Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–75 of 96 matching · newest first
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.10 or 2.15.0 by release line · >= 3.0.0.Beta1, < 3.0.10; >= 2.0.0, < 2.15.0 · CVE-2026-45300 · GHSA-fmxf-pm6p-7xgm
Packagist shopper/cart · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47741 · GHSA-9rh9-hf3w-9fgg
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47740 · GHSA-f946-9qp6-vgch
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45270 · GHSA-gqr2-7hcg-rchf
max DoS protectionnpm brace-expansion · Upgrade to 5.0.6 or later · >= 5.0.0, < 5.0.6 · CVE-2026-45149 · GHSA-jxxr-4gwj-5jf2 · amended
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45139 · GHSA-245j-xjvr-xvm5
html_purify Validation RulePackagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45138 · GHSA-2m69-jmvh-6chr
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-j5rm-v3vh-vx94 · amended
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-qq2p-4282-cfc5 · amended
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-74r7-3mjm-jc5v · amended
Packagist statamic/cms · Upgrade to 6.18.1 or 5.73.22 by release line · < 5.73.22; >= 6.0.0-alpha.1, < 6.18.1 · CVE-2026-45660 · GHSA-pf9c-ch8r-2958
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.13.1 or later · < 14.13.1 · CVE-2026-42326 · GHSA-7wff-wpr6-vmhm
RubyGems faraday · Upgrade to 2.14.2 or later · >= 2.0.0, <= 2.14.1 · CVE-2026-33637 · GHSA-5rv5-xj5j-3484
npm neotoma · Upgrade to 0.11.1 or later · >= 0.6.0, < 0.11.1 · CVE-2026-45577 · GHSA-5cvp-p7p4-mcx9 · amended
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.0 or later · <= 1.18.1 · CVE-2026-45627 · GHSA-q2pj-8v84-9mh5
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.0 or later · <= 1.18.1 · CVE-2026-45625 · GHSA-7h26-hg47-p9hx
npm @sveltia/cms · Upgrade to 0.160.1 or later · < 0.160.1 · GHSA-97r8-rf7q-wmjw · amended
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.3 or later · >= 2.7.0, <= 2.10.2 · CVE-2026-45135 · GHSA-m675-2p33-xv9g
npm webpack-dev-server · Upgrade to 5.2.4 or later · <= 5.2.3 · CVE-2026-6402 · GHSA-79cf-xcqc-c78w · amended
Maven org.springaicommunity:mcp-client-security · Upgrade to 0.1.9 or later · < 0.1.9 · CVE-2026-45609 · GHSA-qjp4-4jvr-xqg3
npm form-data-objectizer · Upgrade to 1.0.1 or later · <= 1.0.0 · CVE-2026-46510 · GHSA-m2hg-wjq3-28wq · amended
PyPI graphitedb · Upgrade to 0.2 or later · < 0.2 · GHSA-qw48-84f6-28gv · amended
npm n8n-mcp · Upgrade to 2.51.3 or later · < 2.51.3 · CVE-2026-45582 · GHSA-f3rg-xqjj-cj9w · amended
.apm/prompts/ and .apm/agents/ are dereferenced during apm install, copying host-local file contents into the project treePyPI apm · Upgrade to 0.13.0 or later · >= 0.5.4, <= 0.12.4 · CVE-2026-45539 · GHSA-q5pp-gvjg-h7v4 · amended
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 11.5.2, 11.4.4, 10.11.14 or 8.0.0-20260326202606-fac92f4a71f3 (pre-release) by release line · >= 11.5.0, < 11.5.2; >= 10.11.0, < 10.11.14; >= 11.4.0, < 11.4.4; < 8.0.0-20260326202606-fac92f4a71f3 · +1 more package · CVE-2026-6346 · GHSA-9p64-jpc7-m2rp
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.