Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 27 matching · newest first
POST /media/upload/* requests can write arbitrary files into the Tina dev server media rootnpm @tinacms/cli · Upgrade to 2.5.2 or later · < 2.5.2 · CVE-2026-63123 · GHSA-rgr9-r7mj-mf6x
next-tinacms-s3 (and sibling production media adapters)npm next-tinacms-s3 · Upgrade to 23.0.4 or later · < 23.0.4 · +3 more packages · CVE-2026-59992 · GHSA-8mq9-5fw2-5rm4
--experience-path via path traversalnpm @logto/tunnel · Upgrade to 0.3.9 or later · < 0.3.9 · CVE-2026-63188 · GHSA-rxjr-6c9q-h67x · amended
Go github.com/moby/buildkit · Upgrade to 0.31.1 or later · <= 0.31.0 · CVE-2026-61712 · GHSA-72x6-4j93-7w86 · amended
Go github.com/moby/buildkit · Upgrade to 0.31.1 or later · <= 0.31.0 · CVE-2026-61711 · GHSA-7236-3392-c5c6 · amended
npm mcp-searxng · Upgrade to 1.12.0 or later · < 1.12.0 · GHSA-hjwh-xvfw-qrwj
Packagist getgrav/grav · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2026-62230 · GHSA-vwg3-w8w3-pc79 · amended
Packagist snipe/snipe-it · Upgrade to 8.6.2 or later · < 8.6.2 · CVE-2026-61807 · GHSA-c8qc-wf67-342w
Packagist snipe/snipe-it · Upgrade to 8.6.3 or later · < 8.6.3 · CVE-2026-55703 · GHSA-r9r3-g9fp-3q4q
Packagist snipe/snipe-it · Upgrade to 8.6.3 or later · < 8.6.3 · CVE-2026-55694 · GHSA-3hgv-jr5j-cg9x
Packagist snipe/snipe-it · Upgrade to 8.6.3 or later · < 8.6.3 · CVE-2026-55643 · GHSA-c6w2-j4wq-mvwg
Maven org.geoserver:gs-main +2 · Upgrade all 3 to 2.27.0 or later · < 2.27.0 · CVE-2024-45747 · GHSA-wf6j-gr27-g7ch · amended
npm mcp-searxng · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-54689 · GHSA-wppf-h75h-6pm6
npm mcp-searxng · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-54688 · GHSA-q87f-qc2r-2gw4
PyPI geolens · Upgrade to 1.2.4 or later · < 1.2.4 · GHSA-p77j-g7h5-r2vw
Maven org.xwiki.platform:xwiki-platform-livedata-livetable · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.4, 17.4.10 or 16.10.17 by release line · >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-53966 · GHSA-45ph-gxxr-gwgw · amended
Packagist mcp/sdk · Upgrade to 0.7.1 or later · >= 0.5.0, < 0.7.1 · CVE-2026-53965 · GHSA-7m52-jw36-44r3 · amended
PyPI document-merge-service · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-53964 · GHSA-w47q-945m-q9pc
host/proxy args to CMA client, redirecting server PAT to attacker-controlled endpointnpm @contentful/mcp-tools · Upgrade to 0.4.5 or later · < 0.4.5 · +1 more package · CVE-2026-53957 · GHSA-2xhg-73j7-rrgx · amended
PyPI copier · Upgrade to 9.15.2 or later · >= 9.5.0, <= 9.15.1 · CVE-2026-53951 · GHSA-9gmc-jqmh-3rvm
Go github.com/inspektor-gadget/inspektor-gadget · Upgrade to 0.53.1 or later · >= 0.27.0, < 0.53.1 · CVE-2026-53941 · GHSA-vjhx-2cqw-3q6q · amended
crates.io block_buffer · Upgrade to 0.12.1 or later · >= 0.11.0, < 0.12.1 · GHSA-qwgh-2vcv-g2f7 · amended
path argument in FAF toolsnpm claude-faf-mcp · Upgrade to 5.7.2 or later · <= 5.7.1 · GHSA-rr55-jp92-8wp2
path argument in FAF toolsnpm faf-mcp · Upgrade to 2.1.3 or later · <= 2.1.2 · GHSA-j4r7-8ph4-43g3
path argument in FAF toolsnpm grok-faf-mcp · Upgrade to 1.5.3 or later · <= 1.5.2 · GHSA-cc2g-gq8c-r332
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.