Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @modelcontextprotocol/server-filesystem · Upgrade to 2025.7.1; some affected versions have no fix yet · <= 0.6.2; >= 2025.1.14, < 2025.7.1 · CVE-2025-53109 · GHSA-q66q-fx2p-7w4m · amended
PyPI pillow · Upgrade to 11.3.0 or later · >= 11.2.0, < 11.3.0 · CVE-2025-48379 · GHSA-xg8h-j46f-w952 · amended
Maven org.graylog2:graylog2-server · Upgrade to 6.3.0-rc.2 (pre-release) or 6.2.4 by release line · >= 6.2.0, < 6.2.4; >= 6.3.0-alpha.1, < 6.3.0-rc.2 · CVE-2025-53106 · GHSA-3m86-c9x3-vwm9
npm @cyanheads/git-mcp-server · Upgrade to 2.1.5 or later · <= 2.1.4 · CVE-2025-53107 · GHSA-3q26-f695-pp76 · amended
Maven org.conductoross:conductor-core · Upgrade to 3.21.13 or later · < 3.21.13 · CVE-2025-26074 · GHSA-8gqp-hr9g-pg62
npm electron · Upgrade to 31.0.0-beta.1 (pre-release) or 30.0.5 by release line · >= 30.0.0-alpha.1, < 30.0.5; >= 31.0.0-alpha.1, < 31.0.0-beta.1 · CVE-2024-46992 · GHSA-xw5q-g62x-2qjc · amended
Maven io.jans:jans-config-api-server · Upgrade to 1.8.0 or later · < 1.8.0 · CVE-2025-53003 · GHSA-373j-mhpf-84wg
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.33.8 or later · < 2.33.8 · CVE-2025-52904 · GHSA-hc8f-m8g5-8362
npm tiny-secp256k1 · Upgrade to 1.1.7 or later · <= 1.1.6 · CVE-2024-49365 · GHSA-5vhg-9xg4-cv9m · amended
npm tiny-secp256k1 · Upgrade to 1.1.7 or later · <= 1.1.6 · CVE-2024-49364 · GHSA-7mc2-6phr-23xc · amended
Packagist starcitizentools/tabber-neue · Upgrade to 3.1.1 or later · >= 3.0.0, < 3.1.1 · CVE-2025-53093 · GHSA-jfj7-249r-7j2m
PyPI mobsf · Upgrade to 3.9.7 or later · < 3.9.7 · CVE-2024-54000 · GHSA-m435-9v6r-v5f6 · amended
Packagist billz/raspap-webgui · Upgrade to 3.3.6 or later · < 3.3.6 · CVE-2025-44163 · GHSA-277f-37gw-9gmq
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.15.0 or later · < 2.15.0 · CVE-2025-52999 · GHSA-h46c-h94j-95f3
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.33.10 or later · < 2.33.10 · CVE-2025-52903 · GHSA-3q2w-42mv-cph4
PyPI apache-airflow-providers-snowflake · Upgrade to 6.4.0 or later · < 6.4.0 · CVE-2025-50213 · GHSA-9r64-3wmc-x8m8 · amended
Go github.com/lxc/incus/v6 · Upgrade to 6.14.0 or later · >= 6.12.0, <= 6.13.0 · CVE-2025-52890 · GHSA-p7fw-vjjm-2rwp
Go github.com/octo-sts/app · Upgrade to 0.5.3 or later · <= 0.5.2 · CVE-2025-52477 · GHSA-h3qp-hwvr-9xcq
Maven io.qameta.allure.plugins:trx-plugin +2 · Upgrade all 3 to 2.34.1 or later · <= 2.34.0 · CVE-2025-52888 · GHSA-h7qf-qmf3-85qg
Go gogs.io/gogs · Upgrade to 0.13.3 or later · <= 0.13.2 · CVE-2024-56731 · GHSA-wj44-9vcg-wjq7
npm pbkdf2 · Upgrade to 3.1.3 or later · >= 1.0.0, <= 3.1.2 · CVE-2025-6547 · GHSA-v62p-rq8g-8h59 · amended
npm pbkdf2 · Upgrade to 3.1.3 or later · >= 3.0.10, <= 3.1.2 · CVE-2025-6545 · GHSA-h7cp-r72f-jxh6 · amended
PyPI langchain-community · Upgrade to 0.0.28 or later · < 0.0.28 · CVE-2025-2828 · GHSA-h5gc-rm8j-5gpr · amended
npm @anthropic-ai/claude-code · Upgrade to 1.0.24 or later · >= 0.2.116, < 1.0.24 · CVE-2025-52882 · GHSA-9f65-56v6-gxw7 · amended
PyPI changedetection-io · Upgrade to 0.50.4 or later · <= 0.50.3 · CVE-2025-52558 · GHSA-hwpg-x5hw-vpv9 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.