Medium, CVSS 6.5
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
PyPI gitpython · Upgrade to 3.1.60 or later · >= 3.1.59, < 3.1.60 · CVE-2026-87818 · GHSA-whh4-5q6c-9v3x · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1526–1550 of 30,910 matching · newest first
- High, CVSS 8.7
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
PyPI gitpython · Upgrade to 3.1.60 or later · <= 3.1.59 · CVE-2026-87817 · GHSA-239g-whfq-7xj9 · amended
- Low, CVSS 3.7
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
crates.io russh · Upgrade to 0.63.1 or later · <= 0.63.0 · CVE-2026-102822 · GHSA-p8qx-h547-fjw9 · amended
- High, CVSS 7.5
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
crates.io russh · Upgrade to 0.63.1 or later · <= 0.63.0 · CVE-2026-102823 · GHSA-47hw-gvq5-r2gm · amended
- Medium, CVSS 4.3
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
crates.io russh · Upgrade to 0.63.0 or later · < 0.63.0 · CVE-2026-102824 · GHSA-w3jg-pjxf-73p4 · amended
- Low, CVSS 3.7
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
crates.io russh · Upgrade to 0.62.6 or later · <= 0.62.5 · CVE-2026-102825 · GHSA-g6xm-f9xp-qq35 · amended
- Medium, CVSS 6.5
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
PyPI litellm · Upgrade to 1.96.2, 1.95.1, 1.94.3 or 6 more by release line · < 1.88.6; >= 1.89.0, < 1.89.7; >= 1.90.0, < 1.90.7; >= 1.91.0, < 1.91.5; >= 1.92.0, < 1.92.2; >= 1.93.0, < 1.93.2; >= 1.94.0, < 1.94.3; >= 1.95.0, < 1.95.1; >= 1.96.0, < 1.96.2 · CVE-2026-84377 · GHSA-3cv6-jpf6-8222 · amended
- Medium, CVSS 5.3
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
PyPI pyjwt · Upgrade to 2.15.0 or later · >= 2.0.0a1, <= 2.14.0 · CVE-2026-101918 · GHSA-42vr-xj54-vc7v · amended
- High, CVSS 8.2
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
npm @angular/router · Upgrade to 22.2.0, 21.2.24 or 20.3.32 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.2.0; >= 21.0.0, < 21.2.24; >= 20.0.0, < 20.3.32; <= 19.2.25 · CVE-2026-101896 · GHSA-ff3f-86qr-9cv3 · amended
- Low, CVSS 2.3
Serialize JavaScript: Cross-site scripting (XSS) via unescaped in serialized function bodies
npm serialize-javascript · Upgrade to 7.1.2 or later · >= 7.1.1, < 7.1.2 · CVE-2026-97711 · GHSA-gfhx-hw2g-v5hg · amended
- Low, CVSS 2.3
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
npm dompurify · Upgrade to 3.4.16 or later · >= 3.4.13, <= 3.4.15 · CVE-2026-109344 · GHSA-p98j-92pf-mc4p · amended
- High, CVSS 7.5
jackson-databind quadratic forward-reference completion
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.3 or 3.1.7 by release line · >= 3.0.0, <= 3.1.6; >= 3.2.0, <= 3.2.2 · +1 more package · CVE-2026-91777 · GHSA-cxp5-3px4-pw24 · amended
- High, CVSS 7.5
jackson-databind retains every unknown raw type ID
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.3 or 3.1.7 by release line · >= 3.0.0, <= 3.1.6; >= 3.2.0, <= 3.2.2 · +1 more package · CVE-2026-91776 · GHSA-wv8q-qhhj-9h54 · amended
- Medium, CVSS 6.1
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
Packagist league/commonmark · Upgrade to 2.10.2 or later · >= 1.3.0, <= 2.10.1 · CVE-2026-105829 · GHSA-97jj-33gv-5xf9 · amended
- High, CVSS 7.5
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Packagist league/commonmark · Upgrade to 2.10.2 or later · >= 2.0.0, <= 2.10.1 · CVE-2026-105830 · GHSA-3q6v-r5mr-hxv8 · amended
- High, CVSS 7.4
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
npm @grpc/grpc-js · Upgrade to 1.14.5 or 1.13.6 by release line · < 1.13.6; >= 1.14.0, < 1.14.5 · CVE-2026-101916 · GHSA-m9gg-hp2v-232j · amended
- Low, CVSS 3.7
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
npm @grpc/grpc-js · Upgrade to 1.14.5 or 1.13.6 by release line · < 1.13.6; >= 1.14.0, < 1.14.5 · CVE-2026-101915 · GHSA-f596-whhp-79r4 · amended
- Medium, CVSS 6.9
Axios: Header Injection via Inherited headers After Minimal Interceptor
npm axios · Upgrade to 1.20.0 or later · >= 1.0.0, < 1.20.0 · CVE-2026-101904 · GHSA-j8rh-479h-cp32 · amended
- Medium, CVSS 6.9
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
npm axios · Upgrade to 1.20.0 or later · >= 1.12.0, < 1.20.0 · CVE-2026-101900 · GHSA-4hqw-qxg8-jxx2 · amended
- High, CVSS 7.6
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
npm axios · Upgrade to 1.20.0 or later · >= 1.15.2, < 1.20.0 · CVE-2026-101905 · GHSA-m8m8-qj5v-23w3 · amended
- Medium, CVSS 6.9
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
npm axios · Upgrade to 1.20.0 or later · >= 1.15.0, < 1.20.0 · CVE-2026-101899 · GHSA-44g4-m2mj-wpvx · amended
- High, CVSS 7.0
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
npm axios · Upgrade to 1.20.0 or later · >= 1.17.0, < 1.20.0 · CVE-2026-101907 · GHSA-r4gj-5m52-g5wh · amended
- Medium, CVSS 6.9
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
npm axios · Upgrade to 1.20.0 or later · >= 1.7.0, < 1.20.0 · CVE-2026-101908 · GHSA-vh66-26gq-q6x8 · amended
- Medium, CVSS 6.9
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
npm axios · Upgrade to 1.20.0 or 0.34.0 by release line · >= 0.27.2, < 0.34.0; >= 1.0.0, < 1.20.0 · CVE-2026-101902 · GHSA-9fr6-4gfg-395g · amended
- High, CVSS 8.2
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
npm axios · Upgrade to 1.20.0 or later · >= 1.16.1, < 1.20.0 · CVE-2026-101903 · GHSA-c29m-xwm3-cm6r · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.