PHP_CodeSniffer gitblame report command injection via crafted filename
Packagist squizlabs/php_codesniffer · Upgrade to 4.0.2 or 3.13.6 by release line · < 3.13.6; >= 4.0.0, < 4.0.2 · CVE-2026-67434 · GHSA-hmqg-cxww-wqhq · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Packagist squizlabs/php_codesniffer · Upgrade to 4.0.2 or 3.13.6 by release line · < 3.13.6; >= 4.0.0, < 4.0.2 · CVE-2026-67434 · GHSA-hmqg-cxww-wqhq · amended
npm ngx-extended-pdf-viewer · Upgrade to 29.0.0-rc.3 (pre-release) or later · >= 27.0.0-rc.0, < 29.0.0-rc.3 · GHSA-w9hm-4m3m-fxmm
npm pdfjs-dist · Upgrade to 6.2.108 or later · >= 5.6.83, < 6.2.108 · CVE-2026-16633 · GHSA-hq66-cqwq-w95j
Packagist craftcms/cms · Upgrade to 5.10.7 or 4.18.3 by release line · >= 5.0.0-RC1, < 5.10.7; >= 4.0.0-RC1, < 4.18.3 · CVE-2026-72781 · GHSA-f5wm-88jv-g5hx · amended
condition.config JSON cleanse bypassPackagist craftcms/cms · Upgrade to 5.10.6 or 4.18.2 by release line · >= 5.0.0-RC1, < 5.10.6; >= 4.0.0-RC1, < 4.18.2 · CVE-2026-72778 · GHSA-265m-7826-wjqm · amended
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 2.0.0, < 2.9.0 · CVE-2026-86434 · GHSA-mh25-x5hq-wrqp · amended
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 1.5.0, < 2.9.0 · GHSA-jfm3-95jq-q3rf · amended
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 1.5.0, < 2.9.0 · GHSA-g2gp-3wwq-f4ph · amended
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 0.6.0, < 2.9.0 · CVE-2026-71488 · GHSA-2q4p-g7hv-5rgv · amended
npm js-yaml · Upgrade to 4.3.1 or 3.15.1 by release line · >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.15.1 · GHSA-5p4m-2wfm-xmqj
Packagist statamic/cms · Upgrade to 6.24.0 or 5.74.1 by release line · < 5.74.1; >= 6.0.0, < 6.24.0 · CVE-2026-64665 · GHSA-93qh-5269-9wcf · amended
BigInt division panics, and two neighbouring operations answer wrongly in silencecrates.io viperjs · Upgrade to 0.2.2 or later · >= 0.0.0-0, < 0.2.2 · GHSA-6976-qm5m-7mcj
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.