's improper file access Controls Allow arbitrary file read (critical)
Fixed in 2.5.0 and 1.123.18.
Feb 4, 2026, GitHub Advisory Database
n8n: expression escape vulnerability Leading to RCE (critical)
Fixed in 1.123.17 and 2.5.2.
Feb 4, 2026, GitHub Advisory Database
n8n: command injection in Community package Installation (critical)
Fixed in 1.120.3.
Feb 4, 2026, GitHub Advisory Database
vllm: RCE in Video Processing (critical)
Fixed in 0.14.1.
Feb 2, 2026, GitHub Advisory Database
n8n: n8n unsafe Workflow expression evaluation Allows remote code execution (critical)
Fixed in 1.123.17 and 2.4.5.
Jan 27, 2026, GitHub Advisory Database
@react-router/node: path traversal in file session storage (critical)
Fixed in 7.9.4.
Jan 8, 2026, GitHub Advisory Database
n8n: unauthenticated file access via improper webhook request handling (critical)
Fixed in 1.121.0.
Jan 7, 2026, GitHub Advisory Database
n8n: RCE via arbitrary file write (critical)
Fixed in 1.121.3.
Jan 6, 2026, GitHub Advisory Database
jspdf: local file Inclusion/Path traversal vulnerability (critical)
Fixed in 4.0.0.
Jan 5, 2026, GitHub Advisory Database
n8n: arbitrary command execution in Pyodide based Python code node (critical)
Fixed in 2.0.0.
Dec 26, 2025, GitHub Advisory Database
langchain-core: LangChain serialization injection vulnerability enables secret… (critical)
Fixed in 1.2.5 and 0.3.81.
Dec 23, 2025, GitHub Advisory Database
n8n: remote code execution via Git node Custom pre-Commit Hook (critical)
Fixed in 1.119.2.
Dec 8, 2025, GitHub Advisory Database
next: RCE in React flight protocol (critical)
Fixed in 15.0.5 and 15.2.6.
Dec 3, 2025, GitHub Advisory Database
ray: Ray's New token authentication is Disabled by default (critical)
Nov 27, 2025, GitHub Advisory Database
django: SQL injection via _connector keyword argument in QuerySet and Q objects. (critical)
Fixed in 5.2.8 and 5.1.14.
Nov 5, 2025, GitHub Advisory Database
keras: deserialization of untrusted data (critical)
Fixed in 3.11.3.
Oct 17, 2025, GitHub Advisory Database
form-data: form-data uses unsafe random function in form-data for choosing boundary (critical)
Fixed in 2.5.4 and 3.0.4.
Jul 21, 2025, GitHub Advisory Database
llama-index: SQL injection (critical)
Fixed in 0.12.28.
Jun 5, 2025, GitHub Advisory Database
vllm: remote code execution via PyNcclPipe Communication service (critical)
Fixed in 0.8.5.
May 20, 2025, GitHub Advisory Database
vllm: remote code execution via Mooncake Integration (critical)
Fixed in 0.8.5.
Apr 29, 2025, GitHub Advisory Database
vllm: CVE-2025-24357 malicious model remote code execution fix bypass (critical)
Fixed in 0.8.0.
Apr 23, 2025, GitHub Advisory Database
torch: torch.load with weights_only=True leads to remote code execution (critical)
Fixed in 2.6.0.
Apr 18, 2025, GitHub Advisory Database
next: authorization bypass in Next.js middleware (critical)
Fixed in 13.5.9 and 14.2.25.
Mar 21, 2025, GitHub Advisory Database
vllm: remote code execution (critical)
Mar 20, 2025, GitHub Advisory Database
vllm: vLLM deserialization vulnerability in… (critical)
Mar 20, 2025, GitHub Advisory Database
vllm: vLLM deserialization of untrusted data vulnerability (critical)
Mar 20, 2025, GitHub Advisory Database
vllm: remote code execution via Mooncake Integration (critical)
Fixed in 0.8.0.
Mar 19, 2025, GitHub Advisory Database
koa: Inefficient Regular expression Complexity in koa (critical)
Fixed in 2.15.4 and 1.7.1.
Feb 12, 2025, GitHub Advisory Database
vitest: remote code execution (critical)
Fixed in 1.6.1 and 2.1.9.
Feb 4, 2025, GitHub Advisory Database
mongoose: Mongoose search injection vulnerability (critical)
Fixed in 8.9.5 and 7.8.4.
Jan 15, 2025, GitHub Advisory Database
gradio: Gradio Blocked path ACL bypass vulnerability (critical)
Fixed in 5.11.0.
Jan 14, 2025, GitHub Advisory Database
dompurify: tampering by prototype polution (critical)
Fixed in 2.4.2.
Oct 31, 2024, GitHub Advisory Database
gradio: users to access arbitrary files (critical)
Fixed in 4.19.2.
Sep 25, 2024, GitHub Advisory Database
llama-index-core: LlamaIndex includes an exec call for import {cls_name} (critical)
Fixed in 0.10.38.
Aug 22, 2024, GitHub Advisory Database
django: Django SQL injection vulnerability (critical)
Fixed in 5.0.8 and 4.2.15.
Aug 7, 2024, GitHub Advisory Database
nuxt: remote code execution via the browser when running the test locally (critical)
Fixed in 3.12.4.
Aug 5, 2024, GitHub Advisory Database
litellm: remote code execution based on using eval unsafely (critical)
Fixed in 1.40.16.
Jun 27, 2024, GitHub Advisory Database
mlflow: remote code execution in mlflow (critical)
Fixed in 2.9.0.
Jun 6, 2024, GitHub Advisory Database

Reached end of life57

The most notable, one per product or package, newest first.

Python 3.10 reached end of life
No more security fixes. Latest: Python 3.15.
Oct 1, 2026, endoflife.date
Node.js 20 reached end of life
No more security fixes. Current LTS: Node.js 24.
Apr 30, 2026, endoflife.date
PostgreSQL 13 reached end of life
No more security fixes. Latest: PostgreSQL 18.
Nov 13, 2025, endoflife.date
Next.js 14 reached end of life
No more security fixes. Current LTS: Next.js 16.
Oct 26, 2025, endoflife.date
Ubuntu 20.04 LTS reached end of life
No more security fixes. Current LTS: Ubuntu 26.04.
May 31, 2025, endoflife.date

Show the other 52

Debian 11 reached end of life
No more security fixes. Latest: Debian 13.
Aug 31, 2026, endoflife.date
Go 1.25 reached end of life
No more security fixes. Latest: Go 1.27.
Aug 19, 2026, endoflife.date
Ruby on Rails 7.2 reached end of life
No more security fixes. Latest: Ruby on Rails 8.1.
Aug 9, 2026, endoflife.date
Nuxt 3 reached end of life
No more security fixes. Latest: Nuxt 4.
Jul 31, 2026, endoflife.date
MongoDB 8.2 reached end of life
No more security fixes. Latest: MongoDB 9.0.
Jul 31, 2026, endoflife.date
Amazon Linux 2 reached end of life
No more security fixes. Latest: Amazon Linux 2023.
Jun 30, 2026, endoflife.date
Spring Boot 3.5 reached end of life
No more security fixes. Latest: Spring Boot 4.1.
Jun 30, 2026, endoflife.date
Kubernetes 1.33 reached end of life
No more security fixes. Latest: Kubernetes 1.37.
Jun 28, 2026, endoflife.date
Angular 19 reached end of life
No more security fixes. Latest: Angular 22.
May 19, 2026, endoflife.date
MySQL 8.0 reached end of life
No more security fixes. Current LTS: MySQL 9.7.
Apr 30, 2026, endoflife.date
Django 4.2 LTS reached end of life
No more security fixes. Current LTS: Django 5.2.
Apr 7, 2026, endoflife.date
Ruby 3.2 reached end of life
No more security fixes. Latest: Ruby 4.0.
Mar 31, 2026, endoflife.date
Laravel 11 reached end of life
No more security fixes. Latest: Laravel 13.
Mar 12, 2026, endoflife.date
Kubernetes 1.32 reached end of life
No more security fixes. Latest: Kubernetes 1.37.
Feb 28, 2026, endoflife.date
Go 1.24 reached end of life
No more security fixes. Latest: Go 1.27.
Feb 10, 2026, endoflife.date
PHP 8.1 reached end of life
No more security fixes. Latest: PHP 8.5.
Dec 31, 2025, endoflife.date
Spring Boot 3.4 reached end of life
No more security fixes. Latest: Spring Boot 4.1.
Dec 31, 2025, endoflife.date
Django 5.1 reached end of life
No more security fixes. Current LTS: Django 5.2.
Dec 3, 2025, endoflife.date
Angular 18 reached end of life
No more security fixes. Latest: Angular 22.
Nov 21, 2025, endoflife.date
Kubernetes 1.31 reached end of life
No more security fixes. Latest: Kubernetes 1.37.
Nov 11, 2025, endoflife.date
Python 3.9 reached end of life
No more security fixes. Latest: Python 3.15.
Oct 31, 2025, endoflife.date
Ruby on Rails 7.1 reached end of life
No more security fixes. Latest: Ruby on Rails 8.1.
Oct 1, 2025, endoflife.date
MongoDB 8.1 reached end of life
No more security fixes. Latest: MongoDB 9.0.
Sep 30, 2025, endoflife.date
Go 1.23 reached end of life
No more security fixes. Latest: Go 1.27.
Aug 12, 2025, endoflife.date
MongoDB 6.0 reached end of life
No more security fixes. Latest: MongoDB 9.0.
Jul 31, 2025, endoflife.date
Kubernetes 1.30 reached end of life
No more security fixes. Latest: Kubernetes 1.37.
Jul 15, 2025, endoflife.date
Spring Boot 3.3 reached end of life
No more security fixes. Latest: Spring Boot 4.1.
Jun 30, 2025, endoflife.date
Angular 17 reached end of life
No more security fixes. Latest: Angular 22.
May 15, 2025, endoflife.date
Node.js 18 reached end of life
No more security fixes. Current LTS: Node.js 24.
Apr 30, 2025, endoflife.date
Django 5.0 reached end of life
No more security fixes. Current LTS: Django 5.2.
Apr 2, 2025, endoflife.date
Ruby on Rails 7.0 reached end of life
No more security fixes. Latest: Ruby on Rails 8.1.
Apr 1, 2025, endoflife.date
Ruby 3.1 reached end of life
No more security fixes. Latest: Ruby 4.0.
Mar 26, 2025, endoflife.date
Kubernetes 1.29 reached end of life
No more security fixes. Latest: Kubernetes 1.37.
Feb 28, 2025, endoflife.date
Go 1.22 reached end of life
No more security fixes. Latest: Go 1.27.
Feb 11, 2025, endoflife.date
Laravel 10 reached end of life
No more security fixes. Latest: Laravel 13.
Feb 4, 2025, endoflife.date
Spring Boot 3.2 reached end of life
No more security fixes. Latest: Spring Boot 4.1.
Dec 31, 2024, endoflife.date
Next.js 13 reached end of life
No more security fixes. Current LTS: Next.js 16.
Dec 21, 2024, endoflife.date
PostgreSQL 12 reached end of life
No more security fixes. Latest: PostgreSQL 18.
Nov 21, 2024, endoflife.date
.NET 6 LTS reached end of life
No more security fixes. Current LTS: .NET 10.
Nov 12, 2024, endoflife.date
Angular 16 reached end of life
No more security fixes. Latest: Angular 22.
Nov 8, 2024, endoflife.date
MongoDB 5.0 reached end of life
No more security fixes. Latest: MongoDB 9.0.
Oct 31, 2024, endoflife.date
Kubernetes 1.28 reached end of life
No more security fixes. Latest: Kubernetes 1.37.
Oct 28, 2024, endoflife.date
Python 3.8 reached end of life
No more security fixes. Latest: Python 3.15.
Oct 7, 2024, endoflife.date
MongoDB 7.3 reached end of life
No more security fixes. Latest: MongoDB 9.0.
Oct 2, 2024, endoflife.date
Ruby on Rails 6.1 reached end of life
No more security fixes. Latest: Ruby on Rails 8.1.
Oct 1, 2024, endoflife.date
Vue 3.4 reached end of life
No more security fixes. Latest: Vue 3.5.
Sep 3, 2024, endoflife.date
Go 1.21 reached end of life
No more security fixes. Latest: Go 1.27.
Aug 13, 2024, endoflife.date
Redis 7.0 reached end of life
No more security fixes. Latest: Redis 8.10.
Jul 29, 2024, endoflife.date
Nuxt 2 reached end of life
No more security fixes. Latest: Nuxt 4.
Jun 30, 2024, endoflife.date
Debian 10 reached end of life
No more security fixes. Latest: Debian 13.
Jun 30, 2024, endoflife.date
Spring Boot 3.1 reached end of life
No more security fixes. Latest: Spring Boot 4.1.
Jun 30, 2024, endoflife.date
Kubernetes 1.27 reached end of life
No more security fixes. Latest: Kubernetes 1.37.
Jun 28, 2024, endoflife.date

New release lines53

The most notable, one per product or package, newest first.

Python 3.15 released
Latest version: 3.15.0.
Oct 9, 2026, endoflife.date
Node.js 26 released
Becomes LTS on Oct 28, 2026.
May 5, 2026, endoflife.date
Next.js 16 released
Latest version: 16.4.2.
Oct 22, 2025, endoflife.date
PostgreSQL 18 released
Latest version: 18.6.
Sep 25, 2025, endoflife.date
React 19 released
Latest version: 19.3.1.
Dec 5, 2024, endoflife.date

Show the other 48

MongoDB 9.0 released
Latest version: 9.0.4.
Sep 30, 2026, endoflife.date
Kubernetes 1.37 released
Latest version: 1.37.1.
Aug 26, 2026, endoflife.date
Go 1.27 released
Latest version: 1.27.2.
Aug 19, 2026, endoflife.date
Django 6.1 released
Latest version: 6.1.2.
Aug 5, 2026, endoflife.date
Angular 22 released
Latest version: 22.2.3.
Jun 3, 2026, endoflife.date
Ubuntu 26.04 LTS released
Latest version: 26.04.1.
Apr 23, 2026, endoflife.date
Kubernetes 1.36 released
Latest version: 1.36.5.
Apr 22, 2026, endoflife.date
MySQL 9.7 released
Latest version: 9.7.2.
Apr 21, 2026, endoflife.date
Laravel 13 released
Latest version: 13.37.0.
Mar 17, 2026, endoflife.date
Go 1.26 released
Latest version: 1.26.9.
Feb 10, 2026, endoflife.date
Ruby 4.0 released
Latest version: 4.0.7.
Dec 25, 2025, endoflife.date
Kubernetes 1.35 released
Latest version: 1.35.9.
Dec 17, 2025, endoflife.date
Django 6.0 released
Latest version: 6.0.9.
Dec 3, 2025, endoflife.date
Spring Boot 4.0 released
Latest version: 4.0.8.
Nov 30, 2025, endoflife.date
PHP 8.5 released
Latest version: 8.5.11.
Nov 20, 2025, endoflife.date
Angular 21 released
Latest version: 21.2.25.
Nov 19, 2025, endoflife.date
.NET 10 LTS released
Latest version: 10.0.13.
Nov 11, 2025, endoflife.date
Ruby on Rails 8.1 released
Latest version: 8.1.4.
Oct 22, 2025, endoflife.date
Node.js 25 released
Latest version: 25.9.0.
Oct 15, 2025, endoflife.date
Python 3.14 released
Latest version: 3.14.8.
Oct 7, 2025, endoflife.date
Java 25 LTS released
Latest version: 25.0.4.1+1.
Sep 22, 2025, endoflife.date
Kubernetes 1.34 released
Latest version: 1.34.12.
Aug 27, 2025, endoflife.date
Go 1.25 released
Latest version: 1.25.14.
Aug 12, 2025, endoflife.date
Debian 13 released
Latest version: 13.7.
Aug 9, 2025, endoflife.date
Nuxt 4 released
Latest version: 4.6.2.
Jul 16, 2025, endoflife.date
Angular 20 released
Latest version: 20.3.34.
May 28, 2025, endoflife.date
Node.js 24 released
Latest version: 24.22.0.
May 6, 2025, endoflife.date
Redis 8.0 released
Latest version: 8.0.6.
May 2, 2025, endoflife.date
Kubernetes 1.33 released
Latest version: 1.33.13.
Apr 23, 2025, endoflife.date
Django 5.2 LTS released
Latest version: 5.2.18.
Apr 2, 2025, endoflife.date
Laravel 12 released
Latest version: 12.70.0.
Feb 24, 2025, endoflife.date
Go 1.24 released
Latest version: 1.24.13.
Feb 11, 2025, endoflife.date
Ruby 3.4 released
Latest version: 3.4.11.
Dec 24, 2024, endoflife.date
Kubernetes 1.32 released
Latest version: 1.32.13.
Dec 11, 2024, endoflife.date
PHP 8.4 released
Latest version: 8.4.26.
Nov 21, 2024, endoflife.date
Angular 19 released
Latest version: 19.2.25.
Nov 19, 2024, endoflife.date
.NET 9 released
Latest version: 9.0.21.
Nov 12, 2024, endoflife.date
Ruby on Rails 8.0 released
Latest version: 8.0.5.1.
Nov 7, 2024, endoflife.date
MongoDB 8.0 released
Latest version: 8.0.34.
Oct 31, 2024, endoflife.date
Next.js 15 released
Latest version: 15.5.28.
Oct 21, 2024, endoflife.date
Node.js 23 released
Latest version: 23.11.1.
Oct 16, 2024, endoflife.date
Python 3.13 released
Latest version: 3.13.16.
Oct 7, 2024, endoflife.date
PostgreSQL 17 released
Latest version: 17.11.
Sep 26, 2024, endoflife.date
Vue 3.5 released
Latest version: 3.5.44.
Sep 3, 2024, endoflife.date
Go 1.23 released
Latest version: 1.23.12.
Aug 13, 2024, endoflife.date
Kubernetes 1.31 released
Latest version: 1.31.14.
Aug 13, 2024, endoflife.date
Ruby on Rails 7.2 released
Latest version: 7.2.4.
Aug 9, 2024, endoflife.date
Django 5.1 released
Latest version: 5.1.15.
Aug 7, 2024, endoflife.date

Events last checked Oct 17, 2026, 09:20 UTC against CISA KEV, GitHub Advisory Database and endoflife.date.

What counts: vulnerabilities CISA confirms are exploited, in software web apps commonly run; critical GitHub advisories on widely used npm and PyPI packages; and release lines of popular runtimes, frameworks and databases reaching end of life or shipping.

How to give Cursor or GitHub Copilot today’s data

GPT-5 Mini only knows what was in its training data. StackPrism’s MCP server lets your agent check packages and services against live vulnerability, end-of-life and outage data while it works. How the MCP server works.

Create a free account and an access token on the Connect page.
Add the server to your agent, with your token in place of <YOUR_TOKEN>.
Ask it to “check whether my dependencies are safe with StackPrism”.

Cursor

Add this to .cursor/mcp.json in your project, or ~/.cursor/mcp.json for every project. Keep the file out of git: it holds your token.

mcp.json

{
  "mcpServers": {
    "stackprism": {
      "url": "https://stackprism.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

StackPrism then shows under MCP in Cursor’s settings.

GitHub Copilot

Any MCP client that supports Streamable HTTP can connect with the URL and header below. For clients that only run local servers, use the mcp-remote bridge.

Server URL

https://stackprism.ai/api/mcp

Header

Authorization: Bearer <YOUR_TOKEN>

Or bridge it over stdio (needs Node)

$ npx -y mcp-remote https://stackprism.ai/api/mcp --header "Authorization: Bearer <YOUR_TOKEN>"

Check your repo against today

Paste a public GitHub repo and see which dependencies are vulnerable, end of life or deprecated today, with a fix task to hand your coding agent.

Free, no sign-up. No repo handy? See a sample report.

Questions

What is GPT-5 Mini’s knowledge cutoff?

GPT-5 Mini’s knowledge cutoff is May 31, 2024, 2 years and 5 months ago, per OpenAI’s API docs. Source: GPT-5 Mini model page.

What has changed since GPT-5 Mini’s cutoff?

The most notable: CVE-2026-48710 added to CISA’s exploited list (Starlette) (Sep 2, 2026); handlebars: JavaScript injection (critical) (Oct 8, 2026); Node.js 20 reached end of life (Apr 30, 2026).

How do I give GPT-5 Mini current information?

Give it a tool that reads live data. StackPrism’s MCP server lets your coding agent check packages and services against live vulnerability, end-of-life and outage data while it works. Set it up in a few minutes.