Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
76–93 of 93 matching · newest first
DataTable.setCell and column writers treat __proto__ as an existing column.npm @highcharts/dashboards · Upgrade to 4.2.2 or later · >= 1.0.0, < 4.2.2 · +1 more package · CVE-2026-118247 · GHSA-c75x-9x9h-28rm · amended
__proto__ data table id writes sync listeners to Object.prototypenpm @highcharts/dashboards · Upgrade to 4.2.2 or later · >= 1.0.0, < 4.2.2 · CVE-2026-118243 · GHSA-jqgh-w3cc-7jqw · amended
innerHTML during printingnpm highcharts · Upgrade to 13.1.0 or 12.6.1 by release line · >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0 · CVE-2026-118244 · GHSA-65hg-cf3f-5m39 · amended
javascript: URL in an xlink:href attribute survives text filtering and reaches exported chartsnpm highcharts · Upgrade to 13.1.1, 12.6.2 or 11.4.9 by release line · >= 10.3.2, < 11.4.9; >= 12.0.0, < 12.6.2; >= 13.0.0, < 13.1.1 · CVE-2026-116796 · GHSA-mw4f-gj5x-6xr4 · amended
%2F-encoded path bypasses route/group middleware guarding a statically-served pathGo github.com/labstack/echo/v4 · Upgrade to 4.16.0 or later · < 4.16.0 · +1 more package · CVE-2026-118650 · GHSA-375p-5qhx-8wq4 · amended
Go github.com/labstack/echo/v4 · Upgrade to 4.16.0 or later · < 4.16.0 · +1 more package · CVE-2026-118652 · GHSA-h9g5-28mm-hx3g · amended
Go github.com/labstack/echo/v4 · Upgrade to 4.16.0 or later · < 4.16.0 · +1 more package · CVE-2026-118266 · GHSA-r7w9-592q-9vg4 · amended
npm mcp-sanitizer · Upgrade to 1.4.0 or later · < 1.4.0 · GHSA-4mfg-r38w-w8fg · amended
npm mcp-sanitizer · Upgrade to 1.4.0 or later · < 1.4.0 · GHSA-7w82-6f9j-v9jp · amended
PyPI rucio · Upgrade to 41.0.0rc1 (pre-release), 38.6.0 or 35.9.0 by release line · >= 1.16.1, < 35.9.0; >= 36.0.0rc1, < 38.6.0; >= 39.0.0rc1, < 41.0.0rc1 · CVE-2026-58273 · GHSA-5j9r-fx4x-rpvg · amended
NuGet mysqlconnector · Upgrade to 2.6.1 or later · < 2.6.1 · GHSA-473q-m89c-ghf8 · amended
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.5 or later · < 2.11.5 · CVE-2026-55458 · GHSA-8qx7-j2v2-x6q5 · amended
crates.io juniper · Upgrade to 0.17.2 or later · >= 0.0.0-0, < 0.17.2 · GHSA-36rq-8957-mjrx
ENABLE_WIKILINKScrates.io pulldown-cmark · Upgrade to 0.13.6 or later · >= 0.13.0, < 0.13.6
crates.io calamine · Upgrade to 0.38.0 or later · >= 0.0.0-0, < 0.38.0
crates.io juniper · Upgrade to 0.17.2 or later · >= 0.0.0-0, < 0.17.2 · GHSA-34cw-x8g7-rcv5
crates.io libz-sys · Upgrade to 1.1.31 or later · >= 1.0.21, < 1.1.31 · GHSA-8p3x-q3q3-q3v5
crates.io juniper_hyper · Upgrade to 0.10.1 or later · >= 0.0.0-0, < 0.10.1 · GHSA-pfrg-qg4f-grmv
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.