Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 42 matching · newest first
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20251010122814-fedc25e3f725 (pre-release) or later · < 0.0.0-20251010122814-fedc25e3f725 · CVE-2026-88986 · GHSA-g3qx-frcg-j979 · amended
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260403210607-ac3a4c65677a (pre-release) or later · < 0.0.0-20260403210607-ac3a4c65677a · CVE-2026-88985 · GHSA-r4mx-2gr2-8277 · amended
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260420170029-186dd1f3b040 (pre-release) or later · < 0.0.0-20260420170029-186dd1f3b040 · CVE-2026-88984 · GHSA-ghgh-57qv-h687 · amended
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260517162502-504d7797c1e0 (pre-release) or later · < 0.0.0-20260517162502-504d7797c1e0 · CVE-2026-88983 · GHSA-f7vj-6669-qvv4 · amended
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260910172610-620d0cc89ae0 (pre-release) or later · < 0.0.0-20260910172610-620d0cc89ae0 · CVE-2026-88982 · GHSA-2xwh-426q-42c5 · amended
npm @anthropic-ai/claude-code · Upgrade to 2.1.251 or later · < 2.1.251 · CVE-2026-88968 · GHSA-5xjx-9qx6-jcrv · amended
Go github.com/ddev/ddev · Upgrade to 1.25.4 or later · < 1.25.4 · CVE-2026-108262 · GHSA-9hq4-hm3j-jmph · amended
npm moleculer · Upgrade to 0.15.2 or 0.14.36 by release line · >= 0.15.0-beta1, < 0.15.2; < 0.14.36 · CVE-2026-97705 · GHSA-h89v-g948-47vp · amended
Go www.velocidex.com/golang/velociraptor · Upgrade to 0.77.2 or later · < 0.77.2 · CVE-2026-85737 · GHSA-9qq5-422f-33c2 · amended
Go github.com/kubeflow/pipelines · Upgrade to 0.0.0-20260909234119-62516d8c525f (pre-release) or later · < 0.0.0-20260909234119-62516d8c525f · CVE-2026-77596 · GHSA-rjr3-43j3-4q8g · amended
Packagist filegator/filegator · Upgrade to 7.15.0 or later · < 7.15.0 · CVE-2026-94619 · GHSA-44r8-3p76-84mw · amended
Packagist filegator/filegator · Upgrade to 7.15.0 or later · < 7.15.0 · CVE-2026-94618 · GHSA-f74m-x83r-c4v4 · amended
PyPI code-graph-rag · Upgrade to 0.0.587 or later · < 0.0.587 · CVE-2026-87008 · GHSA-85gg-2gfq-q95m · amended
PyPI gpustack · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-102895 · GHSA-gj9m-f8ph-pmhr · amended
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260727180059-43aaccd5bfac (pre-release) or later · < 0.0.0-20260727180059-43aaccd5bfac · CVE-2026-115770 · GHSA-rm8c-2cv8-jwf6 · amended
PyPI urwid · Upgrade to 4.0.7 or later · < 4.0.7 · CVE-2026-103022 · GHSA-cp25-j9x5-p5xm · amended
Go github.com/esm-dev/esm.sh/web · Upgrade to 0.2.0 or later · < 0.2.0 · CVE-2026-102657 · GHSA-g3c2-rjq2-c763 · amended
fast-agent serve binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command executionPyPI fast-agent-mcp · Upgrade to 0.7.21 or later · < 0.7.21 · CVE-2026-102610 · GHSA-9vhv-g5hf-m7m7 · amended
Go github.com/telepresenceio/telepresence · Upgrade to 2.31.0 or later · < 2.31.0 · CVE-2026-102340 · GHSA-j8j4-rw65-56r6 · amended
Go github.com/telepresenceio/telepresence/v2 · Upgrade to 2.31.0 or later · < 2.31.0 · CVE-2026-102339 · GHSA-6j3h-rp73-6rvf · amended
PyPI zizmor · Upgrade to 1.28.0 or later · >= 1.27.0, < 1.28.0 · CVE-2026-102289 · GHSA-f42p-wjw5-97qh · amended
X-Forwarded-For headerGo github.com/mayswind/ezbookkeeping · Upgrade to 1.6.0 or later · >= 0.10.0, < 1.6.0 · CVE-2026-86041 · GHSA-wchh-mrv2-5h4q · amended
RubyGems omniauth · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-63183 · GHSA-m27g-v28p-f9fx · amended
Maven com.gradleup.shadow:com.gradleup.shadow.gradle.plugin · Upgrade to 9.6.0 or later · < 9.6.0 · CVE-2026-75598 · GHSA-rr8v-fxxf-c986 · amended
PyPI code-graph-rag · Upgrade to 0.0.345 or later · < 0.0.345 · CVE-2026-77604 · GHSA-vvr2-h2jp-838m · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.