LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
PyPI lmcache · Upgrade to 0.5.6 or later · >= 0.3.9, < 0.5.6 · CVE-2026-105192 · GHSA-w5f2-9q9c-ff4h · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
PyPI lmcache · Upgrade to 0.5.6 or later · >= 0.3.9, < 0.5.6 · CVE-2026-105192 · GHSA-w5f2-9q9c-ff4h · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.146.0 or later · < 0.146.0 · CVE-2026-100349 · GHSA-74vm-87hj-r66f · amended
crates.io lopdf · Upgrade to 0.42.0 or later · < 0.42.0 · GHSA-6fj4-rcr3-r7rr · amended
Maven org.bytedeco:javacv · Upgrade to 1.5.14 or later · < 1.5.14 · CVE-2026-102834 · GHSA-rxjv-24xq-76wc · amended
PyPI claude-agent-sdk · Upgrade to 0.2.121 or later · < 0.2.121 · CVE-2026-96620 · GHSA-h4mw-j7qp-8mwm · amended
Go github.com/gomarkdown/markdown · Upgrade to 0.0.0-20260724235538-61af6e1e6971 (pre-release) or later · < 0.0.0-20260724235538-61af6e1e6971 · CVE-2026-102941 · GHSA-cv23-7vc5-jfh7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.