Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
RubyGems activestorage · Upgrade to 8.1.2.1, 8.0.4.1 or 7.2.3.1 by release line · >= 8.1.0.beta1, < 8.1.2.1; >= 8.0.0.beta1, < 8.0.4.1; < 7.2.3.1 · CVE-2026-33195 · GHSA-9xrj-h377-fr87
PyPI indico · Upgrade to 3.3.12 or later · < 3.3.12 · CVE-2026-33046 · GHSA-rm2q-f7jv-3cfp · amended
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · <= 1.41.0; >= 2.0.0, <= 2.41.0 · CVE-2026-32300 · GHSA-qr6x-wvxr-8hm9
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · <= 1.40.0; >= 2.0.0, <= 2.40.0 · CVE-2026-32299 · GHSA-62ch-j6x7-722j
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · <= 1.41.0; >= 2.0.0, <= 2.41.0 · CVE-2026-32278 · GHSA-mv3p-7p89-wq9p
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · >= 1.35.0, < 1.41.1; >= 2.35.0, < 2.41.1 · CVE-2026-32277 · GHSA-cmfh-mpmf-fmq4
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · < 1.41.1; >= 2.0.0, < 2.41.1 · CVE-2026-32276 · GHSA-hxqw-6qv7-cqfv
Packagist mantisbt/mantisbt · Upgrade to 2.28.1 or later · < 2.28.1 · CVE-2026-30849 · GHSA-phrq-pc6r-f6gh
PyPI cbor2 · Upgrade to 5.9.0 or later · <= 5.8.0 · CVE-2026-26209 · GHSA-3c37-wwvx-h642 · amended
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4601 · GHSA-w8q8-93cx-6h7r · amended
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4600 · GHSA-wvqx-v3f6-w8rh · amended
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4598 · GHSA-8g7p-jf3g-gxcp · amended
npm jsrsasign · Upgrade to 11.1.1 or later · >= 7.0.0, < 11.1.1 · CVE-2026-4599 · GHSA-5jx8-q4cp-rhh6 · amended
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4602 · GHSA-8qwj-4jxw-m8jw · amended
npm parse-server · Upgrade to 9.6.0-alpha.45 (pre-release) or 8.6.56 by release line · >= 9.0.0, < 9.6.0-alpha.45; < 8.6.56 · CVE-2026-33508 · GHSA-6qh5-m6g3-xhq6 · amended
Packagist dreamfactory/df-core · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2025-55988 · GHSA-gv7f-w92j-383q
npm parse-server · Upgrade to 9.6.0-alpha.44 (pre-release) or 8.6.55 by release line · >= 9.0.0, < 9.6.0-alpha.44; < 8.6.55 · CVE-2026-33498 · GHSA-9fjp-q3c4-6w3j · amended
PyPI langflow · Upgrade to 1.7.1 or later · < 1.7.1 · CVE-2026-33497 · GHSA-ph9w-r52h-28p7 · amended
Go github.com/ory/keto · Upgrade to 0.14.1-0.20260320140104-e4393662cd2e (pre-release) or later · < 0.14.1-0.20260320140104-e4393662cd2e · CVE-2026-33505 · GHSA-c38g-mx2c-9wf2
Go github.com/ory/kratos · Upgrade to 1.3.1-0.20260320110106-9d7085948039 (pre-release) or later · < 1.3.1-0.20260320110106-9d7085948039 · CVE-2026-33503 · GHSA-hgx2-28f8-6g2r
Go github.com/ory/oathkeeper · Upgrade to 0.40.10-0.20260320084758-8e0002140491 (pre-release) or later · < 0.40.10-0.20260320084758-8e0002140491 · CVE-2026-33494 · GHSA-p224-6x5r-fjpm
Go github.com/ory/oathkeeper · Upgrade to 0.40.10-0.20260320084801-198a2bc82a99 (pre-release) or later · < 0.40.10-0.20260320084801-198a2bc82a99 · CVE-2026-33496 · GHSA-4mq7-pvjg-xp2r
sql.lit(string) usage or similar methods that append string literal values into the compiled SQL stringsnpm kysely · Upgrade to 0.28.14 or later · <= 0.28.13 · CVE-2026-33468 · GHSA-8cpq-38p9-67gx · amended
npm kysely · Upgrade to 0.28.14 or later · >= 0.28.12, <= 0.28.13 · CVE-2026-33442 · GHSA-fr9j-6mvq-frcv · amended
PyPI langflow · Upgrade to 1.9.0 or later · >= 1.0.0, < 1.9.0 · CVE-2026-33484 · GHSA-7grx-3xcx-2xv5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.