High, CVSS 7.1
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56755 · GHSA-6hm7-3pwj-22rm
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56750 · GHSA-rgv6-xp99-6mgj
- High, CVSS 8.4
GitPython: command injection via unguarded Git options in
Repo.archive(),git.ls_remote(), and arbitrary file overwrite viaRepo.iter_commits()/Repo.blame()PyPI gitpython · Upgrade to 3.1.51 or later · <= 3.1.50 · CVE-2026-67323 · GHSA-956x-8gvw-wg5v · amended
- High, CVSS 8.8
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
PyPI gitpython · Upgrade to 3.1.51 or later · <= 3.1.50 · CVE-2026-67325 · GHSA-2f96-g7mh-g2hx · amended
- High, CVSS 8.7
GitPython unsafe clone option gate bypass through joined short options
PyPI gitpython · Upgrade to 3.1.51 or later · >= 3.1.50, <= 3.1.50 · CVE-2026-67324 · GHSA-v396-v7q4-x2qj · amended
- High, CVSS 8.2
SVGO removeScripts plugin leaves some executable scripts intact
npm svgo · Upgrade to 4.0.2, 3.3.4 or 2.8.3 by release line · >= 1.0.0, < 2.8.3; >= 3.0.0, < 3.3.4; >= 4.0.0, < 4.0.2 · CVE-2026-73650 · GHSA-2p49-hgcm-8545 · amended
- Critical, CVSS 9.4
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
npm @vitest/browser · Upgrade to 5.0.0-beta.6 (pre-release), 4.1.10 or 3.2.7 by release line · >= 4.0.0, < 4.1.10; < 3.2.7; >= 5.0.0-beta.1, < 5.0.0-beta.6 · CVE-2026-73653 · GHSA-p63j-vcc4-9vmv · amended
- Critical, CVSS 9.6
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
npm @sigstore/oci · Upgrade to 0.7.1 or later · < 0.7.1 · CVE-2026-59891 · GHSA-pf56-329r-95rw · amended
- High, CVSS 8.5
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-57894 · GHSA-82f7-87hm-852x
- High, CVSS 7.5
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
PyPI pyasn1 · Upgrade to 0.6.4 or later · <= 0.6.3 · CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r · amended
- High, CVSS 7.5
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
PyPI pyasn1 · Upgrade to 0.6.4 or later · <= 0.6.3 · CVE-2026-59885 · GHSA-8ppf-4f7h-5ppj · amended
- High, CVSS 7.5
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
PyPI pyasn1 · Upgrade to 0.6.4 or later · < 0.6.4 · CVE-2026-59884 · GHSA-m4p7-r5rc-7g4j · amended
- High, CVSS 7.5
OpenTelemetry JavaScript: Denial of service in
JaegerPropagatorvia unhandled exception on a malformed headernpm @opentelemetry/propagator-jaeger · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2026-59892 · GHSA-45rx-2jwx-cxfr · amended
- High, CVSS 7.5
linkify-it: Quadratic-complexity DoS via the
mailto:validator scan-loop on attacker textnpm linkify-it · Upgrade to 5.0.2 or later · <= 5.0.1 · CVE-2026-59887 · GHSA-v245-v573-v5vm · amended
- High, CVSS 7.0
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
npm aws-cdk-lib · Upgrade to 2.260.0 or later · < 2.260.0 · CVE-2026-13760 · GHSA-vcrf-j523-4mrf · amended
- High, CVSS 7.5
fast-uri vulnerable to host confusion via failed IDN canonicalization
npm fast-uri · Upgrade to 4.0.1, 3.1.3 or 2.4.2 by release line · >= 4.0.0, < 4.0.1; >= 3.0.0, < 3.1.3; >= 2.3.1, < 2.4.2 · CVE-2026-13676 · GHSA-4c8g-83qw-93j6 · amended
- High, CVSS 8.7
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
npm immutable · Upgrade to 5.1.8, 4.3.9 or 3.8.4 by release line · >= 5.0.0-beta.1, < 5.1.8; >= 4.0.0-beta.1, < 4.3.9; < 3.8.4 · CVE-2026-59880 · GHSA-xvcm-6775-5m9r · amended
- High, CVSS 8.7
Immutable.js
List32-bit trie overflow → unrecoverable DoSnpm immutable · Upgrade to 5.1.8, 4.3.9 or 3.8.4 by release line · >= 5.0.0-beta.1, < 5.1.8; >= 4.0.0-rc.1, < 4.3.9; < 3.8.4 · CVE-2026-59879 · GHSA-v56q-mh7h-f735 · amended
- High, CVSS 8.9
websocket-driver-ruby: Denial of service via malformed Host header
RubyGems websocket-driver · Upgrade to 0.8.2 or later · < 0.8.2 · CVE-2026-61666 · GHSA-2x63-gw47-w4mm · amended
- Critical, CVSS 9.0
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
PyPI homeassistant · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-64825 · GHSA-5hxg-r395-fqxx · amended
- High, CVSS 8.2
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
Maven org.postgresql:postgresql · Upgrade to 42.7.12 or later · >= 42.7.4, < 42.7.12 · CVE-2026-54291 · GHSA-j92g-9f8w-j867
- High, CVSS 7.5
Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.6, 9.0.15 or 8.0.26 by release line · >= 10.0.0, <= 10.0.5; >= 9.0.0, <= 9.0.14; >= 8.0.0, <= 8.0.25 · CVE-2026-56170 · GHSA-j8gr-8fp3-5q5h
- High, CVSS 7.0
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
NuGet microsoft.net.build.containers · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50526 · GHSA-55jh-fwmh-39m4
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.authentication.negotiate · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-47300 · GHSA-8prm-248r-h957
- High, CVSS 8.8
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.authentication.negotiate · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-47303 · GHSA-2p3q-h3hg-jcqq
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.