Medium, CVSS 6.9
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
PyPI awscli · Upgrade to 1.45.28 or later · <= 1.45.27 · CVE-2026-18654 · GHSA-hqvf-45jj-mccq
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–42 of 42 matching · newest first
- Medium, CVSS 5.3
Mermaid radar diagrams are vulnerable to DoS
npm mermaid · Upgrade to 11.16.1 or later · >= 11.6.0, < 11.16.1 · CVE-2026-71439 · GHSA-rhh3-jpg6-66xh
- Low, CVSS 2.4
Mermaid configuration APIs allow prototype pollution
npm mermaid · Upgrade to 11.16.1 or 10.9.8 by release line · >= 11.0.0-alpha.1, < 11.16.1; < 10.9.8 · CVE-2026-71438 · GHSA-c4c3-pg64-4m4v
- Medium, CVSS 5.3
Mermaid allows CSS injection applying to sibling elements of the diagram
npm mermaid · Upgrade to 11.16.1 or 10.9.8 by release line · >= 11.0.0-alpha.1, < 11.16.1; < 10.9.8 · CVE-2026-50159 · GHSA-6x64-9x62-f2gx
- Medium, CVSS 6.5
Mermaid Architecture diagrams are vulnerable to prototype pollution
npm mermaid · Upgrade to 11.16.1 or later · >= 11.5.0, < 11.16.1 · CVE-2026-71437 · GHSA-3rrr-jr9j-h3q3
- Low, CVSS 3.1
Contao: Possible path traversal in job download URIs
Packagist contao/contao +1 · Upgrade all 2 to 5.7.7 or later · >= 5.7.0, < 5.7.7 · CVE-2026-55825 · GHSA-grm4-wm43-9jh5 · amended
- Medium, CVSS 5.3
Mermaid XY Charts are vulnerable to an infinite loop DoS
npm mermaid · Upgrade to 11.16.1 or 10.9.8 by release line · >= 10.6.0, < 10.9.8; >= 11.0.0-alpha.1, < 11.16.1 · CVE-2026-71436 · GHSA-2v8p-3f2j-5mp7 · amended
- Low, CVSS 2.6
Contao crawler leaks auth credentials to external hosts
Packagist contao/contao +1 · Upgrade all 2 to 5.7.7 or 5.3.47 by release line · >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7 · CVE-2026-55824 · GHSA-3mr9-p497-58f6 · amended
- Medium, CVSS 6.1
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
Packagist statamic/cms · Upgrade to 6.24.2 or 5.74.3 by release line · < 5.74.3; >= 6.0.0, < 6.24.2 · CVE-2026-71435 · GHSA-vx89-p3j7-8xqc · amended
- Medium, CVSS 5.3
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Packagist statamic/cms · Upgrade to 6.24.2 or 5.74.3 by release line · < 5.74.3; >= 6.0.0, < 6.24.2 · CVE-2026-71434 · GHSA-qhr7-v3xp-vw9m · amended
- Medium, CVSS 6.5
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Packagist statamic/cms · Upgrade to 6.24.0 or 5.74.1 by release line · < 5.74.1; >= 6.0.0, < 6.24.0 · CVE-2026-64662 · GHSA-qh8c-7588-qfrv · amended
- Medium, CVSS 6.5
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
Packagist statamic/cms · Upgrade to 6.24.0 or 5.74.1 by release line · < 5.74.1; >= 6.0.0, < 6.24.0 · CVE-2026-64663 · GHSA-j2vp-f2pv-5rj4 · amended
- High, CVSS 8.1
Statamic: Account takeover via OAuth email matching without email-verification check
Packagist statamic/cms · Upgrade to 6.24.0 or 5.74.1 by release line · < 5.74.1; >= 6.0.0, < 6.24.0 · CVE-2026-64665 · GHSA-93qh-5269-9wcf · amended
- Medium, CVSS 4.3
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
Packagist statamic/cms · Upgrade to 6.24.0 or 5.74.1 by release line · < 5.74.1; >= 6.0.0, < 6.24.0 · CVE-2026-64664 · GHSA-225x-3jhx-wh4q · amended
- Medium, CVSS 5.3
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
PyPI langgraph-checkpoint-postgres +1 · Upgrade all 2 to 3.1.1 or later · < 3.1.1 · CVE-2026-71433 · GHSA-47pj-3jcm-6whg
- Unrated
setlocaleandTextDomain::initare unsound as they access environment with no synchronizationcrates.io gettext-rs · Upgrade to 0.8.0 or later · >= 0.0.0-0, < 0.8.0
- High, CVSS 7.5
A
BigIntdivision panics, and two neighbouring operations answer wrongly in silencecrates.io viperjs · Upgrade to 0.2.2 or later · >= 0.0.0-0, < 0.2.2 · GHSA-6976-qm5m-7mcj
A vendor fix does not resolve your finding until you verify it in your own systems.