filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
PyPI filelock · Upgrade to 4.2.1 or later · >= 4.1.0, <= 4.2.0 · CVE-2026-112937 · GHSA-jqc4-5cvw-7w85 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 80 matching · newest first
PyPI filelock · Upgrade to 4.2.1 or later · >= 4.1.0, <= 4.2.0 · CVE-2026-112937 · GHSA-jqc4-5cvw-7w85 · amended
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.20.4, <= 4.2.0 · CVE-2026-112913 · GHSA-9vhv-jxww-xfm5 · amended
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.22.0, <= 4.2.0 · CVE-2026-112907 · GHSA-567q-5qvw-pf92 · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.10 or later · >= 21.14.8, < 21.14.10 · CVE-2026-113713 · GHSA-4f8h-vr72-p32c · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113717 · GHSA-cx28-75q4-x26q · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113714 · GHSA-494p-63j8-28p3 · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113718 · GHSA-394h-qwmc-48pf · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113720 · GHSA-fc2g-4w5p-6whm · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113723 · GHSA-6w3r-xr62-4xcp · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113715 · GHSA-qmx5-4p3x-wvqf · amended
PyPI virtualenv +1 · Upgrade all 2 to 21.14.9 or later · < 21.14.9 · CVE-2026-113719 · GHSA-hhxq-47xx-j5xx · amended
npm @azure/msal-node · Upgrade to 7.1.0 or later · >= 5.0.0-beta.0, < 7.1.0 · CVE-2026-109461 · GHSA-xcx6-jx8p-x3h5 · amended
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 6.23.0, < 6.29.1; >= 7.18.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109869 · GHSA-xjj6-f33q-929c · amended
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 6.5.0, < 6.29.1; >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109924 · GHSA-4qv8-2p9j-2685 · amended
npm undici · Upgrade to 8.12.2 or 7.30.1 by release line · >= 7.15.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109841 · GHSA-f72v-6w45-q472 · amended
npm serialize-javascript · Upgrade to 7.1.3 or later · < 7.1.3 · CVE-2026-115897 · GHSA-m5mm-p8h7-m29v · amended
npm multer · Upgrade to 2.5.0 or later · >= 2.0.0, < 2.5.0 · CVE-2026-113872 · GHSA-q7qp-rjg7-q26m · amended
PyPI mlflow +1 · Upgrade all 2 to 3.17.0 or later · >= 3.12.0rc0, < 3.17.0 · CVE-2026-115886 · GHSA-2wqp-q3c6-ccj5 · amended
. reach other namespaces in Postgres and SQLite storesPyPI langgraph-checkpoint-postgres · Upgrade to 3.1.3 or later · < 3.1.3 · +1 more package · CVE-2026-115883 · GHSA-6hmw-9432-67qq · amended
npm happy-dom · Upgrade to 21.0.4 or later · >= 17.0.0, <= 21.0.3 · CVE-2026-115895 · GHSA-834v-8h66-3h79 · amended
PyPI filelock · Upgrade to 4.2.1 or later · >= 4.1.0, <= 4.2.0 · CVE-2026-112906 · GHSA-2g95-wg33-c5x2 · amended
PyPI filelock · Upgrade to 4.2.1 or later · >= 4.1.0, <= 4.2.0 · CVE-2026-112914 · GHSA-crv4-6mhj-j5jh · amended
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.20.4, <= 4.2.0 · CVE-2026-112940 · GHSA-v4x8-3wr5-3wq8 · amended
.* glob segment let an analyzed repository make Fallow test paths in the parent of the project rootnpm fallow +4 · Upgrade all 5 to 3.34.0 or later · < 3.34.0 · GHSA-h4fr-cmh5-qr62 · amended
projects entries let an analyzed repository make Fallow read files outside the project rootnpm fallow +3 · Upgrade all 4 to 3.34.0 or later · >= 2.68.0, < 3.34.0 · CVE-2026-115569 · GHSA-jfwm-3p3c-6hx5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.