Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 · CVE-2026-71321 · GHSA-9pgf-384g-p7mv
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.4.0, < 3.21.10 · CVE-2026-71320 · GHSA-9473-5f9j-94wq
npm @nuxt/devtools · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-71319 · GHSA-279x-mwfv-vcqv · amended
npm nuxt · Upgrade to 4.5.1 or later · >= 4.4.0, <= 4.5.0 · CVE-2026-71316 · GHSA-wm8w-6qjm-cv43
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 · CVE-2026-71315 · GHSA-hxvh-4h3w-prp9
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 · CVE-2026-71314 · GHSA-hxcr-hm88-mpq6
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79782 · GHSA-gx4c-2hqx-cw2r · amended
serve restic --private-repos authorization bypass: .. in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesGo github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-59733 · GHSA-fqj9-69pf-6pjg · amended
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.4 · CVE-2026-71312 · GHSA-2m8m-jhrm-w6j2 · amended
--links — arbitrary file write from an untrusted remoteGo github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-54572 · GHSA-cf44-9pgv-m4xc · amended
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · >= 1.40.0, < 1.75.0 · CVE-2026-71309 · GHSA-45pq-889g-fcgh · amended
npm electron · Upgrade to 42.0.1, 41.10.3 or 39.8.10 by release line · >= 42.0.0-alpha.1, < 42.0.1; >= 40.0.0-alpha.1, < 41.10.3; < 39.8.10 · CVE-2026-70608 · GHSA-9f4c-93c8-jc8g
npm electron · Upgrade to 42.0.0, 41.4.0, 40.9.3 or 39.8.10 by release line · >= 42.0.0-alpha.1, < 42.0.0; >= 41.0.0-alpha.1, < 41.4.0; >= 40.0.0-alpha.1, < 40.9.3; < 39.8.10 · CVE-2026-70604 · GHSA-v3j7-r9gq-3gjw
npm electron · Upgrade to 42.0.0-beta.5 (pre-release), 41.2.2, 40.9.2 or 39.8.9 by release line · < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.2; >= 42.0.0-alpha.1, < 42.0.0-beta.5 · CVE-2026-70601 · GHSA-h7rp-cf8h-j98x
Maven org.apache.qpid:proton-j · Upgrade to 0.35.0 or later · < 0.35.0 · CVE-2026-66274 · GHSA-p2gc-fm5w-94jj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.