Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Agent.to_web(), clai web): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointPyPI pydantic-ai +1 · Upgrade all 2 to 2.28.0 or 1.107.4 by release line · >= 1.34.0, < 1.107.4; >= 2.0.0b1, < 2.28.0 · CVE-2026-107295 · GHSA-h4xc-3qfq-jf93 · amended
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20260929015830-8ffeb07ec9a3 (pre-release) or later · >= 2.9.0, < 2.11.1-0.20260929015830-8ffeb07ec9a3 · CVE-2026-107213 · GHSA-r7x5-4969-99p7 · amended
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.14; some affected versions have no fix yet · >= 3.0.0, <= 3.0.13; >= 2.2.0, <= 2.16.1 · CVE-2026-107227 · GHSA-x8v2-478q-2hvg · amended
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.14; some affected versions have no fix yet · >= 3.0.0, < 3.0.14; >= 2.0.0, <= 2.16.1 · CVE-2026-107230 · GHSA-v2j5-22fr-j62r · amended
PyPI praisonaiagents · Upgrade to 1.6.78 or later · <= 1.6.77 · CVE-2026-61443 · GHSA-c44f-37qr-gw3f · amended
PyPI praisonaiagents · Upgrade to 1.6.78 or later · <= 1.6.77 · CVE-2026-61437 · GHSA-4gfv-wg42-7jw5 · amended
PyPI praisonaiagents · Upgrade to 1.6.78 or later · <= 1.6.77 · CVE-2026-61446 · GHSA-m6wp-h223-4c8g · amended
PyPI praisonaiagents · Upgrade to 1.6.78 or later · <= 1.6.77 · CVE-2026-61447 · GHSA-2xv2-w8cq-5gxw · amended
web_crawl SSRF protection allows internal response disclosurePyPI praisonaiagents · Upgrade to 1.6.78 or later · <= 1.6.77 · CVE-2026-61430 · GHSA-qg25-6gc4-48mg · amended
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20260911060113-ea12859e43c6 (pre-release) or later · >= 2.8.1, < 2.11.1-0.20260911060113-ea12859e43c6 · CVE-2026-107216 · GHSA-wp2g-vpjj-g53r · amended
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.13 or 2.16.1 by release line · >= 3.0.0, <= 3.0.12; >= 2.0.0, <= 2.16.0 · CVE-2026-107282 · GHSA-jmqq-x5g9-9p2w · amended
Maven org.asynchttpclient:async-http-client · Upgrade to 3.0.13 or 2.16.1 by release line · >= 3.0.0.Beta1, <= 3.0.12; >= 2.0.0, <= 2.16.0 · CVE-2026-107231 · GHSA-rqf5-2wxv-rjf4 · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61439 · GHSA-fj8f-m44g-c479 · amended
npm ghost · Upgrade to 6.67.0 or later · >= 6.56.0, < 6.67.0 · CVE-2026-105642 · GHSA-788w-68h3-cvxp · amended
npm ghost · Upgrade to 6.67.0 or later · >= 6.34.0, < 6.67.0 · CVE-2026-105643 · GHSA-69qc-f5m6-889c · amended
PyPI docling +1 · Upgrade all 2 to 2.132.0 or later · >= 2.94.0, < 2.132.0 · CVE-2026-105744 · GHSA-x3q2-h9hx-4r4j · amended
PyPI langflow · Upgrade to 1.10.3 or later · >= 1.1.2, < 1.10.3 · +2 more packages · CVE-2026-105697 · GHSA-w794-rj3p-xv45 · amended
npm ghost · Upgrade to 6.65.0 or later · >= 4.22.0, < 6.65.0 · CVE-2026-105649 · GHSA-8575-cr6v-7jh4 · amended
PyPI langflow · Upgrade to 1.9.1 or later · >= 1.6.8, <= 1.9.0 · CVE-2026-105699 · GHSA-4hmc-cfm3-w43c · amended
npm next · Upgrade to 16.3.8 or later · >= 16.0.0, < 16.3.8 · CVE-2026-94483 · GHSA-cjq9-62q9-8jv4 · amended
npm @payloadcms/db-postgres · Upgrade to 3.73.0 or later · >= 3.0.0, < 3.73.0 · +3 more packages · CVE-2026-105856 · GHSA-pj7x-6wpf-pgvp · amended
npm payload · Upgrade to 4.0.0-canary.34 (pre-release) or 3.90.0 by release line · < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · CVE-2026-105858 · GHSA-97rh-rhh2-7vjv · amended
npm @payloadcms/plugin-multi-tenant · Upgrade to 4.0.0-canary.34 (pre-release) or 3.90.0 by release line · < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · CVE-2026-105860 · GHSA-p96c-xwx8-3cqj · amended
npm payload · Upgrade to 4.0.0-canary.34 (pre-release) or 3.90.0 by release line · >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · CVE-2026-105861 · GHSA-pj5h-5q6c-3pfx · amended
npm payload · Upgrade to 4.0.0-canary.34 (pre-release) or 3.90.0 by release line · < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · CVE-2026-105862 · GHSA-2pwp-2369-8fg3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.