Critical, CVSS 9.0
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
npm crypto-js · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-71851 · GHSA-rg76-677x-56q9 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
PyPI pymdown-extensions · Upgrade to 11.0.1 or later · <= 11.0.0 · CVE-2026-67422 · GHSA-gm37-52c6-37mw
- Critical, CVSS 9.8
CodeIgniter: Uploaded file extension validation bypass in
is_imageandmime_inrulesPackagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63223 · GHSA-mmj4-63m4-r6h5
- High, CVSS 7.5
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63222 · GHSA-hhmc-q9hp-r662
- Critical, CVSS 9.4
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · >= 4.3.0, < 4.7.4 · CVE-2026-63221 · GHSA-c9w5-rwh3-7pm9 · amended
- High, CVSS 8.4
jsii-diff: Command Injection via npm: package argument
npm jsii-diff · Upgrade to 1.131.0 or later · < 1.131.0 · CVE-2026-15895 · GHSA-wcx4-wpfv-mc5c
- High, CVSS 7.1
go-git: Worktree operations may follow symlinks
Go github.com/go-git/go-git/v6 · Upgrade to 6.0.0-alpha.5 (pre-release) or later · <= 6.0.0-alpha.4 · +1 more package · CVE-2026-71556 · GHSA-hc8v-wwc9-vgxm · amended
- High, CVSS 8.8
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76220 · GHSA-wvpp-8hx9-p66j
- High, CVSS 8.8
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · GHSA-jm78-9fvv-mhgr
- High, CVSS 8.2
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76222 · GHSA-hmq2-w58f-27jc
- High, CVSS 7.5
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76218 · GHSA-9rj7-rf2p-w77r
- High, CVSS 8.1
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76219 · GHSA-4gmw-gg2m-w46p
- Critical, CVSS 9.1
Craft CMS: Passkey login accepts replayed WebAuthn assertions
Packagist craftcms/cms · Upgrade to 5.10.5 or later · >= 5.0.0-RC1, < 5.10.5 · CVE-2026-72780 · GHSA-wg23-69c2-gjc8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.