fast-uri vulnerable to host confusion via percent-encoded scheme normalization
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.3.1, < 2.4.5; >= 3.0.0, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-76172 · GHSA-jqff-g426-hqxp
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm fast-uri · Upgrade to 4.1.3, 3.1.6 or 2.4.5 by release line · >= 2.3.1, < 2.4.5; >= 3.0.0, < 3.1.6; >= 4.0.0, < 4.1.3 · CVE-2026-76172 · GHSA-jqff-g426-hqxp
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-62388 · GHSA-p3m8-78j2-g5p3 · amended
PyPI mistune · Upgrade to 3.3.3 or later · >= 3.3.0, < 3.3.3 · CVE-2026-76098 · GHSA-6m44-fpc8-c3rq
npm apostrophe · Upgrade to 4.32.1 or later · < 4.32.1 · CVE-2026-71553 · GHSA-vmg4-6gfg-83qx · amended
npm orval · Upgrade to 8.22.0 or later · < 8.22.0 · CVE-2026-62680 · GHSA-cxq5-97v7-87j8
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72716 · GHSA-p4cg-3328-rvfg · amended
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71866 · GHSA-6mr6-jvcr-2f25 · amended
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171108-5e8f99f40a8a (pre-release) or later · < 0.0.0-20260512171108-5e8f99f40a8a · CVE-2026-72920 · GHSA-2v6v-25fm-p4fg · amended
Packagist getgrav/grav · Upgrade to 2.0.7 or later · < 2.0.7 · CVE-2026-64850 · GHSA-fj2p-qj2f-74v5 · amended
Packagist easycorp/easyadmin-bundle · Upgrade to 5.5.1 or 4.29.16 by release line · >= 4.0.0, < 4.29.16; >= 5.0.0, < 5.5.1 · CVE-2026-81892 · GHSA-g2fm-8hr4-j82h · amended
PyPI tornado · Upgrade to 6.5.8 or later · <= 6.5.7 · CVE-2026-82397 · GHSA-mpf4-983q-p7j4
npm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · < 10.34.5; >= 11.0.0, < 11.11.0 · CVE-2026-82392 · GHSA-c59q-g84q-2gj5
name escapes node_modules → arbitrary file write/overwrite on installnpm pnpm · Upgrade to 11.11.0 or 10.34.5 by release line · < 10.34.5; >= 11.0.0, < 11.11.0 · CVE-2026-82393 · GHSA-vq4v-j7r6-jq4m
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-81726 · GHSA-8mgp-746c-j5xp · amended
npm @faker-js/faker · Upgrade to 10.5.0 or later · <= 10.4.0 · CVE-2026-73231 · GHSA-qxc2-j82w-r537
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260704035520-68cc0f537dfa (pre-release) or later · < 0.0.0-20260704035520-68cc0f537dfa · CVE-2026-59832 · GHSA-275h-v5h9-vr82 · amended
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260704035518-d0f0fe146fb0 (pre-release) or later · < 0.0.0-20260704035518-d0f0fe146fb0 · CVE-2026-59834 · GHSA-h89q-4j2h-7h88 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.