Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
RubyGems json · Upgrade to 2.21.2 or later · >= 2.20.0, <= 2.21.1 · CVE-2026-71847 · GHSA-9hj4-r449-hfvc · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
2926–2950 of 30,921 matching · newest first
RubyGems json · Upgrade to 2.21.2 or later · >= 2.20.0, <= 2.21.1 · CVE-2026-71847 · GHSA-9hj4-r449-hfvc · amended
PyPI pymdown-extensions · Upgrade to 11.0.1 or later · <= 11.0.0 · CVE-2026-67422 · GHSA-gm37-52c6-37mw
is_image and mime_in rulesPackagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63223 · GHSA-mmj4-63m4-r6h5
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63222 · GHSA-hhmc-q9hp-r662
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · >= 4.3.0, < 4.7.4 · CVE-2026-63221 · GHSA-c9w5-rwh3-7pm9 · amended
Packagist codeigniter4/framework · Upgrade to 4.7.4 or later · < 4.7.4 · CVE-2026-63220 · GHSA-7wmf-pw8j-mc78
npm jsii-diff · Upgrade to 1.131.0 or later · < 1.131.0 · CVE-2026-15895 · GHSA-wcx4-wpfv-mc5c
Maven io.netty:netty-codec-redis · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · < 4.1.136.Final; >= 4.2.0-Final, < 4.2.16.Final · CVE-2026-56818 · GHSA-p9jm-q85p-7mcp · amended
Packagist api-platform/core · Upgrade to 4.3.12, 4.2.26 or 4.1.30 by release line · < 4.1.30; >= 4.2.0, < 4.2.26; >= 4.3.0, < 4.3.12 · CVE-2026-54164 · GHSA-9rjg-x2p2-h68h · amended
npm @sveltejs/kit · Upgrade to 2.70.2 or later · <= 2.70.1 · CVE-2026-66062 · GHSA-29g2-3rmr-qm68 · amended
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 · CVE-2026-72744 · GHSA-7c4v-fwgw-9rf7
Go github.com/go-git/go-git/v6 · Upgrade to 6.0.0-alpha.5 (pre-release) or later · <= 6.0.0-alpha.4 · +1 more package · CVE-2026-71557 · GHSA-qgq7-7hm3-q39j · amended
Go github.com/go-git/go-git/v6 · Upgrade to 6.0.0-alpha.5 (pre-release) or later · <= 6.0.0-alpha.4 · +1 more package · CVE-2026-71556 · GHSA-hc8v-wwc9-vgxm · amended
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76220 · GHSA-wvpp-8hx9-p66j
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · GHSA-jm78-9fvv-mhgr
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76222 · GHSA-hmq2-w58f-27jc
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76217 · GHSA-hh9p-6wh2-4mfc
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76218 · GHSA-9rj7-rf2p-w77r
PyPI gitpython · Upgrade to 3.1.58 or later · <= 3.1.57 · CVE-2026-76219 · GHSA-4gmw-gg2m-w46p
npm dompurify · Upgrade to 3.4.13 or later · <= 3.4.12 · GHSA-55q2-fjhq-7xh7
Packagist smarty/smarty · Upgrade to 5.8.4 or later · >= 5.0.0, < 5.8.4 · CVE-2026-62996 · GHSA-rjhh-76wf-8xmw · amended
Packagist smarty/smarty · Upgrade to 5.8.2 or 4.5.7 by release line · >= 5.0.0, < 5.8.2; < 4.5.7 · CVE-2026-62992 · GHSA-f6wf-28g6-769x · amended
Packagist craftcms/cms · Upgrade to 5.10.5 or later · >= 5.0.0-RC1, < 5.10.5 · CVE-2026-72780 · GHSA-wg23-69c2-gjc8 · amended
crates.io kuva · Upgrade to 0.4.1 or 0.3.1 by release line · >= 0.1.5, < 0.3.1; >= 0.4.0, < 0.4.1 · GHSA-3c48-9r95-hqhr
PyPI nltk · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-12261 · GHSA-ffj6-66c4-86gw
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.