Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Packagist phpoffice/phpspreadsheet · Upgrade to 5.6.0, 3.10.4, 2.4.4 or 2 more by release line · >= 4.0.0, <= 5.5.0; >= 3.3.0, <= 3.10.3; >= 2.2.0, <= 2.4.3; >= 2.0.0, <= 2.1.14; <= 1.30.2 · CVE-2026-34084 · GHSA-q4q6-r8wh-5cgh
Packagist cockpit-hq/cockpit · Upgrade to 2.14.0 or later · < 2.14.0 · CVE-2026-38991 · GHSA-j2rx-4jg9-79mw
Maven org.jenkins-ci.plugins:htmlpublisher · Upgrade to 427.1 or later · < 427.1 · CVE-2026-42524 · GHSA-f8h4-46xv-h7jj
Packagist cockpit-hq/cockpit · Upgrade to 2.14.0 or later · < 2.14.0 · CVE-2026-38992 · GHSA-fm6c-rhcf-7439
Maven org.jenkins-ci.plugins:credentials-binding · Upgrade to 720.v3f6decef43ea or later · < 720.v3f6decef43ea · CVE-2026-42520 · GHSA-p2rf-wpxj-mx2g
Maven com.coravy.hudson.plugins.github:github · Upgrade to 1.46.0.1 or later · < 1.46.0.1 · CVE-2026-42523 · GHSA-w22p-4x9f-486v
npm cyberchef · Upgrade to 11.0.0 or later · < 11.0.0 · CVE-2026-42615 · GHSA-h4hv-92pp-pcjg · amended
Go github.com/coredns/coredns · Upgrade to 1.14.3 or later · < 1.14.3 · CVE-2026-35579 · GHSA-vp29-5652-4fw9
Go github.com/coredns/coredns · Upgrade to 1.14.3 or later · < 1.14.3 · CVE-2026-33190 · GHSA-qhmp-q7xh-99rh
Go github.com/coredns/coredns · Upgrade to 1.14.3 or later · < 1.14.3 · CVE-2026-33489 · GHSA-h8mm-c463-wjq3
Go github.com/coredns/coredns · Upgrade to 1.14.3 or later · < 1.14.3 · CVE-2026-32936 · GHSA-63cw-r7xf-jmwr
Go github.com/coredns/coredns · Upgrade to 1.14.3 or later · < 1.14.3 · CVE-2026-32934 · GHSA-2wpx-qpw2-g5h5
PyPI nvflare · Upgrade to 2.7.2 or later · < 2.7.2 · CVE-2026-24178 · GHSA-jqp3-qrgh-4846 · amended
Go github.com/gravitl/netmaker · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-38651 · GHSA-qpv2-rwc8-c993
Bitnami thrift +1 · Upgrade all 2 to 0.23.0 or later · < 0.23.0 · CVE-2026-41603 · GHSA-gf47-qgg5-9g9q · amended
Go github.com/apache/thrift · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-41602 · GHSA-wf45-q9ch-q8gh
npm thrift · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-41636 · GHSA-r67j-r569-jrwp · amended
Maven org.springframework.ai:spring-ai-azure-cosmos-db-store · Upgrade to 1.1.5 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5 · CVE-2026-40978 · GHSA-63c8-m9m2-cvr3
Maven org.springframework.ai:spring-ai-vector-store · Upgrade to 1.1.5 or 1.0.6 by release line · >= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5 · CVE-2026-40967 · GHSA-qc4j-qjqx-vr58
Maven org.springframework.boot:spring-boot · Upgrade to 4.0.6 or 3.5.14 by release line; some affected versions have no fix yet · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32 · CVE-2026-40973 · GHSA-wwpq-f5c3-7hvx
Maven org.springframework.boot:spring-boot · Upgrade to 4.0.6 or later · >= 4.0.0, < 4.0.6 · CVE-2026-40976 · GHSA-8v8j-3hxp-93wr
Maven org.springframework.boot:spring-boot-devtools · Upgrade to 4.0.6 or 3.5.14 by release line; some affected versions have no fix yet · >= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32 · CVE-2026-40972 · GHSA-56v8-86gj-66jp
Maven org.apache.camel:camel-mail · Upgrade to 4.18.1 or 4.14.6 by release line · >= 3.0.0, < 4.14.6; >= 4.15.0, < 4.18.1 · CVE-2026-33454 · GHSA-2vqf-x7g4-7c2g
Maven org.apache.camel:camel-coap · Upgrade to 4.18.1 or 4.14.6 by release line · >= 4.14.0, <= 4.14.5; >= 4.18.0, < 4.18.1 · CVE-2026-33453 · GHSA-695c-x5gc-94gj
Maven org.apache.camel:camel-platform-http-main · Upgrade to 4.20.0, 4.18.2 or 4.14.6 by release line · >= 4.14.1, < 4.14.6; >= 4.18.0, < 4.18.2; >= 4.19.0, < 4.20.0 · CVE-2026-40022 · GHSA-27vm-5vpj-rp5g
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.