A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
Maven org.a2aproject.sdk:a2a-java-sdk-transport-rest · Upgrade to 1.3.0.Final or later · < 1.3.0.Final · CVE-2026-111762 · GHSA-x32g-jvvm-4725 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 73 matching · newest first
Maven org.a2aproject.sdk:a2a-java-sdk-transport-rest · Upgrade to 1.3.0.Final or later · < 1.3.0.Final · CVE-2026-111762 · GHSA-x32g-jvvm-4725 · amended
Maven org.a2aproject.sdk:a2a-java-sdk-http-client-android · Upgrade to 1.3.2.Final or later · >= 1.3.0.Final, <= 1.3.1.Final · CVE-2026-111765 · GHSA-4fpj-g9jf-9rgg · amended
Maven org.a2aproject.sdk:a2a-java-sdk-server-common · Upgrade to 1.3.0.Final or later · < 1.3.0.Final · CVE-2026-111761 · GHSA-q78c-5jjq-57g8 · amended
Maven org.a2aproject.sdk:a2a-java-sdk-server-common · Upgrade to 1.3.0.Final or later · < 1.3.0.Final · CVE-2026-111764 · GHSA-qw47-mcm5-934w · amended
Maven org.a2aproject.sdk:a2a-java-sdk-parent · Upgrade to 1.3.0.Final or later · < 1.3.0.Final · CVE-2026-111763 · GHSA-9rhm-2h4x-jwmx · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112397 · GHSA-58r4-6rv3-gfh8 · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 9.2.0, < 13.0.0 · CVE-2026-112400 · GHSA-65qm-jvmh-6pqg · amended
PyPI pillow · Upgrade to 13.0.0 or later · >= 2.3.0, <= 12.3.0 · CVE-2026-112899 · GHSA-vx6w-vv9f-6gvg · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.3.0, < 13.0.0 · CVE-2026-112897 · GHSA-q45j-58j2-45rg · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112896 · GHSA-pchr-8j38-3x4p · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-112895 · GHSA-p4wg-p73j-c528 · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 8.2.0, < 13.0.0 · CVE-2026-112395 · GHSA-462x-pgg6-55fp · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 8.1.0, < 13.0.0 · CVE-2026-112404 · GHSA-c6hw-5grf-ff96 · amended
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112403 · GHSA-8g5g-8vmr-9782 · amended
npm @angular/common · Upgrade to 21.0.3 or 20.3.34 by release line; some affected versions have no fix yet · >= 21.0.0, < 21.0.3; >= 20.0.0, < 20.3.34; <= 19.2.25 · CVE-2026-111753 · GHSA-jfgx-762w-99vr · amended
npm markdown-it · Upgrade to 15.0.3 or 14.3.3 by release line · >= 14.1.0, < 14.3.3; >= 15.0.0, < 15.0.3 · CVE-2026-111758 · GHSA-gfr2-rv44-r23c · amended
npm markdown-it · Upgrade to 15.0.3 or 14.3.3 by release line · < 14.3.3; >= 15.0.0, < 15.0.3 · CVE-2026-111766 · GHSA-vfgh-jcmw-g37q · amended
npm @modelcontextprotocol/server · Upgrade to 2.3.0 or later · >= 2.0.0, < 2.3.0 · CVE-2026-111770 · GHSA-jm63-cq47-j5jp · amended
npm @modelcontextprotocol/sdk · Upgrade to 1.32.0 or later · >= 1.3.0, < 1.32.0 · +1 more package · CVE-2026-111768 · GHSA-46jr-4wx8-v453 · amended
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111748 · GHSA-f9xw-jh8m-3mwq · amended
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111749 · GHSA-gx76-c99x-2c96 · amended
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111065 · GHSA-6cjc-53gc-5rqm · amended
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111750 · GHSA-pqxq-w44r-73xw · amended
PyPI aiohttp · Upgrade to 3.14.4 or later · >= 2.0.0, < 3.14.4 · CVE-2026-111066 · GHSA-9xw5-w5jj-pvcg · amended
npm launch-editor · Upgrade to 2.14.2 or later · <= 2.14.1 · +2 more packages · CVE-2026-112944 · GHSA-r825-w8mm-5pxw · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.