Medium, CVSS 4.8
pypdf: Possible large memory usage for large /ToUnicode streams
PyPI pypdf · Upgrade to 6.15.0 or later · < 6.15.0 · CVE-2026-71870 · GHSA-fp3f-mc75-235c
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 31 matching · newest first
- Medium, CVSS 4.8
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
PyPI pypdf · Upgrade to 6.15.0 or later · < 6.15.0 · CVE-2026-71852 · GHSA-fwg2-594c-jp42
- Critical, CVSS 9.0
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
npm crypto-js · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-71851 · GHSA-rg76-677x-56q9 · amended
- Medium, CVSS 4.8
Hono:
memo()retains SSR output across requests, leading to cross-user data disclosurenpm hono · Upgrade to 4.12.34 or later · >= 3.8.0, < 4.12.34 · CVE-2026-71850 · GHSA-f23p-vx2j-j53r
- Low, CVSS 3.7
Hono: Proxy Helper does not remove response headers listed in the
Connectionheadernpm hono · Upgrade to 4.12.34 or later · >= 4.7.0, < 4.12.34 · CVE-2026-71849 · GHSA-79qm-7rj5-m7r9
- Medium, CVSS 5.3
Hono: Algorithmic Complexity DoS in Language Middleware
npm hono · Upgrade to 4.12.34 or later · >= 4.12.0, < 4.12.34 · CVE-2026-71848 · GHSA-54fx-42gc-7vw4
- Unrated
Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
RubyGems json · Upgrade to 2.21.2 or later · >= 2.20.0, <= 2.21.1 · CVE-2026-71847 · GHSA-9hj4-r449-hfvc · amended
- High, CVSS 7.5
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
PyPI pymdown-extensions · Upgrade to 11.0.1 or later · <= 11.0.0 · CVE-2026-67422 · GHSA-gm37-52c6-37mw
- Critical, CVSS 9.8
CodeIgniter: Uploaded file extension validation bypass in
is_imageandmime_inrulesPackagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63223 · GHSA-mmj4-63m4-r6h5
- High, CVSS 7.5
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63222 · GHSA-hhmc-q9hp-r662
- Critical, CVSS 9.4
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · >= 4.3.0, < 4.7.4 · CVE-2026-63221 · GHSA-c9w5-rwh3-7pm9 · amended
- Medium, CVSS 4.8
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63220 · GHSA-7wmf-pw8j-mc78
- High, CVSS 8.4
jsii-diff: Command Injection via npm: package argument
npm jsii-diff · Upgrade to 1.131.0 or later · < 1.131.0 · CVE-2026-15895 · GHSA-wcx4-wpfv-mc5c
- Medium, CVSS 6.5
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
Maven io.netty:netty-codec-redis · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · < 4.1.136.Final; >= 4.2.0-Final, < 4.2.16.Final · CVE-2026-56818 · GHSA-p9jm-q85p-7mcp · amended
- Medium, CVSS 6.5
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
Packagist api-platform/core · Upgrade to 4.3.12, 4.2.26 or 4.1.30 by release line · < 4.1.30; >= 4.2.0, < 4.2.26; >= 4.3.0, < 4.3.12 · CVE-2026-54164 · GHSA-9rjg-x2p2-h68h · amended
- Medium, CVSS 5.3
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
npm @sveltejs/kit · Upgrade to 2.70.2 or later · <= 2.70.1 · CVE-2026-66062 · GHSA-29g2-3rmr-qm68 · amended
- Medium, CVSS 5.3
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 · CVE-2026-72744 · GHSA-7c4v-fwgw-9rf7
- Medium, CVSS 6.3
go-git: Malicious reference names may modify files outside the reference storage
Go github.com/go-git/go-git/v6 · Upgrade to 6.0.0-alpha.5 (pre-release) or later · <= 6.0.0-alpha.4 · +1 more package · CVE-2026-71557 · GHSA-qgq7-7hm3-q39j · amended
- High, CVSS 7.1
go-git: Worktree operations may follow symlinks
Go github.com/go-git/go-git/v6 · Upgrade to 6.0.0-alpha.5 (pre-release) or later · <= 6.0.0-alpha.4 · +1 more package · CVE-2026-71556 · GHSA-hc8v-wwc9-vgxm · amended
- High, CVSS 8.8
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76220 · GHSA-wvpp-8hx9-p66j
- High, CVSS 8.8
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · GHSA-jm78-9fvv-mhgr
- High, CVSS 8.2
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76222 · GHSA-hmq2-w58f-27jc
- Medium, CVSS 6.5
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76217 · GHSA-hh9p-6wh2-4mfc
- High, CVSS 7.5
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76218 · GHSA-9rj7-rf2p-w77r
- High, CVSS 8.1
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76219 · GHSA-4gmw-gg2m-w46p
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.