PYSEC-2026-3446
PyPI pycti · Upgrade to 7.260401.0 or later · < 7.260401.0 · CVE-2026-35211 · GHSA-qpp6-p693-rmm4
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–21 of 21 matching · newest first
PyPI pycti · Upgrade to 7.260401.0 or later · < 7.260401.0 · CVE-2026-35211 · GHSA-qpp6-p693-rmm4
PyPI pycti · Upgrade to 7.260326.0 or later · < 7.260326.0 · CVE-2026-35210 · GHSA-36fr-4m54-94mj
PyPI serena-agent · Upgrade to 1.5.2 or later · < 1.5.2 · CVE-2026-49471 · GHSA-37h2-6p4f-mp3q · amended
Maven nl.nl-portal:taak · Upgrade to 3.0.1 or later · >= 1.5.0, <= 3.0.0 · CVE-2026-49464 · GHSA-6h3c-r723-7fx3
Maven nl.nl-portal:besluiten +1 · Upgrade all 2 to 3.0.1 or later · >= 1.5.0, <= 3.0.0 · CVE-2026-49463 · GHSA-qpm9-h556-mwxm
unstable_redirect Helpernpm waku · Upgrade to 1.0.0-beta.1 (pre-release) or later · <= 1.0.0-beta.0 · CVE-2026-49456 · GHSA-43fc-v873-qw85 · amended
npm waku · Upgrade to 1.0.0-beta.1 (pre-release) or later · <= 1.0.0-beta.0 · CVE-2026-49455 · GHSA-75w3-gmqx-993q · amended
Go github.com/BishopFox/joro · Upgrade to 0.0.0-20260601151442-5c0ca35db828 (pre-release) or later · < 0.0.0-20260601151442-5c0ca35db828 · CVE-2026-53649 · GHSA-xqhv-chqm-fhcc
crates.io oneringbuf · Upgrade to 0.8.0 or later · < 0.8.0 · GHSA-q95x-7g78-rccv
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3 or 8.4 by release line · >= 8.0-rc1, <= 8.3; >= 9.0-rc1, <= 9.2; >= 10.0-rc1, <= 10.0-rc1 · CVE-2026-49833 · GHSA-9qm4-rh6w-pq5x
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3, 8.4 or 7.6.7 by release line · <= 7.6.6; >= 8.0-rc1, <= 8.3; >= 9.0-rc1, <= 9.2; >= 10-rc1, <= 10-rc1 · CVE-2026-49830 · GHSA-c827-pw3m-67w7
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3, 8.4 or 7.6.7 by release line · <= 7.6.6; >= 8.0-rc1, <= 8.3; >= 9.0-rc1, <= 9.2; >= 10-rc1, <= 10-rc1 · CVE-2026-49831 · GHSA-v66x-68f2-pxf5
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3 or 8.4 by release line · >= 8.0-rc1, < 8.4; >= 9.0-rc1, < 9.3; >= 10.0-rc1, <= 10.0-rc1 · CVE-2026-49832 · GHSA-9x82-rm84-c6x7
PyPI trapster · Upgrade to 1.2.2 or later · < 1.2.2 · GHSA-mxwc-wh95-pw4g · amended
Packagist code16/sharp · Upgrade to 9.22.3 or later · >= 9.0.0, < 9.22.3 · CVE-2026-53634 · GHSA-vmwx-m75v-qvch
Go github.com/nuclio/nuclio · Upgrade to 0.0.0-20260601075854-3356b86a8bfa (pre-release) or later · < 0.0.0-20260601075854-3356b86a8bfa · CVE-2026-52831 · GHSA-v5px-423j-pf7p
crates.io async-tar · Upgrade to 0.6.1 or later · < 0.6.1 · CVE-2026-53600 · GHSA-35rm-7j9c-2f7m
Go github.com/zalando/skipper · Upgrade to 0.26.10 or later · < 0.26.10 · CVE-2026-50197 · GHSA-659f-rgp5-w4wf
lxml_html_clean.Cleaner does not strip javascript: URLs from namespaced URL attributesPyPI lxml-html-clean · Upgrade to 0.4.5 or later · < 0.4.5 · CVE-2026-49825 · GHSA-4jhm-jv67-739f · amended
PyPI bbot · Upgrade to 3.0.0 or later · >= 1.1.7, < 3.0.0 · CVE-2026-14967
Bitnami php +2 · Upgrade all 3 to 8.5.8, 8.4.23, 8.3.32 or 8.2.32 by release line · >= 8.2.0, < 8.2.32; >= 8.3.0, < 8.3.32; >= 8.4.0, < 8.4.23; >= 8.5.0, < 8.5.8 · CVE-2026-14355 · GHSA-7jrw-539f-x6vr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.