Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
2651–2675 of 30,921 matching · newest first
Packagist backpack/crud · Partial vendor fix · >= 5.0.0; >= 6.0.0, < 6.8.12; >= 7.0.0, < 7.0.35 · CVE-2026-54178 · GHSA-8xjm-wqrp-2f25
shell.php reach the webserverPackagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54177 · GHSA-8q2w-pv9p-mjvc · amended
Packagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54176 · GHSA-9fw9-8c49-qch8 · amended
Packagist backpack/crud · Upgrade to 7.0.34 or 6.8.11 by release line · < 6.8.11; >= 7.0.0-alpha.1, < 7.0.34 · CVE-2026-54175 · GHSA-xpv2-hrfc-hw62 · amended
npm @whyour/qinglong · Upgrade to 2.20.1 or later · < 2.20.1 · CVE-2026-55445 · GHSA-v667-gc2r-2xm7 · amended
Go github.com/openshift-pipelines/pipelines-as-code · Upgrade to 0.48.0, 0.42.1, 0.39.6 or 0.37.8 by release line · < 0.37.8; >= 0.38.0, < 0.39.6; >= 0.40.0, < 0.42.1; >= 0.43.0, < 0.48.0 · CVE-2026-54168 · GHSA-6f2p-296r-cc28 · amended
Go github.com/openshift-pipelines/pipelines-as-code · Upgrade to 0.48.0, 0.42.1, 0.39.6 or 0.37.8 by release line · >= 0.43.0, < 0.48.0; >= 0.40.0, < 0.42.1; >= 0.38.0, < 0.39.6; < 0.37.8 · CVE-2026-54167 · GHSA-f5f4-3hh4-f54m · amended
Go github.com/opentofu/opentofu · Upgrade to 1.12.2 or 1.11.9 by release line · >= 1.12.0-beta1, < 1.12.2; < 1.11.9 · GHSA-22w5-2fxg-vrwx · amended
Go github.com/alexandre-daubois/ember · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-54162 · GHSA-x3g7-qrwc-f6c5 · amended
npm node-opcua · Upgrade to 2.166.0 or later · < 2.166.0 · CVE-2026-54156 · GHSA-6wvw-vrw4-363w
npm next-video · Upgrade to 2.8.1 or later · <= 2.8.0 · CVE-2026-54150 · GHSA-2p39-2jf3-fv2q · amended
PyPI zoo-kcl · Upgrade to 0.3.153 or later · < 0.3.153 · +1 more package · GHSA-mc9m-6fm9-pghc · amended
PyPI zoo-kcl +1 · Upgrade all 2 to 0.3.129 or later · < 0.3.129 · GHSA-jgvr-6x5w-hx5w · amended
Maven org.jsoup:jsoup · Upgrade to 1.23.2 or later · < 1.23.2 · CVE-2026-75140 · GHSA-65r4-943x-97jj · amended
PyPI stigmem-node · Upgrade to 0.9.0a11 (pre-release) or later · < 0.9.0a11 · GHSA-5p3m-vhh6-9236
npm @nocobase/plugin-backups · Upgrade to 2.1.19 or later · < 2.1.19 · CVE-2026-55410 · GHSA-p853-83gj-wjj3
PyPI langgraph-store-mongodb · Upgrade to 0.4.0 or later · < 0.4.0 · +1 more package · CVE-2026-55253 · GHSA-533j-2v4q-mw5h
PyPI asteval · Upgrade to 1.0.9 or later · < 1.0.9 · CVE-2026-55244 · GHSA-89v8-rhwq-hf77
PyPI asteval · Upgrade to 1.0.9 or later · < 1.0.9 · GHSA-9w56-46f6-3qhx
Go github.com/vouch/vouch-proxy · Upgrade to 0.48.0 or later · <= 0.47.2 · CVE-2026-55149 · GHSA-qqff-5854-px68 · amended
Go go.opentelemetry.io/otel/bridge/opentracing · Upgrade to 1.45.0 or later · >= 0.11.0, < 1.45.0 · CVE-2026-45404 · GHSA-42cj-99w8-cp2p · amended
Go github.com/vmware-tanzu/velero · Upgrade to 1.18.1 or later · < 1.18.1 · CVE-2026-32637 · GHSA-j2g6-362q-6qc6 · amended
crates.io wasmtime · Upgrade to 47.0.4 or 46.0.3 by release line · >= 46.0.0, < 46.0.3; >= 47.0.0, < 47.0.4 · CVE-2026-115391 · GHSA-x84v-gj2h-g759 · amended
crates.io cap-primitives · Upgrade to 4.0.3 or 3.4.6 by release line · >= 0.0.0-0, < 3.4.6; >= 4.0.0, < 4.0.3 · GHSA-hp8f-xmx4-4qrg
crates.io wasmtime · Upgrade to 47.0.4, 46.0.3, 36.0.14 or 24.0.13 by release line · >= 0.0.0-0, < 24.0.13; >= 25.0.0, < 36.0.14; >= 37.0.0, < 46.0.3; >= 47.0.0, < 47.0.4 · CVE-2026-115392 · GHSA-vqjp-4c8c-hfgg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.