Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Maven org.springframework.hateoas:spring-hateoas · Upgrade to 3.0.4 or 2.5.3 by release line; some affected versions have no fix yet · >= 3.0.0, <= 3.0.3; >= 2.5.0, <= 2.5.2; >= 2.3.0, <= 2.3.4; <= 1.5.6; >= 2.4.0, <= 2.4.1 · CVE-2026-41006 · GHSA-7fxc-486f-32q9
Maven org.springframework.ldap:spring-ldap-core · Upgrade to 4.0.4 or 3.3.8 by release line; some affected versions have no fix yet · >= 4.0.0, <= 4.0.3; >= 3.3.0, <= 3.3.7; >= 3.2.0, <= 3.2.16; <= 2.4.4 · CVE-2026-41720 · GHSA-jrv5-8w28-4265
Maven org.springframework:spring-webmvc · Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41845 · GHSA-3chg-m5w7-qfv5
Maven org.springframework.hateoas:spring-hateoas · Upgrade to 3.0.4 or 2.5.3 by release line; some affected versions have no fix yet · >= 3.0.0, <= 3.0.3; >= 2.5.0, <= 2.5.2; >= 2.3.0, <= 2.3.4; <= 1.5.6; >= 2.4.0, <= 2.4.1 · CVE-2026-41007 · GHSA-439x-6767-44cv
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet · >= 7.0.0, <= 7.0.7; >= 6.2.0, <= 6.2.18; >= 6.1.0, <= 6.1.21; <= 5.3.39 · CVE-2026-41842 · GHSA-x23c-287f-qqv5
Maven io.micrometer:micrometer-jetty11 +2 · Upgrade all 3 to 1.16.6 or 1.15.12 by release line; some affected versions have no fix yet · >= 1.16.0, <= 1.16.5; >= 1.15.0, <= 1.15.11; >= 1.14.0, <= 1.14.14; <= 1.13.15 · CVE-2026-40984 · GHSA-g3pr-3p32-fp23
Maven io.micrometer:micrometer-core · Upgrade to 1.16.6 or 1.15.12 by release line · >= 1.16.0, <= 1.16.5; >= 1.15.0, <= 1.15.11 · CVE-2026-40983 · GHSA-w737-wx49-qj23
RubyGems puma · Upgrade to 8.0.2 or 7.2.1 by release line · >= 8.0.0, < 8.0.2; >= 5.5.0, < 7.2.1 · CVE-2026-47737 · GHSA-2vqw-3mp8-cgmx · amended
RubyGems puma · Upgrade to 8.0.2 or 7.2.1 by release line · >= 8.0.0, < 8.0.2; >= 5.5.0, < 7.2.1 · CVE-2026-47736 · GHSA-qpgp-93vx-g8v8 · amended
Go github.com/basekick-labs/arc · Upgrade to 0.0.0-20260520141557-91bdc29d1a02 (pre-release) or later · < 0.0.0-20260520141557-91bdc29d1a02 · CVE-2026-47735 · GHSA-p2j4-c4g6-rpf5
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · <= 0.3.1 · CVE-2026-47726 · GHSA-qm33-p5p9-f8vg
Go github.com/juev/nebula-mesh · Upgrade to 0.3.3 or later · <= 0.3.2 · CVE-2026-47725 · GHSA-273q-qgh5-wrj6
Go github.com/juev/nebula-mesh · Upgrade to 0.3.4 or later · < 0.3.4 · CVE-2026-47724 · GHSA-598g-h2vc-h5vg
Go github.com/juev/nebula-mesh · Upgrade to 0.3.1 or later · <= 0.3.0 · CVE-2026-47723 · GHSA-w7w5-5gcp-38rw
Go github.com/juev/nebula-mesh · Upgrade to 0.3.2 or later · < 0.3.2 · CVE-2026-47722 · GHSA-7hp6-g3pq-3pc3
Go github.com/julien040/anyquery/plugins/chrome +3 · Upgrade all 4 to 0.0.0-20240826075852-c651df0b8767 (pre-release) or later · < 0.0.0-20240826075852-c651df0b8767 · CVE-2026-47252 · GHSA-hrj8-hjv8-mgwc
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-47691 · GHSA-5pvg-856g-cp85
Maven io.netty:netty-transport-sctp · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-46340 · GHSA-5xrh-qmmq-w6ch
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45674 · GHSA-676x-f7gg-47vc
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh
Packagist phpoffice/phpspreadsheet · Upgrade to 1.30.5 or later · <= 1.30.4 · CVE-2026-45034 · GHSA-87m4-826x-3crx
Maven io.netty:netty-codec-classes-quic · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44894 · GHSA-cmm3-54f8-px4j
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44893 · GHSA-cc37-9q2j-3hfv
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44892 · GHSA-c2rx-5r8w-8xr2
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44890 · GHSA-6ghj-frrj-jjj3
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.