High, CVSS 8.7
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
PyPI cryptography · Upgrade to 49.0.0 or later · >= 42.0.0, < 49.0.0 · CVE-2026-69249 · GHSA-jwv3-5hgf-82ww
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.2
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
PyPI cryptography · Upgrade to 50.0.0 or later · >= 44.0.0, < 50.0.0 · CVE-2026-69247 · GHSA-g6cj-pr64-35w5
- High, CVSS 7.2
Guzzle: Noncanonical host can bypass host-based checks
Packagist guzzlehttp/guzzle · Upgrade to 8.0.1 or 7.15.2 by release line · < 7.15.2; >= 8.0.0, < 8.0.1 · CVE-2026-69246 · GHSA-v5mv-p594-2x33 · amended
- High, CVSS 7.1
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
PyPI aiohttp · Upgrade to 3.14.3 or later · <= 3.14.2 · CVE-2026-69244 · GHSA-cq5v-8q36-5273
- Critical, CVSS 9.8
Sequelize: SQL Injection (Oracle DB)
npm sequelize · Upgrade to 6.37.4 or later · < 6.37.4 · CVE-2026-69240 · GHSA-v8fg-2rw7-q452 · amended
- High, CVSS 8.1
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
PyPI gitpython · Upgrade to 3.1.57 or later · <= 3.1.56 · GHSA-3f7w-8rr8-f37f
- High, CVSS 7.7
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
npm ip-address · Upgrade to 10.3.1 or later · <= 10.3.0 · CVE-2026-69192 · GHSA-mwp4-54f8-5fhr
- High, CVSS 7.4
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
npm undici · Upgrade to 8.9.0 or 7.29.0 by release line · >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-13697 · GHSA-4cwx-7wf7-3272
- High, CVSS 7.5
fast-uri vulnerable to host confusion via backslash authority introducer
npm fast-uri · Upgrade to 4.1.2, 3.1.5 or 2.4.4 by release line · < 2.4.4; >= 3.0.0, < 3.1.5; >= 4.0.0, < 4.1.2 · CVE-2026-18446 · GHSA-7p8r-x3mc-p8w7
- High, CVSS 7.5
Socket.IO: Zero-attachment Memory Exhaustion
npm socket.io-parser · Upgrade to 4.2.7, 3.4.5 or 3.3.6 by release line · >= 4.0.0, < 4.2.7; >= 3.4.0, < 3.4.5; < 3.3.6 · CVE-2026-69185 · GHSA-2m8v-j782-fhvr · amended
- High, CVSS 7.5
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
npm brace-expansion · Upgrade to 5.0.9, 3.0.6, 2.1.4 or 1.1.18 by release line · < 1.1.18; >= 2.0.0, < 2.1.4; >= 3.0.0, < 3.0.6; >= 4.0.0, < 5.0.9 · CVE-2026-69152 · GHSA-rgw5-rvv9-x895
- High, CVSS 7.6
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
npm @angular/compiler +1 · Upgrade all 2 to 22.0.1, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-69151 · GHSA-jj27-h5hq-8x99
- High, CVSS 8.6
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
npm @angular/platform-server · Upgrade to 22.0.7, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.7; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-69149 · GHSA-vpx6-8pjr-4g3v
- High, CVSS 8.8
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
npm @angular/common · Upgrade to 22.0.2, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.2; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-68945 · GHSA-jhpw-976m-542j
- High, CVSS 8.2
Auto-Reseeding HMAC-DRBG could panic for some output lengths
crates.io libcrux-hmac-drbg · Upgrade to 0.0.2 or later · >= 0.0.0-0, < 0.0.2 · amended
- High, CVSS 8.7
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · +3 more packages · CVE-2026-13506 · GHSA-qp49-qgx5-5m26 · amended
- Critical, CVSS 9.3
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · +3 more packages · CVE-2026-8763 · GHSA-9pwp-9qqc-pr26 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.