Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
76–90 of 90 matching · newest first
PcfFontFile._load_bitmaps(): Image.frombytes() called without _decompression_bomb_check() — bomb protection bypass via PCF font loadingPyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-54059 · GHSA-8v84-f9pq-wr9x · amended
npm astro · Upgrade to 7.1.0 or later · >= 2.9.0, <= 7.0.9 · CVE-2026-73422 · GHSA-4g3v-8h47-v7g6 · amended
PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-54058 · GHSA-62p4-gmf7-7g93 · amended
npm @better-auth/sso · Upgrade to 1.6.11 or later · >= 1.2.10, < 1.6.11 · CVE-2026-53515 · GHSA-gv74-j8m3-fg5f · amended
npm brace-expansion · Upgrade to 5.0.7, 2.1.2 or 1.1.16 by release line · >= 3.0.0, < 5.0.7; < 1.1.16; >= 2.0.0, < 2.1.2 · CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp · amended
Packagist composer/composer · Upgrade to 2.10.2 or 2.2.29 by release line · >= 2.3.0, < 2.10.2; >= 1.0.0, < 2.2.29 · CVE-2026-59948 · GHSA-499r-g7pc-vmp9
PyPI vllm · Upgrade to 0.24.0 or later · >= 0.12.0, < 0.24.0 · CVE-2026-55514 · GHSA-33cg-gxv8-3p8g · amended
PyPI pillow-heif +1 · Upgrade all 2 to 1.3.0 or later · < 1.3.0 · CVE-2026-28231 · GHSA-5gjj-6r7v-ph3x · amended
PyPI changedetection-io · Upgrade to 0.53.2 or later · < 0.53.2 · CVE-2026-25527 · GHSA-9jj8-v89v-xjvw · amended
PyPI tornado · Upgrade to 6.5.3 or later · < 6.5.3 · CVE-2025-67726 · GHSA-jhmp-mqwm-3gq8 · amended
PyPI tornado · Upgrade to 6.5.3 or later · < 6.5.3 · CVE-2025-67725 · GHSA-c98p-7wgm-6p64 · amended
PyPI tornado · Upgrade to 6.5.3 or later · < 6.5.3 · CVE-2025-67724 · GHSA-pr2v-jx2c-wg9f · amended
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.28.0, < 0.33.0; >= 1.0.0, < 1.18.0 · CVE-2026-67313 · GHSA-42h9-826w-cgv3 · amended
npm axios · Upgrade to 1.18.0 or later · >= 1.15.2, < 1.18.0 · CVE-2026-67314 · GHSA-xj6q-8x83-jv6g · amended
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.28.0, < 0.33.0; >= 1.0.0, < 1.18.0 · CVE-2026-67312 · GHSA-pmv8-rq9r-6j72 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.