High, CVSS 8.1
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
PyPI gitpython · Upgrade to 3.1.57 or later · <= 3.1.56 · GHSA-3f7w-8rr8-f37f
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3101–3125 of 30,921 matching · newest first
- High, CVSS 7.7
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
npm ip-address · Upgrade to 10.3.1 or later · <= 10.3.0 · CVE-2026-69192 · GHSA-mwp4-54f8-5fhr
- Medium, CVSS 6.9
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
npm ip-address · Upgrade to 10.2.2 or later · >= 10.1.1, <= 10.2.1 · CVE-2026-69198 · GHSA-4xrf-jv44-h6hh
- Medium, CVSS 6.9
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
npm ip-address · Upgrade to 10.2.1 or later · >= 10.1.1, <= 10.2.0 · CVE-2026-54272 · GHSA-22jq-vg5j-6vgg · amended
- Medium, CVSS 4.2
undici vulnerable to CRLF Injection via blob-like body 'type' property
npm undici · Upgrade to 8.9.0, 7.29.0 or 6.28.0 by release line · < 6.28.0; >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-15157 · GHSA-m8rv-5g2x-5cg5
- Medium, CVSS 5.9
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
npm undici · Upgrade to 8.9.0 or 7.29.0 by release line · >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-14643 · GHSA-jr45-8vmc-qm54
- Medium, CVSS 4.8
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
npm undici · Upgrade to 8.9.0, 7.29.0 or 6.28.0 by release line · < 6.28.0; >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-16729 · GHSA-v3r7-h72x-cjcm
- Medium, CVSS 4.8
undici vulnerable to downstream response desynchronization via retry interceptor
npm undici · Upgrade to 8.9.0, 7.29.0 or 6.28.0 by release line · < 6.28.0; >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-16728 · GHSA-8xcm-r25x-g524
- High, CVSS 7.4
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
npm undici · Upgrade to 8.9.0 or 7.29.0 by release line · >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-13697 · GHSA-4cwx-7wf7-3272
- High, CVSS 7.5
fast-uri vulnerable to host confusion via backslash authority introducer
npm fast-uri · Upgrade to 4.1.2, 3.1.5 or 2.4.4 by release line · < 2.4.4; >= 3.0.0, < 3.1.5; >= 4.0.0, < 4.1.2 · CVE-2026-18446 · GHSA-7p8r-x3mc-p8w7
- High, CVSS 7.5
Socket.IO: Zero-attachment Memory Exhaustion
npm socket.io-parser · Upgrade to 4.2.7, 3.4.5 or 3.3.6 by release line · >= 4.0.0, < 4.2.7; >= 3.4.0, < 3.4.5; < 3.3.6 · CVE-2026-69185 · GHSA-2m8v-j782-fhvr · amended
- Medium, CVSS 6.3
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when
fromis unsetnpm postcss · Upgrade to 8.5.23 or later · <= 8.5.22 · CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp
- High, CVSS 7.5
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
npm brace-expansion · Upgrade to 5.0.9, 3.0.6, 2.1.4 or 1.1.18 by release line · < 1.1.18; >= 2.0.0, < 2.1.4; >= 3.0.0, < 3.0.6; >= 4.0.0, < 5.0.9 · CVE-2026-69152 · GHSA-rgw5-rvv9-x895
- High, CVSS 7.6
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
npm @angular/compiler +1 · Upgrade all 2 to 22.0.1, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-69151 · GHSA-jj27-h5hq-8x99
- High, CVSS 8.6
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
npm @angular/platform-server · Upgrade to 22.0.7, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.7; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-69149 · GHSA-vpx6-8pjr-4g3v
- High, CVSS 8.8
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
npm @angular/common · Upgrade to 22.0.2, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.2; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-68945 · GHSA-jhpw-976m-542j
- Medium, CVSS 6.5
Russh: Channel-scoped server callbacks can be reached without an open channel
crates.io russh · Upgrade to 0.62.5 or later · <= 0.62.4 · CVE-2026-68930 · GHSA-m65r-rprj-r5rg · amended
- High, CVSS 8.2
Auto-Reseeding HMAC-DRBG could panic for some output lengths
crates.io libcrux-hmac-drbg · Upgrade to 0.0.2 or later · >= 0.0.0-0, < 0.0.2 · amended
- High, CVSS 8.7
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · +3 more packages · CVE-2026-13506 · GHSA-qp49-qgx5-5m26 · amended
- Critical, CVSS 9.3
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · +3 more packages · CVE-2026-8763 · GHSA-9pwp-9qqc-pr26 · amended
- High, CVSS 7.1
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
PyPI transformers · Upgrade to 5.10.0 or later · < 5.10.0 · CVE-2026-9856 · GHSA-xrqw-3rrv-vx5w
- Medium, CVSS 6.5
Keras: HDF5 links can disclose local file contents
PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-9335 · GHSA-m8wh-29wm-52mv
- High, CVSS 7.5
Processing of unverified relay events
crates.io nostr-relay-pool · Upgrade to 0.44.3 or later · >= 0.0.0-0, < 0.44.3
- High, CVSS 7.5
Empty NIP-50 search filters can panic
crates.io nostr · Upgrade to 0.44.7 or later · >= 0.0.0-0, < 0.44.7
- Medium, CVSS 4.3
NIP-04 parsing amplifies malformed ciphertext memory use
crates.io nostr · Upgrade to 0.44.7 or later · >= 0.0.0-0, < 0.44.7
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.