Medium, CVSS 6.9
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
PyPI cryptography · Upgrade to 49.0.0 or later · >= 45.0.0, < 49.0.0 · CVE-2026-69248 · GHSA-m2h6-j472-rp4c
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 32 matching · newest first
- High, CVSS 8.7
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
PyPI cryptography · Upgrade to 49.0.0 or later · >= 42.0.0, < 49.0.0 · CVE-2026-69249 · GHSA-jwv3-5hgf-82ww
- High, CVSS 8.2
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
PyPI cryptography · Upgrade to 50.0.0 or later · >= 44.0.0, < 50.0.0 · CVE-2026-69247 · GHSA-g6cj-pr64-35w5
- High, CVSS 7.2
Guzzle: Noncanonical host can bypass host-based checks
Packagist guzzlehttp/guzzle · Upgrade to 8.0.1 or 7.15.2 by release line · < 7.15.2; >= 8.0.0, < 8.0.1 · CVE-2026-69246 · GHSA-v5mv-p594-2x33 · amended
- Medium, CVSS 6.5
Guzzle: Noncanonical cookie domain keeps subdomain scope
Packagist guzzlehttp/guzzle · Upgrade to 8.0.1 or 7.15.2 by release line · < 7.15.2; >= 8.0.0, < 8.0.1 · CVE-2026-69245 · GHSA-f7vp-7xgx-4w4r · amended
- High, CVSS 7.1
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
PyPI aiohttp · Upgrade to 3.14.3 or later · <= 3.14.2 · CVE-2026-69244 · GHSA-cq5v-8q36-5273
- Medium, CVSS 6.3
AIOHTTP: HTTP request smuggling via WebSocket upgrade
PyPI aiohttp · Upgrade to 3.14.2 or later · <= 3.14.1 · CVE-2026-69243 · GHSA-mfx4-hv73-q22v
- Medium, CVSS 6.9
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
PyPI aiohttp · Upgrade to 3.14.2 or later · <= 3.14.1 · CVE-2026-59881 · GHSA-mq44-7p77-q5h7
- Critical, CVSS 9.8
Sequelize: SQL Injection (Oracle DB)
npm sequelize · Upgrade to 6.37.4 or later · < 6.37.4 · CVE-2026-69240 · GHSA-v8fg-2rw7-q452 · amended
- Medium, CVSS 5.3
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
npm hono · Upgrade to 4.12.34 or later · < 4.12.34 · CVE-2026-69207 · GHSA-8j4g-w8fx-2239
- Medium, CVSS 5.4
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
PyPI gitpython · Upgrade to 3.1.56 or later · <= 3.1.55 · GHSA-p538-c434-8v24
- Medium, CVSS 6.5
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
PyPI gitpython · Upgrade to 3.1.57 or later · <= 3.1.56 · GHSA-539m-9xh6-q6rr
- High, CVSS 8.1
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
PyPI gitpython · Upgrade to 3.1.57 or later · <= 3.1.56 · GHSA-3f7w-8rr8-f37f
- High, CVSS 7.7
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
npm ip-address · Upgrade to 10.3.1 or later · <= 10.3.0 · CVE-2026-69192 · GHSA-mwp4-54f8-5fhr
- Medium, CVSS 6.9
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
npm ip-address · Upgrade to 10.2.2 or later · >= 10.1.1, <= 10.2.1 · CVE-2026-69198 · GHSA-4xrf-jv44-h6hh
- Medium, CVSS 6.9
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
npm ip-address · Upgrade to 10.2.1 or later · >= 10.1.1, <= 10.2.0 · CVE-2026-54272 · GHSA-22jq-vg5j-6vgg · amended
- Medium, CVSS 4.2
undici vulnerable to CRLF Injection via blob-like body 'type' property
npm undici · Upgrade to 8.9.0, 7.29.0 or 6.28.0 by release line · < 6.28.0; >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-15157 · GHSA-m8rv-5g2x-5cg5
- Medium, CVSS 5.9
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
npm undici · Upgrade to 8.9.0 or 7.29.0 by release line · >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-14643 · GHSA-jr45-8vmc-qm54
- Medium, CVSS 4.8
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
npm undici · Upgrade to 8.9.0, 7.29.0 or 6.28.0 by release line · < 6.28.0; >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-16729 · GHSA-v3r7-h72x-cjcm
- Medium, CVSS 4.8
undici vulnerable to downstream response desynchronization via retry interceptor
npm undici · Upgrade to 8.9.0, 7.29.0 or 6.28.0 by release line · < 6.28.0; >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-16728 · GHSA-8xcm-r25x-g524
- High, CVSS 7.4
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
npm undici · Upgrade to 8.9.0 or 7.29.0 by release line · >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-13697 · GHSA-4cwx-7wf7-3272
- High, CVSS 7.5
fast-uri vulnerable to host confusion via backslash authority introducer
npm fast-uri · Upgrade to 4.1.2, 3.1.5 or 2.4.4 by release line · < 2.4.4; >= 3.0.0, < 3.1.5; >= 4.0.0, < 4.1.2 · CVE-2026-18446 · GHSA-7p8r-x3mc-p8w7
- High, CVSS 7.5
Socket.IO: Zero-attachment Memory Exhaustion
npm socket.io-parser · Upgrade to 4.2.7, 3.4.5 or 3.3.6 by release line · >= 4.0.0, < 4.2.7; >= 3.4.0, < 3.4.5; < 3.3.6 · CVE-2026-69185 · GHSA-2m8v-j782-fhvr · amended
- Medium, CVSS 6.3
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when
fromis unsetnpm postcss · Upgrade to 8.5.23 or later · <= 8.5.22 · CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp
- High, CVSS 7.5
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
npm brace-expansion · Upgrade to 5.0.9, 3.0.6, 2.1.4 or 1.1.18 by release line · < 1.1.18; >= 2.0.0, < 2.1.4; >= 3.0.0, < 3.0.6; >= 4.0.0, < 5.0.9 · CVE-2026-69152 · GHSA-rgw5-rvv9-x895
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.