Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Go github.com/authorizerdev/authorizer · Upgrade to 0.0.0-20260329085140-6d9bef1aaba3 (pre-release) or later · < 0.0.0-20260329085140-6d9bef1aaba3 · GHSA-x3f4-v83f-7wp2
Go github.com/authorizerdev/authorizer · Upgrade to 0.0.0-20260327055742-73679faa53cd (pre-release) or later · < 0.0.0-20260327055742-73679faa53cd · GHSA-jfwg-rxf3-p7r9
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.2.0 or later · <= 0.31.1.0 · CVE-2026-35035 · GHSA-5ghq-42rg-769x
crates.io libp2p-rendezvous · Upgrade to 0.17.1 or later · < 0.17.1 · CVE-2026-35457 · GHSA-v5hw-cv9c-rpg7
crates.io libp2p-rendezvous · Upgrade to 0.17.1 or later · < 0.17.1 · CVE-2026-35405 · GHSA-cqfx-gf56-8x59
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-34511 · GHSA-9jpj-g8vv-j5mf · amended
Go github.com/coder/code-marketplace · Upgrade to 1.2.3-0.20260402184705-988440dee05f (pre-release) or later · < 1.2.3-0.20260402184705-988440dee05f · CVE-2026-35454 · GHSA-8x9r-hvwg-c55h
__proto__ key in defaults argumentnpm defu · Upgrade to 6.1.5 or later · <= 6.1.4 · CVE-2026-35209 · GHSA-737v-mqg7-c878 · amended
PyPI lightrag-hku · Upgrade to 1.4.13 or later · <= 1.4.12 · CVE-2026-30762 · GHSA-mcww-4hxq-hfr3 · amended
npm directus · Upgrade to 11.17.0 or later · < 11.17.0 · CVE-2026-35442 · GHSA-38hg-ww64-rrwc · amended
npm directus · Upgrade to 11.17.0 or later · < 11.17.0 · GHSA-6q22-g298-grjh · amended
npm directus · Upgrade to 11.16.1 or later · < 11.16.1 · CVE-2026-35412 · GHSA-qqmv-5p3g-px89 · amended
npm directus · Upgrade to 11.16.0 or later · < 11.16.0 · CVE-2026-35409 · GHSA-wv3h-5fx7-966h · amended
npm directus · Upgrade to 11.17.0 or later · < 11.17.0 · CVE-2026-39942 · GHSA-393c-p46r-7c95 · amended
npm directus · Upgrade to 11.17.0 or later · < 11.17.0 · CVE-2026-35408 · GHSA-8m32-p958-jg99 · amended
npm @budibase/server · Upgrade to 3.33.4 or later · < 3.33.4 · CVE-2026-35216 · GHSA-fcm4-4pj2-m5hf · amended
npm @budibase/server · Upgrade to 3.33.4 or later · < 3.33.4 · CVE-2026-35214 · GHSA-2wfh-rcwf-wh23 · amended
npm @mobilenext/mobile-mcp · Upgrade to 0.0.50 or later · < 0.0.50 · CVE-2026-35394 · GHSA-5qhv-x9j4-c3vm · amended
npm @stablelib/cbor · Upgrade to 2.0.3 or later · < 2.0.3 · CVE-2026-106447 · GHSA-5jg4-p4qw-cgfr · amended
__proto__ map keys in CBOR decodingnpm @stablelib/cbor · Upgrade to 2.0.3 or later · < 2.0.3 · CVE-2026-106448 · GHSA-w48f-fwg7-ww6p · amended
npm @hapi/content · Upgrade to 6.0.1 or later · <= 6.0.0 · CVE-2026-115728 · GHSA-jg4p-7fhp-p32p · amended
Maven tools.jackson.core:jackson-core · Upgrade to 3.1.1 or later · >= 3.0.0, <= 3.1.0 · GHSA-2m67-wjpj-xhg9
PyPI bentoml · Upgrade to 1.4.38 or later · <= 1.4.37 · CVE-2026-35044 · GHSA-v959-cwq9-7hr6 · amended
PyPI bentoml · Upgrade to 1.4.38 or later · <= 1.4.37 · CVE-2026-35043 · GHSA-fgv4-6jr3-jgfw · amended
PyPI litellm · Upgrade to 1.83.0 or later · < 1.83.0 · CVE-2026-35030 · GHSA-jjhc-v7c2-5hh6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.