High, CVSS 7.7
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
PyPI virtualenv · Upgrade to 21.7.12 or later · <= 21.7.11 · CVE-2026-102930 · GHSA-94p9-xgh2-xp45 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 54 matching · newest first
- Medium, CVSS 5.8
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
PyPI virtualenv · Upgrade to 21.7.11 or later · <= 21.7.10 · CVE-2026-102938 · GHSA-9h9j-4vrj-gf7g · amended
- Medium, CVSS 5.9
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
npm fastify · Upgrade to 5.12.5 or later · < 5.12.5 · CVE-2026-92081 · GHSA-4mh8-r7rc-xpvc · amended
- Medium, CVSS 5.3
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103261 · GHSA-3hv7-mjh2-fv65 · amended
- High, CVSS 7.5
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103262 · GHSA-chx6-46f5-w4vp · amended
- High, CVSS 8.2
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103263 · GHSA-c2m8-h5v5-343r · amended
- Medium, CVSS 6.1
GitPython submodule update path traversal can write outside the repository
PyPI gitpython · Upgrade to 3.1.62 or later · <= 3.1.61 · CVE-2026-100689 · GHSA-59cr-6r3x-644w · amended
- Medium, CVSS 4.7
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
npm hono · Upgrade to 4.13.7 or later · < 4.13.7 · CVE-2026-93981 · GHSA-hxh3-vqpv-xpqv · amended
- High, CVSS 8.1
fastify vulnerable to request body replacement via an async validation result collision
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84504 · GHSA-667r-xxjv-c9mm · amended
- High, CVSS 7.5
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
npm fastify · Upgrade to 5.12.2 or later · >= 4.0.0, < 5.12.2 · CVE-2026-76169 · GHSA-p68q-wchp-6fh7 · amended
- High, CVSS 7.5
fastify vulnerable to request validation bypass via skipped boolean false schemas
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84469 · GHSA-hwr6-493r-vm6h · amended
- High, CVSS 7.5
fastify vulnerable to header validation bypass via incomplete schema case normalization
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84428 · GHSA-9q9j-q6p8-xq58 · amended
- Medium, CVSS 6.2
pageant: Out-of-bounds read / oversized allocation in
pageantMemoryMap::read via a malicious Pageant agent (Windows)crates.io pageant · Upgrade to 0.2.3 or later · <= 0.2.2 · CVE-2026-102820 · GHSA-g4mp-vgx3-xrvm · amended
- Medium, CVSS 6.5
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
crates.io russh · Upgrade to 0.63.2 or later · <= 0.63.1 · CVE-2026-102821 · GHSA-35g8-35p8-c8fw · amended
- Medium, CVSS 6.3
Astro: Netlify Image CDN allowlist bypass enables SSRF
npm @astrojs/netlify · Upgrade to 8.2.4 or later · >= 5.2.0, <= 8.2.3 · CVE-2026-102983 · GHSA-4233-jc72-56c5 · amended
- High, CVSS 8.2
Astro: Malformed port in the Host header can crash the Node adapter
npm @astrojs/node · Upgrade to 11.1.3 or later · <= 11.1.2 · CVE-2026-102984 · GHSA-qh8j-hqjv-7m4x · amended
- High, CVSS 7.5
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
PyPI gitpython · Upgrade to 3.1.60 or later · <= 3.1.59 · CVE-2026-87819 · GHSA-g5vv-9gxw-82hx · amended
- Medium, CVSS 6.5
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
PyPI gitpython · Upgrade to 3.1.60 or later · >= 3.1.59, < 3.1.60 · CVE-2026-87818 · GHSA-whh4-5q6c-9v3x · amended
- High, CVSS 8.7
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
PyPI gitpython · Upgrade to 3.1.60 or later · <= 3.1.59 · CVE-2026-87817 · GHSA-239g-whfq-7xj9 · amended
- Low, CVSS 3.7
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
crates.io russh · Upgrade to 0.63.1 or later · <= 0.63.0 · CVE-2026-102822 · GHSA-p8qx-h547-fjw9 · amended
- High, CVSS 7.5
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
crates.io russh · Upgrade to 0.63.1 or later · <= 0.63.0 · CVE-2026-102823 · GHSA-47hw-gvq5-r2gm · amended
- Medium, CVSS 4.3
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
crates.io russh · Upgrade to 0.63.0 or later · < 0.63.0 · CVE-2026-102824 · GHSA-w3jg-pjxf-73p4 · amended
- Low, CVSS 3.7
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
crates.io russh · Upgrade to 0.62.6 or later · <= 0.62.5 · CVE-2026-102825 · GHSA-g6xm-f9xp-qq35 · amended
- Medium, CVSS 6.5
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
PyPI litellm · Upgrade to 1.96.2, 1.95.1, 1.94.3 or 6 more by release line · < 1.88.6; >= 1.89.0, < 1.89.7; >= 1.90.0, < 1.90.7; >= 1.91.0, < 1.91.5; >= 1.92.0, < 1.92.2; >= 1.93.0, < 1.93.2; >= 1.94.0, < 1.94.3; >= 1.95.0, < 1.95.1; >= 1.96.0, < 1.96.2 · CVE-2026-84377 · GHSA-3cv6-jpf6-8222 · amended
- Medium, CVSS 5.3
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
PyPI pyjwt · Upgrade to 2.15.0 or later · >= 2.0.0a1, <= 2.14.0 · CVE-2026-101918 · GHSA-42vr-xj54-vc7v · amended
A vendor fix does not resolve your finding until you verify it in your own systems.