Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @insumermodel/mppx-condition-gate · Upgrade to 3.0.0 or later · <= 2.0.3 · +1 more package · CVE-2026-104891 · GHSA-jg6q-3qfh-r9f8 · amended
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106510 · GHSA-4488-j8vj-vqqv · amended
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106558 · GHSA-qmw3-745m-w99g · amended
npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown · Upgrade to 0.3.25 or later · < 0.3.25 · CVE-2026-106560 · GHSA-2cmg-v53w-8xfp · amended
npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud · Upgrade to 0.3.10 or later · < 0.3.10 · +1 more package · CVE-2026-106486 · GHSA-g8rx-f7m5-7794 · amended
npm @backstage/plugin-auth-backend-module-oidc-provider · Upgrade to 0.4.20 or later · < 0.4.20 · CVE-2026-106488 · GHSA-826h-28h9-65hg · amended
npm @backstage/backend-defaults · Upgrade to 0.17.8 or later · < 0.17.8 · CVE-2026-106492 · GHSA-cq7v-rfgc-5c7v · amended
npm @backstage/plugin-catalog-backend · Upgrade to 3.9.1 or later · < 3.9.1 · CVE-2026-106498 · GHSA-qgvj-qcf8-xq73 · amended
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0, 4.0.3, 3.4.1 or 3.3.1 by release line · < 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 · CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p · amended
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0, 4.0.3, 3.4.1 or 3.3.1 by release line · < 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 · CVE-2026-106503 · GHSA-hmp2-4m7g-22cv · amended
npm @backstage/plugin-scaffolder-backend · Upgrade to 4.1.0 or later · < 4.1.0 · CVE-2026-106500 · GHSA-xvgh-hmx8-9xxf · amended
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106505 · GHSA-p75x-jh7p-ppcx · amended
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106509 · GHSA-8w7q-29mw-gf5c · amended
npm @backstage/plugin-techdocs-node · Upgrade to 1.15.4 or later · < 1.15.4 · CVE-2026-106557 · GHSA-f7v3-xhm6-w245 · amended
npm @payloadcms/db-mongodb · Upgrade to 4.0.0-canary.20 (pre-release) or 3.87.0 by release line · < 3.87.0; >= 4.0.0-canary.0, < 4.0.0-canary.20 · CVE-2026-106100 · GHSA-4ww4-68q3-h7g5 · amended
NuGet imagesharp +1 · Upgrade all 2 to 4.1.1 or 3.2.0 by release line · >= 3.0.0, < 3.2.0; >= 4.0.0, < 4.1.1 · CVE-2026-106118 · GHSA-v76p-62qx-wwq2 · amended
NuGet imagesharp · Upgrade to 4.1.1 or 3.2.0 by release line · >= 3.0.0, < 3.2.0; >= 4.0.0, < 4.1.1 · CVE-2026-106117 · GHSA-jj3q-cwqj-842r · amended
X-Forwarded-For Allowing Remote Configuration WritePyPI langflow · Upgrade to 1.10.3 or later · >= 1.5.0, < 1.10.3 · CVE-2026-105741 · GHSA-4f6c-2vvp-gw82 · amended
npm ghost · Upgrade to 6.44.1 or later · >= 5.9.0, < 6.44.1 · CVE-2026-105681 · GHSA-6q6j-f24j-p477 · amended
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · <= 3.1.2 · CVE-2026-73487 · GHSA-w7x8-q2gp-5cgg · amended
npm flowise +1 · Upgrade all 2 to 3.1.3 or later · < 3.1.3 · CVE-2026-73483 · GHSA-9gvv-qjj3-2p6g · amended
npm @quasar/cli · Upgrade to 5.0.4 or later · <= 5.0.3 · +2 more packages · CVE-2026-106105 · GHSA-fh39-c73x-5pjv · amended
npm @quasar/render-ssr-error · Upgrade to 2.2.4 or later · <= 2.2.3 · +1 more package · CVE-2026-106106 · GHSA-r5mf-4r5x-q78f · amended
npm @quasar/app-vite · Upgrade to 3.3.0 or later · <= 3.2.0 · CVE-2026-106107 · GHSA-5m6h-8g35-p3m7 · amended
npm quasar · Upgrade to 2.23.3 or later · <= 2.23.2 · CVE-2026-106104 · GHSA-68jq-fhch-4xq4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.