SP1 V6 Recursion Circuit Row-Count Binding Gap
crates.io sp1_prover +2 · Upgrade all 3 to 6.1.0 or later · >= 6.0.0, <= 6.0.2 · CVE-2026-40323 · GHSA-63x8-x938-vx33
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
crates.io sp1_prover +2 · Upgrade all 3 to 6.1.0 or later · >= 6.0.0, <= 6.0.2 · CVE-2026-40323 · GHSA-63x8-x938-vx33
npm @aiondadotcom/mcp-ssh · Upgrade to 1.3.5 or later · < 1.3.5 · GHSA-p4h8-56qp-hpgv · amended
Go github.com/monetr/monetr · Upgrade to 1.12.4 or later · <= 1.12.3 · CVE-2026-40481 · GHSA-v7xq-3wx6-fqc2
PyPI excel-mcp-server · Upgrade to 0.1.8 or later · < 0.1.8 · CVE-2026-40576 · GHSA-j98m-w3xp-9f56 · amended
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260411145018-6bb62842ccb9 (pre-release) or later · < 0.0.0-20260411145018-6bb62842ccb9 · CVE-2026-40262 · GHSA-9pr4-rf97-79qh
Go github.com/foxcpp/maddy · Upgrade to 0.9.3 or later · < 0.9.3 · CVE-2026-40193 · GHSA-5835-4gvc-32pc
PyPI pillow · Upgrade to 12.2.0 or later · >= 10.3.0, < 12.2.0 · CVE-2026-40192 · GHSA-whj4-6x5x-4v2j · amended
Maven gov.nsa.emissary:emissary · Upgrade to 8.43.0 or later · < 8.43.0 · CVE-2026-35582 · GHSA-3p24-9x7v-7789 · amended
Go github.com/external-secrets/external-secrets · Upgrade to 1.3.3-0.20260331202714-6800989bdc12 (pre-release); some affected versions have no fix yet · < 1.3.3-0.20260331202714-6800989bdc12; >= 2.0.0, <= 2.2.0 · CVE-2026-34984 · GHSA-r2pg-r6h7-crf3
npm simple-git · Upgrade to 3.32.0 or later · < 3.32.0 · CVE-2026-28291 · GHSA-jcxm-m3jx-f287 · amended
PyPI apache-airflow · Upgrade to 3.2.0 or later · >= 3.1.8, < 3.2.0 · CVE-2026-33858 · GHSA-mc4f-r875-v87w · amended
PyPI keras · Upgrade to 3.13.2 or later · < 3.13.2 · CVE-2026-1462 · GHSA-4f3f-g24h-fr8m · amended
Go github.com/apache/skywalking-mcp · Upgrade to 0.2.0 or later · < 0.2.0 · CVE-2026-34476 · GHSA-c4hg-6933-x62x
Maven org.apache.storm:storm-client · Upgrade to 2.8.6 or later · < 2.8.6 · CVE-2026-35337 · GHSA-jf89-3q6q-vcgr
PyPI google-adk · Upgrade to 2.0.0a2 (pre-release) or 1.28.1 by release line · >= 2.0.0a1, < 2.0.0a2; >= 1.7.0, < 1.28.1 · CVE-2026-4810 · GHSA-rg7c-g689-fr3x · amended
Go github.com/daptin/daptin · Upgrade to 0.12.0 or later · <= 0.11.3 · GHSA-9cp7-j3f8-p5jx
npm mathjs · Upgrade to 15.2.0 or later · >= 13.1.0, < 15.2.0 · CVE-2026-41139 · GHSA-jvff-x2qm-6286
npm paperclipai +1 · Upgrade all 2 to 2026.410.0 or later · < 2026.410.0 · CVE-2026-41679 · GHSA-68qg-g8mg-6pr7 · amended
Go github.com/juju/juju · Upgrade to 0.0.0-20260408003526-d395054dc2c3 (pre-release) or later · < 0.0.0-20260408003526-d395054dc2c3 · CVE-2026-5412 · GHSA-w5fq-8965-c969
PyPI gramps-webapi · Upgrade to 3.11.1 or later · >= 1.6.0, < 3.11.1 · CVE-2026-40258 · GHSA-m5gr-86j6-99jp · amended
npm n8n-mcp · Upgrade to 2.47.6 or later · <= 2.47.5 · GHSA-75hx-xj24-mqrw · amended
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.17.3 or later · <= 1.17.2 · CVE-2026-40242 · GHSA-ff24-4prj-gpmj
NuGet dotnetnuke.core · Upgrade to 10.2.2 or later · < 10.2.2 · CVE-2026-40321 · GHSA-ffq7-898w-9jc4
npm basic-ftp · Upgrade to 5.2.2 or later · <= 5.2.1 · GHSA-6v7q-wjvx-w8wg · amended
PyPI ajenti-plugin-core · Upgrade to 0.112 or later · < 0.112 · CVE-2026-40177 · GHSA-3mcx-6wxm-qr8v · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.