XDocReport affected by an XML External Entity (XXE) vulnerability
Maven fr.opensagres.xdocreport:fr.opensagres.xdocreport.document · Upgrade to 2.0.4 or later · >= 0.9.2, < 2.0.4 · CVE-2025-65482 · GHSA-7jc7-g598-2p64
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Maven fr.opensagres.xdocreport:fr.opensagres.xdocreport.document · Upgrade to 2.0.4 or later · >= 0.9.2, < 2.0.4 · CVE-2025-65482 · GHSA-7jc7-g598-2p64
Go github.com/external-secrets/external-secrets · Upgrade to 1.2.0 or later · >= 0.20.2, < 1.2.0 · CVE-2026-22822 · GHSA-77v3-r3jw-j2v2
npm @fastify/express · Upgrade to 4.0.3 or later · <= 4.0.2 · CVE-2026-22037 · GHSA-g6q3-96cp-5r5m · amended
npm @fastify/middie · Upgrade to 9.1.0 or later · <= 9.0.3 · CVE-2026-22031 · GHSA-cxrg-g7r8-w69p · amended
Go github.com/pterodactyl/wings · Upgrade to 1.12.0 or later · >= 1.7.0, < 1.12.0 · CVE-2026-21696 · GHSA-2497-gp99-2m74
Go github.com/pterodactyl/wings · Upgrade to 1.12.0 or later · < 1.12.0 · CVE-2025-69199 · GHSA-8w7m-w749-rx98
PyPI weasyprint · Upgrade to 68.0 or later · < 68.0 · CVE-2025-68616 · GHSA-983w-rhvv-gwmv · amended
PyPI chainlit · Upgrade to 2.9.4 or later · < 2.9.4 · CVE-2026-22219 · GHSA-2g59-m95p-pgfq · amended
Maven org.apache.linkis:linkis · Upgrade to 1.8.0 or later · >= 1.3.0, < 1.8.0 · CVE-2025-29847 · GHSA-c399-q49h-qwc8
npm tar · Upgrade to 7.5.3 or later · <= 7.5.2 · CVE-2026-23745 · GHSA-8qq5-rm4j-mr97 · amended
npm @mcpjam/inspector · Upgrade to 1.4.3 or later · <= 1.4.2 · CVE-2026-23744 · GHSA-232v-j27c-5pp6 · amended
npm graphql-modules · Upgrade to 3.1.1 or 2.4.1 by release line · >= 2.2.1, < 2.4.1; >= 3.0.0, < 3.1.1 · CVE-2026-23735 · GHSA-53wg-r69p-v3r7 · amended
Go github.com/zalando/skipper · Upgrade to 0.23.0 or later · < 0.23.0 · CVE-2026-23742 · GHSA-cc8m-98fm-rc9g
npm svelte · Upgrade to 3.59.2 or later · >= 3.0.0, < 3.59.2 · GHSA-gw32-9rmw-qwww · amended
PyPI crawl4ai · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-26216 · GHSA-5882-5rx9-xgxp · amended
PyPI crawl4ai · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-26217 · GHSA-vx9w-5cx4-9796 · amended
RubyGems activerecord-jdbc-adapter · Upgrade to 1.2.8 or later · < 1.2.8 · GHSA-5qw5-wf2q-f538
PyPI pyasn1 · Upgrade to 0.6.2 or later · >= 0.6.1, <= 0.6.1 · CVE-2026-23490 · GHSA-63vm-454h-vhhq · amended
PyPI wlc · Upgrade to 1.17.2 or later · < 1.17.2 · CVE-2026-23535 · GHSA-mmwx-79f6-67jg · amended
crates.io deno · Upgrade to 2.5.6 or later · < 2.5.6 · CVE-2026-22864 · GHSA-m3c4-prhw-mrx6
crates.io deno · Upgrade to 2.6.0 or later · <= 2.5.6 · CVE-2026-22863 · GHSA-5379-f5hf-w38v
PyPI apache-airflow · Upgrade to 3.1.6 or later · >= 3.1.0, < 3.1.6 · CVE-2025-68438 · GHSA-3qmm-r55x-hpxx · amended
PyPI apache-airflow · Upgrade to 3.1.6 or 2.11.1 by release line · >= 3.0.0b1, < 3.1.6; < 2.11.1 · CVE-2025-68675 · GHSA-7c2f-r6gc-h92h · amended
npm devalue · Upgrade to 5.6.2 or later · >= 5.1.0, < 5.6.2 · CVE-2026-22775 · GHSA-g2pg-6438-jwpf · amended
npm h3 · Upgrade to 1.15.5 or later · <= 1.15.4 · CVE-2026-23527 · GHSA-mp2g-9vg9-f4cg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.