ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-48724 · GHSA-2hhq-c99x-492r
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
26–50 of 60 matching · newest first
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-48724 · GHSA-2hhq-c99x-492r
Maven io.nextflow:nextflow · Upgrade to 26.04.3 or 25.10.6 by release line · >= 25.09.2-edge, < 25.10.6; >= 26.00.0-edge, < 26.04.3 · CVE-2026-48722 · GHSA-92qf-fcph-v5wr
Go github.com/sigstore/rekor · Upgrade to 1.5.2 or later · >= 0.3.0, < 1.5.2 · CVE-2026-48702 · GHSA-47q9-m4ww-924m
Go github.com/github/github-mcp-server · Upgrade to 1.1.2 or later · >= 0.22.0, < 1.1.2 · CVE-2026-48529 · GHSA-pjp5-fpmr-3349
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48517 · GHSA-qhmf-xw27-6rqr
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48516 · GHSA-q2h6-ghwm-5qm8
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48515 · GHSA-cxmj-83gh-fp49
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48514 · GHSA-w567-gjr2-hm5j
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48513 · GHSA-wfr3-xj75-pfwh
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48512 · GHSA-cj9g-3mj2-g8vv
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48511 · GHSA-2x83-8g95-xh59
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48510 · GHSA-v72x-2h86-7f8m
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48509 · GHSA-2f33-pr97-265q
PyPI lemur · Upgrade to 1.9.1 or later · <= 1.9.0 · CVE-2026-48508 · GHSA-qcqw-jwxc-2hqg · amended
NuGet messagepack · Upgrade to 3.1.7 or 2.5.301 by release line · < 2.5.301; >= 3.0, < 3.1.7 · CVE-2026-48506 · GHSA-vh6j-jc39-fggf
Packagist filament/filament · Upgrade to 5.6.5 or 4.11.5 by release line · >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5 · CVE-2026-48505 · GHSA-mc5j-f6wx-h9qh
crates.io opentelemetry_sdk · Upgrade to 0.32.1 or later · <= 0.32.0 · CVE-2026-48504 · GHSA-w9wp-h8wv-79jx
NuGet messagepack · Upgrade to 3.1.7 or later · >= 3.0, < 3.1.7 · CVE-2026-48502 · GHSA-382j-8mxh-c7x2
PyPI amazon-braket-sdk · Upgrade to 1.117.0 or later · >= 1.10.0, < 1.117.0 · CVE-2026-9291 · GHSA-g697-2xrc-gc46 · amended
PyPI langgraph +1 · Upgrade all 2 to 0.3.15 or later · < 0.3.15 · CVE-2026-48776 · GHSA-w39p-vh2g-g8g5 · amended
PyPI langgraph-checkpoint · Upgrade to 4.1.1 or later · < 4.1.1 · CVE-2026-48775 · GHSA-fjqc-hq36-qh5p · amended
middleware.RealIPGo github.com/go-chi/chi/v5 +1 · Upgrade all 2 to 5.3.0 or later · >= 5.2.1, < 5.3.0 · CVE-2026-72815 · GHSA-3fxj-6jh8-hvhx · amended
Go github.com/gtsteffaniak/filebrowser · Upgrade to 0.0.0-20260522161427-fa5abc8c67f3a (pre-release) or later · < 0.0.0-20260522161427-fa5abc8c67f3a · GHSA-r4v7-6wcg-ghj5
/usr/share/man/man8crates.io fixurjavainstall · Upgrade to 0.8.1 or later · <= 0.8.0 · GHSA-fq3w-p4fg-mw73
npm neotoma · Upgrade to 0.14.0 or later · >= 0.13.0, < 0.14.0 · GHSA-wrr4-782v-jhwh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.