High, CVSS 8.1
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
PyPI httpx2 +1 · Upgrade all 2 to 2.10.0 or later · >= 2.6.0, < 2.10.0 · CVE-2026-84381 · GHSA-7mj9-2mp8-4m2p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Packagist maatwebsite/excel · Upgrade to 3.1.70 or later · >= 3.1.8, < 3.1.70 · CVE-2026-84374 · GHSA-c7r6-vx3h-w5g2 · amended
- High, CVSS 8.7
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
npm @xmldom/xmldom · Upgrade to 0.9.11 or later · >= 0.9.0-beta.9, <= 0.9.10 · CVE-2026-83606 · GHSA-g53g-w8rj-fmg7 · amended
- High, CVSS 7.8
Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50646 · GHSA-gh2h-rhph-h37g · amended
- High, CVSS 8.2
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-80206 · GHSA-w3v8-gmh9-3wv7 · amended
- High, CVSS 8.7
NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-80205 · GHSA-rrv8-h7p8-rx55 · amended
- Critical, CVSS 10.0
Microsoft QUIC: Remote Code Execution Vulnerability
NuGet microsoft.native.quic.msquic.schannel +1 · Upgrade all 2 to 2.5.10 or 2.4.19 by release line · >= 2.5.3, < 2.5.10; < 2.4.19 · CVE-2026-62815 · GHSA-92f5-vc22-8j33 · amended
- High, CVSS 8.7
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78677 · GHSA-8mcc-hrx5-hvxc · amended
- High, CVSS 7.1
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78678 · GHSA-5xxx-qhh7-9287 · amended
- Critical, CVSS 9.3
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78676 · GHSA-284h-m62q-gf8w · amended
- High, CVSS 8.6
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78675 · GHSA-7833-fr7j-v32q · amended
- Critical, CVSS 9.4
DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API
npm @deepseek-ai/dsh-client-connection · Upgrade to 0.1.2-alpha.1 (pre-release) or later · < 0.1.2-alpha.1 · CVE-2026-82533 · GHSA-8m2g-8cgm-3vcp · amended
- Critical, CVSS 9.1
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Maven io.netty:netty-handler · Upgrade to 4.2.17.Final or 4.1.137.Final by release line · >= 4.2.0.Final, <= 4.2.16.Final; <= 4.1.136.Final · CVE-2026-75595 · GHSA-c4c3-7fpv-j4q5 · amended
- High, CVSS 7.5
LiquidJS: Uncontrolled Resource Consumption in
joinfilter allows template authors to bypassmemoryLimitand crash the processnpm liquidjs · Upgrade to 10.27.2 or later · <= 10.27.1 · CVE-2026-69222 · GHSA-4r6h-5v86-94p3 · amended
- Critical, CVSS 9.9
Semaphore U: OS Command Injection
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260704181911-7e8a9434bd81 (pre-release) or later · < 0.0.0-20260704181911-7e8a9434bd81 · CVE-2026-73294 · GHSA-xp7j-h7jc-4w8p · amended
- High, CVSS 8.6
SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260726020813-a25c2dd06aae (pre-release) or later · < 0.0.0-20260726020813-a25c2dd06aae · CVE-2026-72789 · GHSA-v684-q882-jgmq · amended
- High, CVSS 8.8
NLTK: Corpus Reader Sandbox Bypass
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79674 · GHSA-3gq4-3j92-5w49 · amended
- High, CVSS 8.2
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79676 · GHSA-p4rw-rvv2-7xwr · amended
- Critical, CVSS 9.3
NLTK: Allowlisted pickle loaders still permit code execution in current source
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79657 · GHSA-x99w-6fgc-pmfw · amended
- High, CVSS 8.7
NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-78681 · GHSA-97qj-x29f-37w7 · amended
- High, CVSS 8.7
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-78682 · GHSA-6ww7-3frv-cqxh · amended
- Critical, CVSS 9.4
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-78683 · GHSA-rhp5-r9x4-f5g2 · amended
- High, CVSS 8.7
NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
PyPI nltk · Upgrade to 3.10.2 or later · >= 3.10.0, < 3.10.2 · CVE-2026-62384 · GHSA-f833-7jw8-xwrv · amended
- High, CVSS 8.2
NLTK: Stable FrameNet and NKJP readers parse outside-root XML
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-62385 · GHSA-568f-pv23-39p4 · amended
- High, CVSS 8.7
NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-63312 · GHSA-x5ph-mj9p-rfr8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.