Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
4876–4900 of 30,970 matching · newest first
LABEL flows to restart-monitor binary:// logger: host-root command execution from an image pullGo github.com/containerd/containerd · Upgrade to 1.7.33 or later · >= 1.7.0, < 1.7.33 · +1 more package · CVE-2026-53488 · GHSA-xhf5-7wjv-pqxp
Go github.com/containerd/containerd/v2 · Upgrade to 2.3.2, 2.2.5 or 2.1.9 by release line · >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 · CVE-2026-50195 · GHSA-cvxm-645q-p574
$relatedTo query bypasses protectedFields and owning-object ACLnpm parse-server · Upgrade to 9.9.1-alpha.6 (pre-release) or 8.6.80 by release line · >= 9.0.0, < 9.9.1-alpha.6; < 8.6.80 · CVE-2026-53726 · GHSA-wmwx-jr2p-4j4r · amended
/login and /verifyPassword disclose MFA secrets and protected fields when _User get is deniednpm parse-server · Upgrade to 9.9.1-alpha.5 (pre-release) or later · >= 9.8.0, < 9.9.1-alpha.5 · CVE-2026-53725 · GHSA-75v4-m273-5j49 · amended
npm parse-server · Upgrade to 9.9.1-alpha.4 (pre-release) or 8.6.79 by release line · >= 9.0.0, < 9.9.1-alpha.4; <= 8.6.78 · CVE-2026-53724 · GHSA-7wqv-xjf3-x35v · amended
Packagist symfony/ux-autocomplete · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.2.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49216 · GHSA-mwqm-4fw3-cjvr
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.22.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49215 · GHSA-4m4j-hmqq-3gxm
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49212 · GHSA-34w5-c283-j9fg
Packagist symfony/ux-autocomplete · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.2.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49211 · GHSA-946h-jp5c-8fvh
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49210 · GHSA-38x5-rcv4-xf7x
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.5.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49209 · GHSA-mm82-c99c-h2cf
npm parse-server · Upgrade to 9.9.1-alpha.3 (pre-release) or later · >= 9.8.0, < 9.9.1-alpha.3 · CVE-2026-50008 · GHSA-p84r-h6rx-f2xr · amended
Go github.com/containerd/containerd · Upgrade to 1.7.33 or later · >= 1.7.0, < 1.7.33 · +1 more package · CVE-2026-47262 · GHSA-jpcc-p29g-p8mq
RubyGems oj · Upgrade to 3.17.2 or later · < 3.17.2 · CVE-2026-54899 · GHSA-2cw7-v8ff-p88r
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49208 · GHSA-89g7-22c8-3j23
PyPI py7zr · Upgrade to 1.1.3 or later · <= 1.1.2 · CVE-2026-23879 · GHSA-q6rc-2cgv-63h7 · amended
npm typeorm · Upgrade to 0.3.29 or later · >= 0.1.12, <= 0.3.28 · GHSA-9ggv-8w38-r7pm · amended
Go github.com/gohugoio/hugo · Upgrade to 0.163.1 or later · >= 0.162.0, < 0.163.1 · GHSA-r46f-3rpw-hxrv
RubyGems alchemy_cms · Upgrade to 8.2.6, 8.1.14, 8.0.15 or 7.4.15 by release line · >= 8.2.0, <= 8.2.5; >= 8.1.0, <= 8.1.13; >= 8.0.0.a, <= 8.0.14; <= 7.4.14 · GHSA-mqq5-j7w8-2hgh
Go github.com/gohugoio/hugo · Upgrade to 0.163.1 or later · >= 0.123.0, < 0.163.1 · GHSA-c3wq-j5vh-68rc
Go github.com/gohugoio/hugo · Upgrade to 0.163.3 or later · >= 0.60.0, < 0.163.3 · GHSA-q76j-gcg9-vxc6
npm @openzeppelin/wizard · Upgrade to 0.10.11 or later · <= 0.10.10 · +3 more packages · CVE-2026-57583 · GHSA-9wxg-vf3r-56hc · amended
Nokogiri::XML::Attr#value= or #content=RubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-phwj-rprq-35pp
RubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-wfpw-mmfh-qq69
NokogirI::XML::XPathContext beyond document lifetimeRubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-p67v-3w7g-wjg7
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.