High, CVSS 8.2
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-80206 · GHSA-w3v8-gmh9-3wv7 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 89 matching · newest first
- High, CVSS 8.7
NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-80205 · GHSA-rrv8-h7p8-rx55 · amended
- Critical, CVSS 10.0
Microsoft QUIC: Remote Code Execution Vulnerability
NuGet microsoft.native.quic.msquic.schannel +1 · Upgrade all 2 to 2.5.10 or 2.4.19 by release line · >= 2.5.3, < 2.5.10; < 2.4.19 · CVE-2026-62815 · GHSA-92f5-vc22-8j33 · amended
- Medium, CVSS 5.9
Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability
NuGet microsoft.sourcelink.azurerepos.git +1 · Upgrade all 2 to 10.0.303 or 10.0.111 by release line; some affected versions have no fix yet · >= 8.0.0, <= 8.0.0; >= 10.0.102, <= 10.0.110; >= 10.0.200, <= 10.0.204; >= 10.0.300, <= 10.0.301 · CVE-2026-62900 · GHSA-23fw-v26w-5fgq · amended
- Medium, CVSS 5.3
vLLM: Cross-User Data Leak Vulnerability
PyPI vllm · Upgrade to 0.27.0 or later · < 0.27.0 · CVE-2026-73558 · GHSA-7m6h-x95x-82q5 · amended
- Medium, CVSS 6.5
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78679 · GHSA-3wxw-xv34-2frg · amended
- High, CVSS 8.7
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78677 · GHSA-8mcc-hrx5-hvxc · amended
- High, CVSS 7.1
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78678 · GHSA-5xxx-qhh7-9287 · amended
- Critical, CVSS 9.3
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78676 · GHSA-284h-m62q-gf8w · amended
- High, CVSS 8.6
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
PyPI gitpython · Upgrade to 3.1.59 or later · <= 3.1.58 · CVE-2026-78675 · GHSA-7833-fr7j-v32q · amended
- Critical, CVSS 9.4
DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API
npm @deepseek-ai/dsh-client-connection · Upgrade to 0.1.2-alpha.1 (pre-release) or later · < 0.1.2-alpha.1 · CVE-2026-82533 · GHSA-8m2g-8cgm-3vcp · amended
- Critical, CVSS 9.1
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Maven io.netty:netty-handler · Upgrade to 4.2.17.Final or 4.1.137.Final by release line · >= 4.2.0.Final, <= 4.2.16.Final; <= 4.1.136.Final · CVE-2026-75595 · GHSA-c4c3-7fpv-j4q5 · amended
- Medium, CVSS 6.9
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
Maven io.netty:netty-handler · Upgrade to 4.2.17.Final or 4.1.137.Final by release line · >= 4.2.0.Final, <= 4.2.16.Final; <= 4.1.136.Final · CVE-2026-75596 · GHSA-fccg-mwvh-qqg4 · amended
- Medium, CVSS 5.9
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Go github.com/infracost/infracost · Upgrade to 0.10.45 or later · < 0.10.45 · CVE-2026-71494 · GHSA-6x6c-w9w9-hv4h · amended
- Medium, CVSS 5.9
Infracost: Arbitrary file read via config-template readFile symlink traversal
Go github.com/infracost/infracost · Upgrade to 0.10.45 or later · < 0.10.45 · CVE-2026-71493 · GHSA-mmg6-4qmv-6pc8 · amended
- Low, CVSS 2.3
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher
Go github.com/amir20/dozzle · Upgrade to 1.29.1-0.20260804193351-8cf7ccd5ee04 (pre-release) or later · < 1.29.1-0.20260804193351-8cf7ccd5ee04 · CVE-2026-73087 · GHSA-p2w3-6x73-2f6x · amended
- High, CVSS 7.5
LiquidJS: Uncontrolled Resource Consumption in
joinfilter allows template authors to bypassmemoryLimitand crash the processnpm liquidjs · Upgrade to 10.27.2 or later · <= 10.27.1 · CVE-2026-69222 · GHSA-4r6h-5v86-94p3 · amended
- Medium, CVSS 5.4
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
PyPI prowler +1 · Upgrade all 2 to 5.37.0 or later · <= 5.36.0 · CVE-2026-73262 · GHSA-c2jg-2778-ggm4 · amended
- Medium, CVSS 6.9
node-csv: Prototype replacement still reachable via columns path
npm csv-parse · Upgrade to 7.0.2 or later · < 7.0.2 · CVE-2026-85063 · GHSA-8cw4-87c7-c6xx · amended
- Medium, CVSS 6.1
SWC HTML minifier may allow script element breakout when minifying embedded JSON
npm @swc/html · Upgrade to 1.15.47-nightly-20260729.1 (pre-release) or later · < 1.15.47-nightly-20260729.1 · +1 more package · CVE-2026-72925 · GHSA-5qr2-v392-m9g8 · amended
- Critical, CVSS 9.9
Semaphore U: OS Command Injection
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260704181911-7e8a9434bd81 (pre-release) or later · < 0.0.0-20260704181911-7e8a9434bd81 · CVE-2026-73294 · GHSA-xp7j-h7jc-4w8p · amended
- High, CVSS 8.6
SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260726020813-a25c2dd06aae (pre-release) or later · < 0.0.0-20260726020813-a25c2dd06aae · CVE-2026-72789 · GHSA-v684-q882-jgmq · amended
- Medium, CVSS 5.8
SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260726005141-9edb321eb451 (pre-release) or later · < 0.0.0-20260726005141-9edb321eb451 · CVE-2026-72790 · GHSA-74pj-6g7r-j55c · amended
- Medium, CVSS 5.8
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260726004013-64c26e74bb82 (pre-release) or later · < 0.0.0-20260726004013-64c26e74bb82 · CVE-2026-72791 · GHSA-57v5-wqx3-cgj4 · amended
- High, CVSS 8.8
NLTK: Corpus Reader Sandbox Bypass
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79674 · GHSA-3gq4-3j92-5w49 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.