High, CVSS 7.5
NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126299 · GHSA-89p3-fcch-88ph · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 31,071 matching · newest first
- High, CVSS 7.5
NLTK: Quadratic-time CPU denial of service in Tree.chomsky_normal_form right-factor binarization via list.pop(0)
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126298 · GHSA-r53h-rw34-8h97 · amended
- High, CVSS 7.5
NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126297 · GHSA-v8f3-6phw-6mh9 · amended
- Medium, CVSS 6.8
NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read
PyPI nltk · Upgrade to 3.10.4 or later · >= 3.10.0, < 3.10.4 · CVE-2026-126295 · GHSA-fg9w-wfp5-j933 · amended
- High, CVSS 7.5
ag-psd can exhaust memory when parsing crafted PSD dimensions
npm ag-psd · Upgrade to 31.0.0 or later · < 31.0.0 · CVE-2026-62297 · GHSA-qfx6-q44v-9qqw · amended
- Low, CVSS 3.1
File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · < 2.63.17 · CVE-2026-62683 · GHSA-pp88-jhwj-5qh5 · amended
- Medium, CVSS 5.3
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop
PyPI nltk · Upgrade to 3.10.4 or later · >= 3.6, < 3.10.4 · CVE-2026-126301 · GHSA-gpwc-27cw-rh9r · amended
- Medium, CVSS 5.3
NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop
PyPI nltk · Upgrade to 3.10.4 or later · >= 3.2.5, < 3.10.4 · CVE-2026-126300 · GHSA-ffr9-mgrr-wcvr · amended
- High, CVSS 7.5
NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126303 · GHSA-8fx7-8jr8-84rv · amended
- High, CVSS 7.5
NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox
PyPI nltk · Upgrade to 3.10.4 or later · >= 3.10.0, < 3.10.4 · CVE-2026-126304 · GHSA-qg35-44qx-7vrr · amended
- Medium, CVSS 5.9
SvelteKit: adapter-node crashes with an unhandled URIError when
rerouterewrites malformed pathnamesnpm @sveltejs/kit · Upgrade to 3.1.1 or 2.70.4 by release line · >= 3.0.0, < 3.1.1; < 2.70.4 · CVE-2026-128117 · GHSA-mw6w-2fmv-pvw3 · amended
- Medium, CVSS 5.9
SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
npm @sveltejs/adapter-static · Upgrade to 4.0.1 or 3.0.11 by release line · >= 4.0.0-next.0, < 4.0.1; < 3.0.11 · +1 more package · CVE-2026-128121 · GHSA-jf9x-2fg2-hx4w · amended
- Medium, CVSS 5.9
SvelteKit: Prerendered redirect paths can inject arbitrary rules into the
_redirectsfile generated by@sveltejs/adapter-cloudflarenpm @sveltejs/adapter-cloudflare · Upgrade to 8.0.2 or 7.2.10 by release line · >= 4.7.0, < 7.2.10; >= 8.0.0-next.0, < 8.0.2 · CVE-2026-128122 · GHSA-5wg4-q3ww-283h · amended
- Medium, CVSS 5.9
SvelteKit:
@sveltejs/adapter-nodecrashes when proxying certain requests viafetchnpm @sveltejs/adapter-node · Upgrade to 6.0.1 or 5.5.8 by release line · >= 5.5.7, < 5.5.8; >= 6.0.0-next.0, < 6.0.1 · CVE-2026-128123 · GHSA-rqw3-x7hx-mm3p · amended
- Low, CVSS 3.1
Tornado: Open redirect via triple-slash redirect paths
PyPI tornado · Upgrade to 6.6.1 or later · < 6.6.1 · CVE-2026-126347 · GHSA-5cjw-f85j-cv6r · amended
- High, CVSS 7.5
dnspython has excessive memory and CPU use
PyPI dnspython · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2026-128089 · GHSA-vvf4-9x63-8xvv · amended
- Medium, CVSS 6.5
Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading
//in the request path bypassesserver/middlewarepath checks and server route rules on page routesnpm @nuxt/nitro-server · Upgrade to 4.6.4 or later · >= 4.6.0, < 4.6.4 · CVE-2026-128077 · GHSA-r99w-jh2x-3mg9 · amended
- Medium, CVSS 5.8
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
npm @opentelemetry/instrumentation-http · Upgrade to 0.222.0 or later · >= 0.204.0, < 0.222.0 · CVE-2026-128080 · GHSA-3v2p-hm54-8qcq · amended
- High, CVSS 7.5
AutoMapper: Uncontrolled Recursion with Constructor Parameters
NuGet automapper · Upgrade to 16.3.0 or 15.1.4 by release line · >= 16.0.0, < 16.3.0; < 15.1.4 · CVE-2026-128082 · GHSA-6vhm-j9h7-f9gh · amended
- Low, CVSS 3.7
russh kex_done: Shared-secret callback runs before server host-key verification
crates.io russh · Upgrade to 0.65.1 or later · >= 0.55.0, < 0.65.1 · CVE-2026-128087 · GHSA-9264-jvgf-6w2f · amended
- Low, CVSS 2.2
russh try_sign: asynchronous confirmation can sign after agent lock
crates.io russh · Upgrade to 0.65.1 or later · >= 0.65.0, < 0.65.1 · CVE-2026-128088 · GHSA-736f-c93q-9fwx · amended
- Medium, CVSS 5.3
OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
Go go.opentelemetry.io/otel/baggage +1 · Upgrade all 2 to 1.47.0 or later · >= 1.0.0-RC1, < 1.47.0 · CVE-2026-128086 · GHSA-rrfc-gjm9-cgrj · amended
- Medium, CVSS 5.3
opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes
Go go.opentelemetry.io/otel/sdk/log +2 · Upgrade all 3 to 1.47.0 or later · >= 0.9.0, < 1.47.0 · CVE-2026-128085 · GHSA-q7gw-24fr-5p69 · amended
- Medium, CVSS 4.8
sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger
RubyGems sqlite3 · Upgrade to 2.10.2 or later · < 2.10.2 · CVE-2026-128084 · GHSA-4fqr-96q8-xrfx · amended
- Low, CVSS 2.3
Laravel: Task Output Injection - Concurrency Process
Packagist laravel/framework · Upgrade to 13.40.0 or 12.71.0 by release line · < 12.71.0; >= 13.0.0, < 13.40.0 · CVE-2026-128083 · GHSA-63hm-g96r-2m2q · amended
A vendor fix does not resolve your finding until you verify it in your own systems.