High, CVSS 7.5
NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126299 · GHSA-89p3-fcch-88ph · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
NLTK: Quadratic-time CPU denial of service in Tree.chomsky_normal_form right-factor binarization via list.pop(0)
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126298 · GHSA-r53h-rw34-8h97 · amended
- High, CVSS 7.5
NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126297 · GHSA-v8f3-6phw-6mh9 · amended
- High, CVSS 7.5
ag-psd can exhaust memory when parsing crafted PSD dimensions
npm ag-psd · Upgrade to 31.0.0 or later · < 31.0.0 · CVE-2026-62297 · GHSA-qfx6-q44v-9qqw · amended
- High, CVSS 7.5
NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126303 · GHSA-8fx7-8jr8-84rv · amended
- High, CVSS 7.5
NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox
PyPI nltk · Upgrade to 3.10.4 or later · >= 3.10.0, < 3.10.4 · CVE-2026-126304 · GHSA-qg35-44qx-7vrr · amended
- High, CVSS 7.5
dnspython has excessive memory and CPU use
PyPI dnspython · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-128089 · GHSA-vvf4-9x63-8xvv · amended
- High, CVSS 7.5
AutoMapper: Uncontrolled Recursion with Constructor Parameters
NuGet automapper · Upgrade to 16.3.0 or 15.1.4 by release line · >= 16.0.0, < 16.3.0; < 15.1.4 · CVE-2026-128082 · GHSA-6vhm-j9h7-f9gh · amended
- High, CVSS 7.5
AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth
NuGet automapper · Upgrade to 16.3.0 or 15.1.4 by release line · >= 16.0.0, < 16.3.0; < 15.1.4 · CVE-2026-128081 · GHSA-gpwp-5797-mjff · amended
- High, CVSS 7.5
Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER
PyPI soupsieve · Upgrade to 3.0.2 or later · < 3.0.2 · CVE-2026-126191 · GHSA-6655-6qjp-jx7x · amended
- High, CVSS 7.5
KVStoreInterpreter::verify_signature_legacy answers true for every token and every key
crates.io bsv-rs · Upgrade to 0.9.0-beta.7.0 (pre-release) or 0.8.9 by release line · >= 0.0.0-0, < 0.8.9; >= 0.9.0-beta.1, < 0.9.0-beta.7.0 · GHSA-mj2m-jxgv-r446
- Critical, CVSS 9.8
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens
PyPI rucio · Upgrade to 41.1.1, 40.4.2, 38.6.1 or 35.9.1 by release line · >= 1.14.0.post1, < 35.9.1; >= 36.0.0rc1, < 38.6.1; >= 39.0.0rc1, < 40.4.2; >= 41.0.0rc1, < 41.1.1 · CVE-2026-100397 · GHSA-x585-4vv8-2mh2 · amended
- High, CVSS 7.5
Soup Sieve: Polynomial-time denial of service in the descendant combinator
PyPI soupsieve · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-126190 · GHSA-mmhr-3c5m-f64f · amended
- Critical, CVSS 9.8
Active Storage: Possible arbitrary file write and read in image analysis
RubyGems activestorage · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-122006 · GHSA-f3w6-w445-fwh9 · amended
- High, CVSS 7.5
Action Pack: Possible Strong Parameters Bypass in Parameters#each_key
RubyGems actionpack · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126081 · GHSA-wm3x-v3qw-4jh3 · amended
- High, CVSS 8.4
Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size
PyPI pillow · Upgrade to 13.0.0 or later · < 13.0.0 · CVE-2026-128067 · GHSA-xcvg-w56q-r89m · amended
- High, CVSS 7.5
msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM
RubyGems msgpack · Upgrade to 1.8.7 or later · < 1.8.7 · CVE-2026-126366 · GHSA-73v3-wf97-vpgj · amended
- High, CVSS 7.8
pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
Go github.com/pgEdge/control-plane · Upgrade to 0.11.0 or later · < 0.11.0 · CVE-2026-125323 · GHSA-vq9p-w6wv-cr25 · amended
- High, CVSS 7.5
pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
Go github.com/pgEdge/pgedge-rag-server · Upgrade to 1.0.1-0.20260729020411-a09d4872356b (pre-release) or later · < 1.0.1-0.20260729020411-a09d4872356b · CVE-2026-125327 · GHSA-5qg5-rgp6-j5m5 · amended
- Critical, CVSS 9.1
Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability
NuGet aspire.dashboard.sdk.osx-arm64 +6 · Upgrade all 7 to 13.6.5 or later · < 13.6.5 · CVE-2026-118740 · GHSA-4g86-54fm-h9h8 · amended
- Critical, CVSS 9.1
Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key
crates.io bsv-rs · Upgrade to 0.9.0-beta.7.0 (pre-release) or 0.8.7 by release line · >= 0.0.0-0, < 0.8.7; >= 0.9.0-beta.1, < 0.9.0-beta.7.0 · GHSA-cwxv-4866-5gq2
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-118745 · GHSA-x8x8-p968-x646 · amended
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-114152 · GHSA-xf35-v9jh-g65w · amended
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability
NuGet microsoft.testplatform.cli · Upgrade to 18.11.1, 18.10.2, 18.7.1 or 6 more by release line; some affected versions have no fix yet · >= 17.2.0-preview-20220301-01, < 17.3.4; >= 17.3.1, < 17.3.4; >= 17.3.2, < 17.3.4; >= 17.3.3, < 17.3.4; >= 17.8.0, < 17.8.1; >= 17.11.0, < 17.11.2; >= 17.11.1, < 17.11.2; >= 17.12.0, < 17.12.1; >= 17.14.0, < 17.14.2; >= 17.14.1, < 17.14.2; >= 18.0.0, < 18.0.2; >= 18.0.1, < 18.0.2; >= 18.7.0, < 18.7.1; >= 18.10.0, < 18.10.2; >= 18.10.1, < 18.10.2; >= 18.11.0, < 18.11.1; >= 17.4.0, <= 17.4.0; >= 17.4.1, <= 17.4.1; >= 17.5.0, <= 17.5.0; >= 17.6.0, <= 17.6.0; >= 17.6.1, <= 17.6.1; >= 17.6.2, <= 17.6.2; >= 17.6.3, <= 17.6.3; >= 17.7.0, <= 17.7.0; >= 17.7.1, <= 17.7.1; >= 17.7.2, <= 17.7.2; >= 17.9.0, <= 17.9.0; >= 17.10.0, <= 17.10.0; >= 17.13.0, <= 17.13.0; >= 18.3.0, <= 18.3.0; >= 18.4.0, <= 18.4.0; >= 18.5.0, <= 18.5.0; >= 18.5.1, <= 18.5.1; >= 18.6.0, <= 18.6.0; >= 18.8.0, <= 18.8.0; >= 18.8.1, <= 18.8.1; >= 18.9.0, <= 18.9.0; >= 17.4.0-preview-20220707-01, <= 17.4.0-preview-20220707-01; >= 17.4.0-preview-20220726-02, <= 17.4.0-preview-20220726-02; >= 17.4.0-preview-20221003-03, <= 17.4.0-preview-20221003-03; >= 17.4.0-release-20220926-01, <= 17.4.0-release-20220926-01; >= 17.5.0-preview-20221003-04, <= 17.5.0-preview-20221003-04; >= 17.5.0-preview-20221221-03, <= 17.5.0-preview-20221221-03; >= 17.6.0-preview-20230223-05, <= 17.6.0-preview-20230223-05; >= 17.7.0-preview-23364-03, <= 17.7.0-preview-23364-03; >= 17.7.0-preview.23280.1, <= 17.7.0-preview.23280.1; >= 17.8.0-preview-23371-04, <= 17.8.0-preview-23371-04; >= 17.8.0-preview-23424-02, <= 17.8.0-preview-23424-02; >= 17.8.0-release-23468-02, <= 17.8.0-release-23468-02; >= 17.9.0-preview-23503-02, <= 17.9.0-preview-23503-02; >= 17.9.0-preview-23531-01, <= 17.9.0-preview-23531-01; >= 17.9.0-preview-23577-04, <= 17.9.0-preview-23577-04; >= 17.9.0-release-23619-01, <= 17.9.0-release-23619-01; >= 17.10.0-preview-24080-01, <= 17.10.0-preview-24080-01; >= 17.10.0-release-24177-07, <= 17.10.0-release-24177-07; >= 17.11.0-release-24352-06, <= 17.11.0-release-24352-06; >= 17.11.0-release-24373-02, <= 17.11.0-release-24373-02; >= 17.14.0-preview-25107-01, <= 17.14.0-preview-25107-01; >= 17.3.0, < 17.3.4 · GHSA-6856-87hx-p5x7
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-114151 · GHSA-fpxj-5c99-g7vj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.