Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
3976–4000 of 30,924 matching · newest first
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3, 8.4 or 7.6.7 by release line · <= 7.6.6; >= 8.0-rc1, <= 8.3; >= 9.0-rc1, <= 9.2; >= 10-rc1, <= 10-rc1 · CVE-2026-49831 · GHSA-v66x-68f2-pxf5
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3 or 8.4 by release line · >= 8.0-rc1, < 8.4; >= 9.0-rc1, < 9.3; >= 10.0-rc1, <= 10.0-rc1 · CVE-2026-49832 · GHSA-9x82-rm84-c6x7
PyPI trapster · Upgrade to 1.2.2 or later · < 1.2.2 · GHSA-mxwc-wh95-pw4g · amended
Packagist code16/sharp · Upgrade to 9.22.3 or later · >= 9.0.0, < 9.22.3 · CVE-2026-53634 · GHSA-vmwx-m75v-qvch
Go github.com/nuclio/nuclio · Upgrade to 0.0.0-20260601075854-3356b86a8bfa (pre-release) or later · < 0.0.0-20260601075854-3356b86a8bfa · CVE-2026-52831 · GHSA-v5px-423j-pf7p
crates.io async-tar · Upgrade to 0.6.1 or later · < 0.6.1 · CVE-2026-53600 · GHSA-35rm-7j9c-2f7m
Go github.com/zalando/skipper · Upgrade to 0.26.10 or later · < 0.26.10 · CVE-2026-50197 · GHSA-659f-rgp5-w4wf
lxml_html_clean.Cleaner does not strip javascript: URLs from namespaced URL attributesPyPI lxml-html-clean · Upgrade to 0.4.5 or later · < 0.4.5 · CVE-2026-49825 · GHSA-4jhm-jv67-739f · amended
PyPI bbot · Upgrade to 3.0.0 or later · >= 1.1.7, < 3.0.0 · CVE-2026-14967
Bitnami php +2 · Upgrade all 3 to 8.5.8, 8.4.23, 8.3.32 or 8.2.32 by release line · >= 8.2.0, < 8.2.32; >= 8.3.0, < 8.3.32; >= 8.4.0, < 8.4.23; >= 8.5.0, < 8.5.8 · CVE-2026-14355 · GHSA-7jrw-539f-x6vr · amended
PyPI weblate · Upgrade to 2026.6 or later · >= 5.15, < 2026.6 · CVE-2026-50127 · GHSA-vmfc-9982-2m45 · amended
Go github.com/oasdiff/oasdiff · Upgrade to 1.18.1 or later · >= 1.13.2, <= 1.18.0 · CVE-2026-53508 · GHSA-2jcc-mxv7-p3f9
Go github.com/kedacore/keda/v2 · Upgrade to 2.20.0 or later · < 2.20.0 · CVE-2026-53572 · GHSA-6w3m-4hhp-775q
Go github.com/zhenorzz/goploy · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-53553 · GHSA-4g5x-hcwm-82jw · amended
Go github.com/zhenorzz/goploy · Upgrade to 1.18.0 or later · < 1.18.0 · CVE-2026-53552 · GHSA-26rh-24rg-j3vv · amended
PyPI ha-mcp · Upgrade to 7.10.0 or later · < 7.10.0 · GHSA-q855-8rh5-jfgq · amended
crates.io rama · Upgrade to 0.3.0-rc.1 (pre-release) or later · < 0.3.0-rc.1 · GHSA-cwv4-h3j5-w3cf
PyPI aiosmtplib · Upgrade to 5.1.1 or later · <= 5.1.0 · CVE-2026-53533 · GHSA-v3q9-hj7j-63hq · amended
Go github.com/zxh326/kite · Upgrade to 0.12.3 or later · <= 0.12.2 · CVE-2026-53487 · GHSA-gvhc-wv3v-7pf8
Packagist web-auth/webauthn-lib · Upgrade to 5.3.5 or later · >= 4.9.0, < 5.3.5 · GHSA-gq4g-fpc9-vjfq
crates.io ratex-parser · Upgrade to 0.1.11 or later · < 0.1.11 · CVE-2026-53531 · GHSA-4w5h-hx6r-28q7
\verb with a multibyte delimiter (UTF-8 byte-boundary slice)crates.io ratex-parser · Upgrade to 0.1.11 or later · < 0.1.11 · CVE-2026-53530 · GHSA-4hgp-59h5-gvrj
PyPI cognee · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-58473 · GHSA-49f7-whx5-4256 · amended
npm @better-auth/scim · Upgrade to 1.7.0-beta.4 (pre-release) or later · >= 1.5.0, < 1.7.0-beta.4 · CVE-2026-67331 · GHSA-j8v8-g9cx-5qf4 · amended
npm @better-auth/scim +1 · Upgrade all 2 to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-67334 · GHSA-2vg6-77g8-24mp · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.