Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
5951–5975 of 30,985 matching · newest first
pages.access permission is not checked during rendering of page draftsPackagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-44176 · GHSA-2xw4-v2wx-hqq9
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-44175 · GHSA-5fhx-9q32-q257
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-44174 · GHSA-86rh-h242-j8xp
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0, <= 1.3.0 · CVE-2026-43947 · GHSA-rg3m-cfq7-g6h6 · amended
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0, <= 1.3.0 · CVE-2026-43946 · GHSA-fwcm-rqvw-j3p7 · amended
npm @frangoteam/fuxa · Upgrade to 1.3.1 or later · >= 1.2.11, < 1.3.1 · CVE-2026-43945 · GHSA-p69w-mmfv-xrfj · amended
Maven org.yamcs:yamcs-core · Upgrade to 5.12.7 or later · < 5.12.7 · CVE-2026-42568 · GHSA-cqh3-jg8p-336j
npm @fedify/fedify · Upgrade to 2.2.3, 2.1.14, 2.0.18 or 2 more by release line · >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.14; >= 2.0.0, < 2.0.18; >= 1.10.0, < 1.10.10; < 1.9.11 · CVE-2026-42462 · GHSA-9rfg-v8g9-9367 · amended
npm yeoman-environment · Upgrade to 6.0.1 or later · >= 2.9.0, < 6.0.1 · CVE-2026-42089 · GHSA-vv9j-gjw2-j8wp · amended
Maven io.netty.incubator:netty-incubator-codec-ohttp · Upgrade to 0.0.21.Final or later · < 0.0.21.Final · CVE-2026-41207 · GHSA-f659-372h-6x3x
Maven org.xwiki.platform:xwiki-platform-livetable-ui · Upgrade to 17.10.3, 17.4.9 or 16.10.17 by release line · >= 6.2.1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 · CVE-2026-48048 · GHSA-rh28-mqj4-8x59
Maven org.xwiki.platform:xwiki-platform-webjars-api · Upgrade to 17.10.3, 17.4.9 or 16.10.17 by release line · >= 9.6-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 · CVE-2026-48047 · GHSA-vgwr-23fq-pr7g
Packagist pterodactyl/panel · Upgrade to 1.12.3 or later · < 1.12.3 · CVE-2026-35202 · GHSA-fgmm-w5cx-vrfw
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.3, 17.4.9 or 16.10.17 by release line · >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-33137 · GHSA-qrvh-r3f2-9h4r
javascript: URI in text bubble links — bot author executes JS on visitors' browsersnpm @typebot.io/js · Upgrade to 0.10.1 or later · < 0.10.1 · CVE-2026-39964 · GHSA-hqmv-v56g-4m47 · amended
npm @typebot.io/js · Upgrade to 0.10.1 or later · < 0.10.1 · CVE-2026-28445 · GHSA-6m7c-xfhp-p9fh · amended
Maven org.xwiki.commons:xwiki-commons-classloader-api · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.3, 17.4.9 or 16.10.17 by release line · >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-23734 · GHSA-xq3r-2qv5-vqqm
PyPI weblate · Upgrade to 5.15 or later · < 5.15 · CVE-2025-66407 · GHSA-hfpv-mc5v-p9mm · amended
Go kubevirt.io/kubevirt · Upgrade to 1.8.3, 1.7.4 or 1.6.6 by release line · >= 1.8.0-alpha.0, < 1.8.3; >= 1.7.0-alpha.0, < 1.7.4; < 1.6.6 · CVE-2026-7374 · GHSA-7jcp-v9w4-wjmg
npm @koa/router · Upgrade to 15.0.0 or later · >= 14.0.0, < 15.0.0 · CVE-2026-9495 · GHSA-47p6-69vm-vw6v · amended
npm pacote · Upgrade to 21.5.1 or later · >= 11.2.7, < 21.5.1 · CVE-2026-9496 · GHSA-w4pp-8pjf-rmxw · amended
Maven org.apache.shiro:shiro-core · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.0 by release line · >= 1.0.0-incubating, < 2.2.0; >= 3.0.0-alpha-1, <= 3.0.0-alpha-1 · CVE-2026-43827 · GHSA-fcvm-3cpj-f9qx
Maven org.apache.shiro:shiro-web · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.0 by release line · >= 1.0.0-incubating, < 2.2.0; >= 3.0.0-alpha-1, <= 3.0.0-alpha-1 · CVE-2026-43828 · GHSA-c6r4-qjmw-cvj2
Maven org.apache.shiro:shiro-jakarta-ee · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.1 by release line · >= 2.0-alpha, < 2.2.1; >= 3.0.0-alpha-0, < 3.0.0-alpha-2 · CVE-2026-48589 · GHSA-7pq2-fhx9-x464
Maven org.apache.shiro:shiro-jakarta-ee · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.0 by release line · >= 2.0.0-alpha-0, < 2.2.0; >= 3.0.0-alpha-1, <= 3.0.0-alpha-1 · CVE-2026-44598 · GHSA-wpqm-4gwx-w843
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.