Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.10 or 2.15.0 by release line · >= 3.0.0.Beta1, < 3.0.10; >= 2.0.0, < 2.15.0 · CVE-2026-45300 · GHSA-fmxf-pm6p-7xgm
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47740 · GHSA-f946-9qp6-vgch
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45270 · GHSA-gqr2-7hcg-rchf
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-j5rm-v3vh-vx94 · amended
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-qq2p-4282-cfc5 · amended
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.0 or later · <= 1.18.1 · CVE-2026-45627 · GHSA-q2pj-8v84-9mh5
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.0 or later · <= 1.18.1 · CVE-2026-45625 · GHSA-7h26-hg47-p9hx
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.3 or later · >= 2.7.0, <= 2.10.2 · CVE-2026-45135 · GHSA-m675-2p33-xv9g
Maven org.springaicommunity:mcp-client-security · Upgrade to 0.1.9 or later · < 0.1.9 · CVE-2026-45609 · GHSA-qjp4-4jvr-xqg3
npm form-data-objectizer · Upgrade to 1.0.1 or later · <= 1.0.0 · CVE-2026-46510 · GHSA-m2hg-wjq3-28wq · amended
PyPI graphitedb · Upgrade to 0.2 or later · < 0.2 · GHSA-qw48-84f6-28gv · amended
.apm/prompts/ and .apm/agents/ are dereferenced during apm install, copying host-local file contents into the project treePyPI apm · Upgrade to 0.13.0 or later · >= 0.5.4, <= 0.12.4 · CVE-2026-45539 · GHSA-q5pp-gvjg-h7v4 · amended
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 11.5.2, 11.4.4, 10.11.14 or 8.0.0-20260326202606-fac92f4a71f3 (pre-release) by release line · >= 11.5.0, < 11.5.2; >= 10.11.0, < 10.11.14; >= 11.4.0, < 11.4.4; < 8.0.0-20260326202606-fac92f4a71f3 · +1 more package · CVE-2026-6346 · GHSA-9p64-jpc7-m2rp
Go github.com/mattermost/mattermost-plugin-calls · Upgrade to 1.12.0-rc2 (pre-release) or later · < 1.12.0-rc2 · +1 more package · CVE-2026-6347 · GHSA-82j6-4fq7-fx62
npm jsondiffpatch · Upgrade to 0.7.6 or later · < 0.7.6 · CVE-2026-8657 · GHSA-j4fx-xxwh-2485 · amended
Maven com.oviva.telematik:epa4all-client · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-45575 · GHSA-gqx7-6552-67hf
Maven org.apache.flink:flink-table-planner_2.12 +2 · Upgrade all 3 to 2.2.1, 2.1.2, 2.0.2 or 1.20.4 by release line · >= 1.15.0, < 1.20.4; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.2; >= 2.2.0, < 2.2.1 · CVE-2026-35194 · GHSA-2f54-v4hm-fx73
Maven com.oviva.telematik:epa4all-client · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-45574 · GHSA-5hhf-xmfx-4vvr
Packagist simplesamlphp/simplesamlphp-module-casserver · Upgrade to 7.0.3 or later · <= 7.0.2 · CVE-2026-46491 · GHSA-jrrg-99xh-5j2q
Packagist code16/sharp · Upgrade to 9.22.0 or later · < 9.22.0 · CVE-2026-44692 · GHSA-748w-hm6r-qc7v
PUT /api/datasources/:datasourceId is protected only by TABLE/READ permission instead of builder access, allowing any authenticated app user to overwrite datasource connection…npm @budibase/server · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45717 · GHSA-44m2-crh7-f4q2 · amended
npm @budibase/server · Upgrade to 3.38.1 or later · < 3.38.1 · CVE-2026-45715 · GHSA-fgqv-jh4g-pvg2 · amended
npm @budibase/server · Upgrade to 3.34.8 or later · < 3.34.8 · CVE-2026-45548 · GHSA-rpj4-7x2v-wjrf · amended
npm better-auth · Upgrade to 1.5.0-beta.9 (pre-release) or 1.4.17 by release line · < 1.4.17; >= 1.5.0-beta.1, < 1.5.0-beta.9 · CVE-2026-45364 · GHSA-p6v2-xcpg-h6xw · amended
Go goshs.de/goshs/v2 · Upgrade to 2.0.7 or later · <= 2.0.6 · GHSA-mxg3-432p-mr72
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.