Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 67 matching · newest first
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +10 · Upgrade all 11 to 11.0.0 or later · >= 11.0.0-preview.6.26359.118, < 11.0.0 · CVE-2026-109481 · GHSA-xw2x-23jm-j582 · amended
NuGet microsoft.aspnetcore.webutilities · Upgrade to 2.3.14 or later · >= 2.3.0, < 2.3.14 · CVE-2026-118750 · GHSA-6527-9fp8-r4x6 · amended
NuGet aspire.hosting.apphost +1 · Upgrade all 2 to 13.6.5 or later · < 13.6.5 · CVE-2026-120006 · GHSA-f7vh-h5g3-7jrh · amended
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-0, < 8.0.34; >= 9.0.0-0, < 9.0.23; >= 10.0.0-0, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-109475 · GHSA-3g4v-f5gv-c7xf · amended
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 11.0.0 or later · >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-120796 · GHSA-cpw3-h88j-9f6x · amended
NuGet system.formats.cbor · Upgrade to 11.0.0, 10.0.15, 9.0.24 or 8.0.2 by release line · >= 8.0.0-0, < 8.0.2; >= 9.0.0-0, < 9.0.24; >= 10.0.0-0, < 10.0.15; >= 11.0.0-0, < 11.0.0 · CVE-2026-118747 · GHSA-vmv3-wvjp-wqpj · amended
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 11.0.0 or later · >= 11.0.0-rc.1.26425.128, < 11.0.0 · CVE-2026-118749 · GHSA-m28h-pj36-4364 · amended
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-preview.1.23112.2, < 8.0.34; >= 9.0.0-preview.1.24081.5, < 9.0.23; >= 10.0.0-preview.1.25120.3, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-114149 · GHSA-x33c-w48q-qrgc · amended
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +10 · Upgrade all 11 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-rc.1.23421.29, < 8.0.34; >= 9.0.0-preview.1.24081.5, < 9.0.23; >= 10.0.0-preview.1.25120.3, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-109476 · GHSA-xhj5-c3g8-pfj8 · amended
npm react-server-dom-turbopack +2 · Upgrade all 3 to 19.3.1, 19.2.9, 19.1.10 or 19.0.9 by release line · >= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1 · CVE-2026-126187 · GHSA-xqc2-xf4c-x3h3 · amended
PyPI compose-lint · Upgrade to 0.32.0 or later · >= 0.31.0, < 0.32.0 · CVE-2026-125123 · GHSA-8v59-qmwv-4p6q · amended
GitHub Actions tmatens/compose-lint · Upgrade to 0.32.0 or later · >= 0.30.0, < 0.32.0 · CVE-2026-125125 · GHSA-xcf7-88g6-7xr8 · amended
PyPI compose-lint · Upgrade to 0.32.0 or later · >= 0.31.0, < 0.32.0 · CVE-2026-125122 · GHSA-hr4h-4c45-v4q4 · amended
RubyGems activestorage · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126186 · GHSA-v924-7rp8-4mxh · amended
RubyGems activestorage · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126085 · GHSA-hfr4-8rjc-97m2 · amended
RubyGems activesupport · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126080 · GHSA-8474-xrp6-wh69 · amended
RubyGems activestorage · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126074 · GHSA-p2pm-g2h6-7j5j · amended
RubyGems actionmailbox · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126068 · GHSA-5957-c7qm-m469 · amended
RubyGems activesupport · Upgrade to 8.1.4.1 or later · >= 8.1.0.beta1, < 8.1.4.1 · CVE-2026-126075 · GHSA-2w9f-fxwj-w2qf · amended
RubyGems actionpack · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126073 · GHSA-r9jg-fmfx-2gv6 · amended
RubyGems actionpack · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126067 · GHSA-gmj8-hvj3-49mw · amended
RubyGems activestorage · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; >= 8.0.0.beta1, < 8.0.5.2 · CVE-2026-126071 · GHSA-4v2w-w6g6-f8f8 · amended
RubyGems actionpack · Upgrade to 8.1.4.1 or later · >= 8.1.0.beta1, < 8.1.4.1 · CVE-2026-126083 · GHSA-2gff-2mmg-m73p · amended
RubyGems actionpack · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126076 · GHSA-2586-8ghr-69fj · amended
npm node-forge · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-125335 · GHSA-6889-vf6x-f3g5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.