Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Go github.com/neuvector/neuvector · Upgrade to 0.0.0-20251020133207-084a437033b4 (pre-release) or later · >= 0.0.0-20230727023453-1c4957d53911, < 0.0.0-20251020133207-084a437033b4 · CVE-2025-54470 · GHSA-qqj3-g7mx-5p4w
Go github.com/neuvector/neuvector · Upgrade to 5.4.7, 5.3.5 or 0.0.0-20251020133207-084a437033b4 (pre-release) by release line · >= 5.3.0, < 5.3.5; >= 5.4.0, <= 5.4.6; >= 0.0.0-20230727023453-1c4957d53911, < 0.0.0-20251020133207-084a437033b4 · CVE-2025-54469 · GHSA-c8g6-qrwh-m3vp
PyPI taguette · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2025-62527 · GHSA-7rc8-5c8q-jr6j · amended
Go github.com/netbirdio/netbird · Upgrade to 0.57.0 or later · < 0.57.0 · CVE-2025-10678 · GHSA-g3j4-58mp-3x25
Maven org.apache.syncope.core:syncope-core-spring · Upgrade to 4.0.2 or 3.0.14 by release line · < 3.0.14; >= 4.0.0-M0, < 4.0.2 · CVE-2025-57738 · GHSA-825g-mm5v-ggq4
Maven org.apache.geode:geode-web · Upgrade to 1.15.2 or later · >= 1.10.0, < 1.15.2 · CVE-2025-47410 · GHSA-gjp8-99fv-cgcw
Maven net.mingsoft:ms-mcms · Upgrade to 6.0.2 or later · >= 5.5.0, < 6.0.2 · CVE-2025-56316 · GHSA-54wc-49qj-5ghj
PyPI keras · Upgrade to 3.11.3 or later · >= 3.11.0, < 3.11.3 · CVE-2025-49655 · GHSA-cvhh-q5g5-qprp · amended
Go github.com/openbao/openbao · Upgrade to 2.4.1 or later · <= 2.4.0 · CVE-2025-59043 · GHSA-g46h-2rq9-gw5m
Go github.com/git-lfs/git-lfs · Upgrade to 3.7.1 or later · >= 0.5.2, <= 3.7.0 · CVE-2025-26625 · GHSA-6pvw-g552-53c5
Go github.com/minio/minio · Upgrade to 0.0.0-20251015170045-c1a49490c78e (pre-release) or later · < 0.0.0-20251015170045-c1a49490c78e · CVE-2025-62506 · GHSA-jjjj-jwhf-8rgr
npm @angular/ssr · Upgrade to 21.0.0-next.8 (pre-release), 20.3.6 or 19.2.18 by release line · >= 19.0.0-next.0, < 19.2.18; >= 20.0.0-next.0, < 20.3.6; >= 21.0.0-next.0, < 21.0.0-next.8 · CVE-2025-62427 · GHSA-q63q-pgmf-mxhr · amended
Packagist bagisto/bagisto · Upgrade to 2.3.8 or later · <= 2.3.7 · CVE-2025-62417 · GHSA-jqrp-58fv-w8cq
Packagist prestashop/ps_checkout · Upgrade to 5.0.5 or 4.4.1 by release line · >= 5.0.0, < 5.0.5; >= 1.3.0, < 4.4.1 · CVE-2025-61922 · GHSA-54hq-mf6h-48xh
npm @strapi/core · Upgrade to 5.20.0 or later · < 5.20.0 · CVE-2025-53092 · GHSA-9329-mxxw-qwf8 · amended
npm @strapi/core · Upgrade to 5.5.2 or later · >= 5.0.0, < 5.5.2 · CVE-2024-56143 · GHSA-495j-h493-42q2 · amended
Maven org.springframework.cloud:spring-cloud-gateway-server · Upgrade to 4.3.2 or 4.2.6 by release line; some affected versions have no fix yet · >= 4.3.0, < 4.3.2; >= 4.2.0, < 4.2.6; >= 4.0.0, <= 4.1.9; <= 3.1.10 · CVE-2025-41253 · GHSA-fwxx-wv44-7qfg
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20250807174701-e14175eb6539 (pre-release) or later · < 8.0.0-20250807174701-e14175eb6539 · +1 more package · CVE-2025-58073 · GHSA-6q7m-p8cc-998r
NuGet apache.nms.amqp · Upgrade to 2.4.0 or later · < 2.4.0 · CVE-2025-54539 · GHSA-4mjw-xr5x-prpc
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20250815100400-2d5cdc6e217e (pre-release) or later · < 8.0.0-20250815100400-2d5cdc6e217e · +1 more package · CVE-2025-58075 · GHSA-r6qj-894f-5hr2
--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScriptnpm happy-dom · Upgrade to 20.0.2 or later · >= 19.0.0, < 20.0.2 · CVE-2025-62410 · GHSA-qpm2-6cq5-7pq5 · amended
Maven org.opensearch.dataprepper.plugins:opensearch · Upgrade to 2.12.2 or later · < 2.12.2 · CVE-2025-62371 · GHSA-43ff-rr26-8hx4
sveltekit-superforms has Prototype Pollution in parseFormData function of formData.jsnpm sveltekit-superforms · Upgrade to 2.27.4 or later · <= 2.27.3 · CVE-2025-62381 · GHSA-hwmc-4c8j-xxj7 · amended
NuGet microsoft.build.utilities.core +2 · Upgrade all 3 to 18.0.0-preview-25476-107 (pre-release), 17.14.28, 17.12.50 or 3 more by release line · >= 17.15.0-preview-25277-114, <= 17.15.0-preview-25277-114; >= 17.14.0, <= 17.14.8; >= 17.12.0, <= 17.12.36; >= 17.11.0, <= 17.11.31; >= 17.10.0, <= 17.10.29; >= 17.8.0, <= 17.8.29 · CVE-2025-55247 · GHSA-w3q9-fxm7-j8fq
alloy_dyn_abi::TypedData hashingcrates.io alloy-dyn-abi · Upgrade to 1.4.1 or 0.8.26 by release line · < 0.8.26; >= 1.0.0, < 1.4.1 · CVE-2025-62370 · GHSA-pgp9-98jm-wwq2
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.