Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @andrea9293/mcp-documentation-server · Upgrade to 1.13.1 or later · >= 1.13.0, <= 1.13.0 · CVE-2026-54504 · GHSA-6f5r-5672-72j7 · amended
npm systeminformation · Upgrade to 5.31.7 or later · <= 5.31.6 · CVE-2026-50289 · GHSA-5xpp-75jx-m839 · amended
Go github.com/pomerium/pomerium · Upgrade to 0.32.8 or later · >= 0.32.6, < 0.32.8 · CVE-2026-50285 · GHSA-ggw3-5987-rx77
RubyGems datadog · Upgrade to 2.32.0 or later · < 2.32.0 · CVE-2026-50276 · GHSA-p5f6-rccc-jv98
NuGet datadog.trace.opentracing +1 · Upgrade all 2 to 3.43.0 or later · < 3.43.0 · CVE-2026-50273 · GHSA-38wr-vpc7-2mp4
npm dd-trace · Upgrade to 5.100.0 or later · < 5.100.0 · CVE-2026-50272 · GHSA-wxqq-gcq8-c443 · amended
PyPI ddtrace · Upgrade to 4.8.2 or later · < 4.8.2 · CVE-2026-50271 · GHSA-mw54-j2v2-42hr · amended
Maven com.datadoghq:dd-java-agent · Upgrade to 1.62.0 or later · < 1.62.0 · CVE-2026-50270 · GHSA-74xj-wh4w-vqxc
RubyGems view_component · Upgrade to 4.12.0 or later · >= 4.0.0, < 4.12.0 · CVE-2026-54498 · GHSA-97jw-64cj-jc58
eval() in Elasticsearch Result DeserializationPyPI django-haystack · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-105315 · GHSA-r3hx-x5rh-p9vv · amended
npm websocket-driver · Upgrade to 0.7.5 or later · < 0.7.5 · CVE-2026-54466 · GHSA-xv26-6w52-cph6 · amended
PyPI tensorzero · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-54457 · GHSA-824w-x939-6cmc · amended
npm obsidian-local-rest-api · Upgrade to 4.1.3 or later · < 4.1.3 · GHSA-62gx-5q78-wrvx · amended
Packagist mantisbt/mantisbt · Upgrade to 2.28.4 or later · <= 2.28.3 · CVE-2026-62944 · GHSA-h2wf-967x-gxvw
Packagist mantisbt/mantisbt · Upgrade to 2.28.4 or later · <= 2.28.3 · CVE-2026-52881 · GHSA-vcrw-4xvv-jh49
PyPI lightning +1 · Upgrade all 2 to 2.6.6 or later · < 2.6.6 · CVE-2026-58659 · GHSA-qqmf-gpg7-g8gw · amended
Packagist mantisbt/mantisbt · Upgrade to 2.28.4 or later · <= 2.28.3 · CVE-2026-52847 · GHSA-77x8-3v3h-hrhv
Packagist phanan/koel · Upgrade to 9.7.1 or later · <= 9.7.0 · CVE-2026-54491 · GHSA-6qvr-wjmv-v8mm
PyPI garminconnect · Upgrade to 0.3.5 or later · <= 0.3.4 · CVE-2026-54447 · GHSA-wjhr-76vg-2hvc · amended
Packagist phanan/koel · Upgrade to 9.7.0 or later · <= 9.6.0 · CVE-2026-54493 · GHSA-6p96-cfg5-4vhp
Packagist mantisbt/mantisbt · Upgrade to 2.28.4 or later · >= 1.3.0, <= 2.28.3 · CVE-2026-49273 · GHSA-v84x-qvhg-f36r
Packagist mantisbt/mantisbt · Upgrade to 2.28.4 or later · <= 2.28.3 · CVE-2026-47156 · GHSA-c2xg-qjqw-2v98
Packagist mantisbt/mantisbt · Upgrade to 2.28.4 or later · <= 2.28.3 · CVE-2026-47142 · GHSA-mw6p-33vw-46cc
PyPI cornac · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2026-43637 · GHSA-rrh3-cwwj-g5mg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.