Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–75 of 86 matching · newest first
/api/v1/user/starred and private issue titles via /api/v1/user/timesGo code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-59766 · GHSA-qf2f-qh6p-7v89
Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()PyPI gitpython · Upgrade to 3.1.51 or later · <= 3.1.50 · CVE-2026-67323 · GHSA-956x-8gvw-wg5v · amended
PyPI gitpython · Upgrade to 3.1.51 or later · <= 3.1.50 · CVE-2026-67325 · GHSA-2f96-g7mh-g2hx · amended
PyPI gitpython · Upgrade to 3.1.51 or later · >= 3.1.50, <= 3.1.50 · CVE-2026-67324 · GHSA-v396-v7q4-x2qj · amended
npm svgo · Upgrade to 4.0.2, 3.3.4 or 2.8.3 by release line · >= 1.0.0, < 2.8.3; >= 3.0.0, < 3.3.4; >= 4.0.0, < 4.0.2 · CVE-2026-73650 · GHSA-2p49-hgcm-8545 · amended
CUSTOM_ELEMENT_HANDLING bypasses afterSanitizeElements for allowed custom elements.npm dompurify · Upgrade to 3.4.12 or later · <= 3.4.11 · CVE-2026-66010 · GHSA-c2j3-45gr-mqc4 · amended
@JsonView bypass for creator properties with @JsonTypeInfo(include=As.EXTERNAL_PROPERTY)Maven com.fasterxml.jackson.core:jackson-databind · Upgrade to 2.21.5 or 2.18.9 by release line · >= 2.18.0, <= 2.18.8; >= 2.21.0, <= 2.21.4 · GHSA-mhm7-754m-9p8w
npm @vitest/browser · Upgrade to 5.0.0-beta.6 (pre-release), 4.1.10 or 3.2.7 by release line · >= 4.0.0, < 4.1.10; < 3.2.7; >= 5.0.0-beta.1, < 5.0.0-beta.6 · CVE-2026-73653 · GHSA-p63j-vcc4-9vmv · amended
npm @sigstore/oci · Upgrade to 0.7.1 or later · < 0.7.1 · CVE-2026-59891 · GHSA-pf56-329r-95rw · amended
Maven tools.jackson.core:jackson-databind · Upgrade to 3.1.4 or later · >= 3.0.0, < 3.1.4 · +1 more package · CVE-2026-59888 · GHSA-3pjw-73gf-8qr5
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-57894 · GHSA-82f7-87hm-852x
PyPI pyasn1 · Upgrade to 0.6.4 or later · <= 0.6.3 · CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r · amended
PyPI pyasn1 · Upgrade to 0.6.4 or later · <= 0.6.3 · CVE-2026-59885 · GHSA-8ppf-4f7h-5ppj · amended
PyPI pyasn1 · Upgrade to 0.6.4 or later · < 0.6.4 · CVE-2026-59884 · GHSA-m4p7-r5rc-7g4j · amended
PyPI setuptools · Upgrade to 83.0.0 or later · < 83.0.0 · CVE-2026-59890 · GHSA-h35f-9h28-mq5c · amended
JaegerPropagator via unhandled exception on a malformed headernpm @opentelemetry/propagator-jaeger · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2026-59892 · GHSA-45rx-2jwx-cxfr · amended
mailto: validator scan-loop on attacker textnpm linkify-it · Upgrade to 5.0.2 or later · <= 5.0.1 · CVE-2026-59887 · GHSA-v245-v573-v5vm · amended
npm aws-cdk-lib · Upgrade to 2.260.0 or later · < 2.260.0 · CVE-2026-13760 · GHSA-vcrf-j523-4mrf · amended
npm fast-uri · Upgrade to 4.0.1, 3.1.3 or 2.4.2 by release line · >= 4.0.0, < 4.0.1; >= 3.0.0, < 3.1.3; >= 2.3.1, < 2.4.2 · CVE-2026-13676 · GHSA-4c8g-83qw-93j6 · amended
npm immutable · Upgrade to 5.1.8, 4.3.9 or 3.8.4 by release line · >= 5.0.0-beta.1, < 5.1.8; >= 4.0.0-beta.1, < 4.3.9; < 3.8.4 · CVE-2026-59880 · GHSA-xvcm-6775-5m9r · amended
List 32-bit trie overflow → unrecoverable DoSnpm immutable · Upgrade to 5.1.8, 4.3.9 or 3.8.4 by release line · >= 5.0.0-beta.1, < 5.1.8; >= 4.0.0-rc.1, < 4.3.9; < 3.8.4 · CVE-2026-59879 · GHSA-v56q-mh7h-f735 · amended
Packagist guzzlehttp/psr7 · Upgrade to 2.12.3 or later · < 2.12.3 · CVE-2026-59882 · GHSA-c2w2-prh8-qm98
RubyGems websocket-driver · Upgrade to 0.8.2 or later · < 0.8.2 · CVE-2026-61666 · GHSA-2x63-gw47-w4mm · amended
npm hono · Upgrade to 4.12.27 or later · >= 4.11.8, < 4.12.27 · CVE-2026-59896 · GHSA-hvrm-45r6-mjfj · amended
npm hono · Upgrade to 4.12.27 or later · >= 4.0.0, < 4.12.27 · CVE-2026-59895 · GHSA-w62v-xxxg-mg59 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.