Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
2501–2525 of 30,910 matching · newest first
order_by parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoSPyPI starlette-admin · Upgrade to 0.16.1 or later · <= 0.16.0 · CVE-2026-54553 · GHSA-6753-gr46-6wpr
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · < 0.23.35 · +2 more packages · CVE-2026-54556 · GHSA-vmm3-xgcx-67hm · amended
crates.io apimock-server · Upgrade to 5.19.1 or later · >= 0.0.0-0, < 5.19.1 · GHSA-72g6-wgrg-vhm7 · amended
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.25, 10.1.58 or 9.0.121 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.25; >= 10.1.0-M1, < 10.1.58; >= 9.0.0-M1, < 9.0.121; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109 · CVE-2026-68525 · GHSA-h3x4-894j-xpx5 · amended
Bitnami tomcat · Upgrade to 11.0.25, 10.1.58 or 9.0.121 by release line · >= 9.0.115, < 9.0.121; >= 10.1.53, < 10.1.58; >= 11.0.20, < 11.0.25 · +2 more packages · CVE-2026-65637 · GHSA-f525-44xv-f2qj · amended
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.25, 10.1.58 or 9.0.121 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.25; >= 10.1.0-M1, < 10.1.58; >= 9.0.0-M1, < 9.0.121; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109 · CVE-2026-65182 · GHSA-gcx9-497g-6cp6 · amended
Maven org.apache.tomcat:tomcat +2 · Upgrade all 3 to 11.0.25, 10.1.58 or 9.0.121 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.25; >= 10.1.0-M1, < 10.1.58; >= 9.0.0.M1, < 9.0.121; >= 8.5.0, <= 8.5.100; >= 7.0.30, <= 7.0.109 · CVE-2026-65905 · GHSA-9xv2-5v5q-p794 · amended
Go github.com/googleapis/genai-toolbox +1 · Upgrade all 2 to 0.25.0 or later · < 0.25.0 · CVE-2026-11624 · GHSA-76g7-m3xw-x9gr · amended
PyPI jupyterhub · Upgrade to 5.5.0 or later · < 5.5.0 · CVE-2026-54338 · GHSA-p43p-whwx-q52h
PyPI icalendar · Upgrade to 7.1.3 or later · >= 7.1.0, < 7.1.3 · CVE-2026-55099 · GHSA-cv84-9p8j-fj68
PyPI chainlit · Upgrade to 2.12.0 or later · >= 2.4.0rc0, < 2.12.0 · CVE-2026-45019 · GHSA-hvfh-5mj3-5f3j · amended
PyPI chainlit · Upgrade to 2.12.0 or later · >= 2.4.0rc0, <= 2.11.1 · CVE-2026-45018 · GHSA-w3fx-mc44-mf6j · amended
npm @arikusi/deepseek-mcp-server · Upgrade to 1.8.0 or later · >= 1.4.2, < 1.8.0 · CVE-2026-55605 · GHSA-72f3-6w86-7rv3
npm @arikusi/deepseek-mcp-server · Upgrade to 1.7.0 or later · >= 1.4.2, < 1.7.0 · CVE-2026-55604 · GHSA-fh3r-g96v-f578
npm consciousness-explorer · Upgrade to 1.1.2 or later · < 1.1.2 · +1 more package · CVE-2026-55609 · GHSA-xc9g-j69q-37xw
npm whistle · Upgrade to 2.10.3 or later · < 2.10.3 · CVE-2026-55629 · GHSA-3vfr-4gwf-qxfp
PyPI eml-parser · Upgrade to 3.0.2 or later · < 3.0.2 · CVE-2026-55620 · GHSA-g7gc-gmgp-wgqg
PyPI eml-parser · Upgrade to 3.0.2 or later · < 3.0.2 · CVE-2026-55619 · GHSA-m66c-fw79-6359
PyPI eml-parser · Upgrade to 3.0.2 or later · < 3.0.2 · CVE-2026-55618 · GHSA-fxgq-9m89-cxj9
crates.io mediasoup · Upgrade to 0.22.5 or later · >= 0.22.0, <= 0.22.4 · +1 more package · CVE-2026-55663 · GHSA-p7x2-g5cq-fhmq · amended
Go github.com/geiserx/genieacs-mcp · Upgrade to 0.3.2 or later · <= 0.3.1 · CVE-2026-55637 · GHSA-cmwv-wf9p-p8wx · amended
PromptService._render_template via unsandboxed Jinja2 EnvironmentPyPI mcp-contextforge-gateway · Upgrade to 1.0.0 or later · < 1.0.0 · GHSA-vwf3-4xxj-qg6h
PyPI reachy-mini · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2026-55419 · GHSA-m2pc-3q4q-w6jr
Go github.com/aquasecurity/trivy · Upgrade to 0.71.1 or later · < 0.71.1 · CVE-2026-55092 · GHSA-mcj4-mphf-j9ff · amended
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.5 or later · <= 4.1.4 · CVE-2026-57995 · GHSA-pg62-f8g4-4wqh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.