Until today you could only use reportbug-ng to query the BTS with simple queries like "packagename", "bugnumber", "tag:patch", etc. But the BTS actually supports composite queries like "severity:grave tag:patch" which returns bugreports with severity grave and a patch. The underlying Python library python-debianbts also supported this right from the start, but reportbug-ng did not make use of it.
Last weekend I finally had the time to fix that and the result is on it's way to unstable.
Composite queries provide a very convenient way to find cheap NMU
candidates: the query
"severity:critical severity:grave severity:serious tag:patch" will
return release critical bugs which have a patch. Now you can just go
through this list, pick an open bug, test the patch and do what's
necessary to release Squeeze in time.
Next item on my list is an option to hide closed bugs, maybe next weekend.