Critical, CVSS 10.0
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-46595 · GHSA-x527-x647-q7gg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 60 matching · newest first
- Critical, CVSS 9.1
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-42508 · GHSA-5cgq-3rg8-m6cv
- Critical, CVSS 9.1
golang.org/x/crypto vulnerable to infinite loop on large channel writes
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39834 · GHSA-rm3j-f69w-wqmq
- Critical, CVSS 9.1
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39831 · GHSA-89gr-r52h-f8rx
- High, CVSS 7.5
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39829 · GHSA-w879-237q-wc7r
- Critical, CVSS 9.1
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39830 · GHSA-vgwf-h737-ff37
- Medium, CVSS 6.5
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39827 · GHSA-qpw4-5x99-6vjp
- Medium, CVSS 5.3
golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39835 · GHSA-78mq-xcr3-xm33
- Medium, CVSS 6.3
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39828 · GHSA-45gg-vh54-h5m9
- High, CVSS 7.5
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
- Critical, CVSS 9.1
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39832 · GHSA-f5wc-c3c7-36mc
- Critical, CVSS 9.1
golang.org/x/crypto doesn't enforce invoking key constraints
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39833 · GHSA-jppx-rxg9-jmrx
- Medium, CVSS 5.3
golang.org/x/crypto: Invoking pathological inputs can lead to client panic
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-46598 · GHSA-9m57-25v3-79x9
- Critical, CVSS 9.9
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
PyPI lemur · Upgrade to 1.9.2 or later · < 1.9.2 · CVE-2026-55166 · GHSA-v2wp-frmc-5q3v · amended
- Medium, CVSS 4.8
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
PyPI lemur · Upgrade to 1.9.2 or later · < 1.9.2 · CVE-2026-55165 · GHSA-r9gp-7f88-9r54 · amended
- Medium, CVSS 4.9
Lemur user-update path stores plaintext passwords
PyPI lemur · Upgrade to 1.9.2 or later · <= 1.9.1 · CVE-2026-55164 · GHSA-q437-g7fv-2jvv · amended
- Medium, CVSS 6.3
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/
PyPI lemur · Upgrade to 1.9.2 or later · <= 1.9.1 · CVE-2026-55163 · GHSA-x3vf-mgxj-7785 · amended
- Medium, CVSS 6.3
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
PyPI lemur · Upgrade to 1.9.2 or later · <= 1.9.1 · CVE-2026-55162 · GHSA-54vg-pfh7-jq95 · amended
- High, CVSS 7.5
ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53461 · GHSA-g22q-f7gc-5jhr
- High, CVSS 7.5
ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53460 · GHSA-q62c-h75r-2xhc
- Medium, CVSS 5.5
ImageMagick: Policy Bypass can read disallowed files via symlink
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-49219 · GHSA-xcjm-wqff-m669
- High, CVSS 7.5
ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-49218 · GHSA-8pj9-6897-74xc
- Medium, CVSS 5.9
ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-48994 · GHSA-4v89-6mgq-6rgc
- Medium, CVSS 5.5
ImageMagick Vulnerable to Stack Overflow in its MVG Decoder
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-48734 · GHSA-h36c-3666-h489
- Medium, CVSS 4.7
ImageMagick has an Infinite Loop in subimage-search with crafted image
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-48733 · GHSA-5v62-8fq6-cp9m
A vendor fix does not resolve your finding until you verify it in your own systems.