Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
3076–3100 of 30,921 matching · newest first
DELETE /api/v1/chatflows/:id does not validate resource type, allowing agentflows:delete and chatflows:delete to delete each other’s flow typenpm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-69262 · GHSA-p5w8-m249-4r4v
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69259 · GHSA-x3hf-7cj6-3r4m · amended
overrideConfig Spread in Prediction APInpm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-69258 · GHSA-6vh2-wg4h-4vwj
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-69257 · GHSA-c6xh-wv4j-ppv5
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69256 · GHSA-x6vm-w76m-8j7g · amended
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69255 · GHSA-vmv7-4m6c-3cg5 · amended
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69254 · GHSA-3769-jgqc-cxm7 · amended
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69253 · GHSA-wg86-r78f-74mp · amended
/api/v1/files allows low-privileged API keys to list and delete files across workspaces within the same organizationnpm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-69252 · GHSA-wp74-f5hh-5f3r
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-69251 · GHSA-g32j-mmxr-gfq5 · amended
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-69250 · GHSA-r745-8hwv-h473
npm flowise · Upgrade to 3.1.3 or later · <= 3.1.2 · CVE-2026-73488 · GHSA-2364-jh4q-m9vm · amended
ReadChunk::commit when an element's Drop panicscrates.io rtrb · Upgrade to 0.4.0 or 0.3.5 by release line · >= 0.0.0-0, < 0.3.5; >= 0.4.0-0, < 0.4.0
PyPI cryptography · Upgrade to 49.0.0 or later · >= 45.0.0, < 49.0.0 · CVE-2026-69248 · GHSA-m2h6-j472-rp4c
PyPI cryptography · Upgrade to 49.0.0 or later · >= 42.0.0, < 49.0.0 · CVE-2026-69249 · GHSA-jwv3-5hgf-82ww
PyPI cryptography · Upgrade to 50.0.0 or later · >= 44.0.0, < 50.0.0 · CVE-2026-69247 · GHSA-g6cj-pr64-35w5
Packagist guzzlehttp/guzzle · Upgrade to 8.0.1 or 7.15.2 by release line · < 7.15.2; >= 8.0.0, < 8.0.1 · CVE-2026-69246 · GHSA-v5mv-p594-2x33 · amended
Packagist guzzlehttp/guzzle · Upgrade to 8.0.1 or 7.15.2 by release line · < 7.15.2; >= 8.0.0, < 8.0.1 · CVE-2026-69245 · GHSA-f7vp-7xgx-4w4r · amended
PyPI aiohttp · Upgrade to 3.14.3 or later · <= 3.14.2 · CVE-2026-69244 · GHSA-cq5v-8q36-5273
PyPI aiohttp · Upgrade to 3.14.2 or later · <= 3.14.1 · CVE-2026-69243 · GHSA-mfx4-hv73-q22v
PyPI aiohttp · Upgrade to 3.14.2 or later · <= 3.14.1 · CVE-2026-59881 · GHSA-mq44-7p77-q5h7
npm sequelize · Upgrade to 6.37.4 or later · < 6.37.4 · CVE-2026-69240 · GHSA-v8fg-2rw7-q452 · amended
npm hono · Upgrade to 4.12.34 or later · < 4.12.34 · CVE-2026-69207 · GHSA-8j4g-w8fx-2239
PyPI gitpython · Upgrade to 3.1.56 or later · <= 3.1.55 · GHSA-p538-c434-8v24
PyPI gitpython · Upgrade to 3.1.57 or later · <= 3.1.56 · GHSA-539m-9xh6-q6rr
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.