Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–75 of 88 matching · newest first
PyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.0.0, <= 2.12.1 · CVE-2026-48522 · GHSA-993g-76c3-p5m4 · amended
PyPI pyjwt · Upgrade to 2.13.0 or later · < 2.13.0 · CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx · amended
PyJWK / PyJWKClient keysPyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.9.0, < 2.13.0 · CVE-2026-48523 · GHSA-jq35-7prp-9v3f · amended
npm nodemailer · Upgrade to 8.0.9 or later · <= 8.0.8 · CVE-2026-82661 · GHSA-268h-hp4c-crq3 · amended
npm nodemailer · Upgrade to 8.0.9 or later · <= 8.0.8 · CVE-2026-82660 · GHSA-wqvq-jvpq-h66f · amended
npm nodemailer · Upgrade to 8.0.8 or later · <= 8.0.7 · CVE-2026-82662 · GHSA-r7g4-qg5f-qqm2 · amended
../ or ./ → Generated URL Collapses Off-Route Under RFC 3986 NormalizationPackagist symfony/symfony +1 · Upgrade all 2 to 8.0.13, 7.4.13, 6.4.41 or 5.4.53 by release line · < 5.4.53; >= 6.0.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48784 · GHSA-h5x3-xfc9-m39h
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.13, 7.4.13 or 6.4.41 by release line · >= 6.1.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48760 · GHSA-v3wm-qf9p-c549
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.13 or 7.4.13 by release line · >= 7.2.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48747 · GHSA-rrj9-5q2j-4gvr
Packagist symfony/symfony · Upgrade to 8.0.13, 7.4.13, 6.4.41 or 5.4.53 by release line · >= 5.4.0, < 5.4.53; >= 6.4.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · +2 more packages · CVE-2026-48736 · GHSA-38cx-cq6f-5755
npm protobufjs · Upgrade to 8.4.1 or 7.6.1 by release line · <= 7.6.0; >= 8.0.0, <= 8.4.0 · CVE-2026-48712 · GHSA-wcpc-wj8m-hjx6 · amended
PyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.0.0, <= 2.12.1 · CVE-2026-48524 · GHSA-fhv5-28vv-h8m8 · amended
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.13, 7.4.13, 6.4.41 or 5.4.53 by release line · < 5.4.53; >= 6.0.0, < 6.4.41; >= 7.0.0, < 7.4.13; >= 8.0.0, < 8.0.13 · CVE-2026-48489 · GHSA-6h46-9jf5-q59x
npm protobufjs · Upgrade to 8.6.0 or 7.6.3 by release line · <= 7.6.2; >= 8.0.0, <= 8.5.0 · +1 more package · CVE-2026-54269 · GHSA-f38q-mgvj-vph7 · amended
npm form-data · Upgrade to 4.0.6, 3.0.5 or 2.5.6 by release line · < 2.5.6; >= 3.0.0, < 3.0.5; >= 4.0.0, < 4.0.6 · CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx · amended
npm @angular/service-worker · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54264 · GHSA-qxh6-94w6-9r5p · amended
npm @angular/common · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54268 · GHSA-48r7-hpm6-gfxm · amended
HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoningnpm @angular/common · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54266 · GHSA-39pv-4j6c-2g6v · amended
npm @angular/compiler · Upgrade to 22.0.1, 21.2.17 or 20.3.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25 · CVE-2026-54265 · GHSA-58w9-8g37-x9v5 · amended
npm @angular/compiler +1 · Upgrade all 2 to 22.0.0-rc.2 (pre-release), 21.2.15, 20.3.22 or 19.2.22 by release line; some affected versions have no fix yet · >= 21.0.0-next.0, < 21.2.15; >= 22.0.0-next.0, < 22.0.0-rc.2; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14 · CVE-2026-50557 · GHSA-f3m7-gqxr-g87x · amended
Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRnpm @angular/platform-server · Upgrade to 22.0.0-rc.2 (pre-release), 21.2.16, 20.3.24 or 19.2.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.16; >= 20.0.0-next.0, < 20.3.24; >= 19.0.0-next.0, < 19.2.25; <= 18.2.14 · CVE-2026-50556 · GHSA-gxx4-3xcv-f8qx · amended
npm @angular/platform-server · Upgrade to 22.0.0-rc.2 (pre-release), 21.2.16, 20.3.24 or 19.2.25 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.16; >= 20.0.0-next.0, < 20.3.24; >= 19.0.0-next.0, < 19.2.25; <= 18.2.14 · CVE-2026-50555 · GHSA-hqr9-c56f-3x7f · amended
npm tar · Upgrade to 7.5.16 or later · <= 7.5.15 · CVE-2026-53655 · GHSA-vmf3-w455-68vh · amended
npm launch-editor · Upgrade to 2.14.1 or later · <= 2.14.0 · +2 more packages · CVE-2026-53632 · GHSA-v6wh-96g9-6wx3 · amended
server.fs.deny bypass on Windows alternate pathsnpm vite · Upgrade to 8.0.16, 7.3.5 or 6.4.3 by release line · >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3 · +1 more package · CVE-2026-53571 · GHSA-fx2h-pf6j-xcff · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.