Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Packagist symfony/symfony +1 · Upgrade all 2 to 7.3.7, 6.4.29 or 5.4.50 by release line · >= 2.0.0, < 5.4.50; >= 6.0.0, < 6.4.29; >= 7.0.0, < 7.3.7 · CVE-2025-64500 · GHSA-3rg7-wf37-54rm
Go github.com/evervault/evervault-go · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2025-64186 · GHSA-88h9-77c7-p6w4
Go github.com/oauth2-proxy/oauth2-proxy/v7 · Upgrade to 7.13.0 or later · < 7.13.0 · CVE-2025-64484 · GHSA-vjrc-mh2v-45x6
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.0.3 or later · < 16.0.3 · CVE-2025-64099 · GHSA-39hr-239p-fhqc
Go github.com/dvsekhvalnov/jose2go · Upgrade to 1.7.0 or later · < 1.7.0 · CVE-2025-63811 · GHSA-9mj6-hxhv-w67j
Go github.com/rhobs/observability-operator · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2025-2843 · GHSA-mj6p-p843-x5wc
Packagist codingms/modules · Upgrade to 7.5.5, 6.4.2, 5.7.4 or 4.3.11 by release line · < 4.3.11; >= 5.0.0, < 5.7.4; >= 7.0.0, < 7.5.5; >= 6.0.0, < 6.4.2 · CVE-2025-12998 · GHSA-49qv-h8pm-73pf
Go github.com/charmbracelet/soft-serve · Upgrade to 0.11.1 or later · < 0.11.1 · CVE-2025-64522 · GHSA-vwq2-jx9q-9h9f
Packagist torrentpier/torrentpier · Upgrade to 2.8.9 or later · <= 2.8.8 · CVE-2025-64519 · GHSA-4rwr-8c3m-55f6
Maven org.cyclonedx:cyclonedx-core-java · Upgrade to 11.0.1 or later · >= 2.1.0, < 11.0.1 · CVE-2025-64518 · GHSA-6fhj-vr9j-g45r
npm cloudinary · Upgrade to 2.7.0 or later · < 2.7.0 · CVE-2025-12613 · GHSA-g4mf-96x5-5m2c · amended
PyPI pdfminer-six · Upgrade to 20251230 or later · < 20251230 · CVE-2025-70559 · GHSA-f83h-ghpp-7wcc · amended
PyPI pdfminer-six · Upgrade to 20251107 or later · < 20251107 · CVE-2025-64512 · GHSA-wf5f-4jwr-ppcp · amended
Go kubevirt.io/kubevirt · Upgrade to 1.7.0-rc.0 (pre-release) or 1.6.1 by release line · < 1.6.1; >= 1.7.0-alpha.0, < 1.7.0-rc.0 · CVE-2025-64324 · GHSA-46xp-26xh-hpqh
npm open-webui +1 · Upgrade all 2 to 0.6.35 or later · <= 0.6.34 · CVE-2025-64496 · GHSA-cm35-v4vp-5xvx · amended
npm open-webui +1 · Upgrade all 2 to 0.6.35 or later · <= 0.6.34 · CVE-2025-64495 · GHSA-w7xj-8fx7-wfch · amended
RubyGems mqtt · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2025-12790 · GHSA-9c5q-w6gr-fxcq
crates.io apollo-router · Upgrade to 2.8.1 or 1.61.12 by release line · < 1.61.12; >= 2.0.0-alpha.0, < 2.8.1 · CVE-2025-64173 · GHSA-x33c-7c2v-mrj9
crates.io apollo-router · Upgrade to 2.8.1 or 1.61.12 by release line · < 1.61.12; >= 2.0.0-alpha.0, < 2.8.1 · CVE-2025-64347 · GHSA-g8jh-vg5j-4h3f
RubyGems prosemirror_to_html · Upgrade to 0.2.1 or later · < 0.2.1 · CVE-2025-64501 · GHSA-52c5-vh7f-26fx
Go github.com/containerd/containerd · Upgrade to 1.7.29 or later · < 1.7.29 · +1 more package · CVE-2024-25621 · GHSA-pwhc-rpq9-4c8w
PyPI langgraph-checkpoint · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2025-64439 · GHSA-wwqv-p2pp-99h5 · amended
npm parse-server · Upgrade to 8.4.0-alpha.2 (pre-release) or 7.5.4 by release line · >= 4.2.0, < 7.5.4; >= 8.0.0, <= 8.4.0-alpha.1 · CVE-2025-64430 · GHSA-x4qj-2f4q-r4rx · amended
crates.io youki · Upgrade to 0.5.7 or later · < 0.5.7 · CVE-2025-62596 · GHSA-vf95-55w6-qmrf
crates.io youki · Upgrade to 0.5.7 or later · < 0.5.7 · CVE-2025-62161 · GHSA-4g74-7cff-xcv8
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.