Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Maven org.springframework.boot:spring-boot · Upgrade to 3.4.5 or 3.3.11 by release line; some affected versions have no fix yet · <= 2.7.24.2; >= 3.1.0, <= 3.1.15.2; >= 3.2.0, <= 3.2.13.2; >= 3.3.0, <= 3.3.10; >= 3.4.0, <= 3.4.4 · CVE-2025-22235 · GHSA-rc42-6c7j-7h5r
Packagist moodle/moodle · Upgrade to 4.5.4, 4.4.8, 4.3.12 or 4.1.18 by release line · < 4.1.18; >= 4.3.0-beta, < 4.3.12; >= 4.4.0-beta, < 4.4.8; >= 4.5.0-beta, < 4.5.4 · CVE-2025-3641 · GHSA-c8v6-vxhf-wcrr
Packagist moodle/moodle · Upgrade to 4.5.4, 4.4.8, 4.3.12 or 4.1.18 by release line · < 4.1.18; >= 4.3.0-beta, < 4.3.12; >= 4.4.0-beta, < 4.4.8; >= 4.5.0-beta, < 4.5.4 · CVE-2025-3642 · GHSA-m367-445c-2xqr
Packagist moodle/moodle · Upgrade to 4.5.3 or later · >= 4.5.0-beta, < 4.5.3 · CVE-2025-32044 · GHSA-345q-9jmq-g9q4
Go github.com/rancher/steve · Upgrade to 0.5.13, 0.4.4, 0.3.3 or 0.2.1 by release line · >= 0.2.0, < 0.2.1; >= 0.4.0, < 0.4.4; >= 0.5.0, < 0.5.13; >= 0.3.0, < 0.3.3 · CVE-2023-32198 · GHSA-95fc-g4gj-mqmx
Go github.com/rancher/rancher · Upgrade to 2.11.1, 2.10.5 or 2.9.9 by release line · >= 2.8.0, < 2.9.9; >= 2.10.0, < 2.10.5; >= 2.11.0, < 2.11.1 · CVE-2024-22031 · GHSA-8h6m-wv39-239m
Packagist craftcms/cms · Upgrade to 5.6.17, 4.14.15 or 3.9.15 by release line · >= 3.0.0-RC1, <= 3.9.14; >= 4.0.0-RC1, <= 4.14.14; >= 5.0.0-RC1, <= 5.6.16 · CVE-2025-32432 · GHSA-f3gw-9ww9-jmc3
npm react-router · Upgrade to 7.5.2 or later · >= 7.0.0-pre.0, <= 7.5.1 · CVE-2025-43865 · GHSA-cpj6-fhp6-mr6j · amended
npm react-router · Upgrade to 7.5.2 or later · >= 7.2.0, <= 7.5.1 · CVE-2025-43864 · GHSA-f46r-rw29-r322 · amended
PyPI h11 · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2025-43859 · GHSA-vqfr-h8mv-ghfj · amended
npm @trpc/server · Upgrade to 11.1.1 or later · >= 11.0.0, < 11.1.1 · CVE-2025-43855 · GHSA-pj3v-9cm8-gvj8 · amended
Maven org.apache.httpcomponents.client5:httpclient5 · Upgrade to 5.4.3 or later · >= 5.4-alpha1, < 5.4.3 · CVE-2025-27820 · GHSA-73m2-qfq3-56cx
NuGet youtubedlsharp · Upgrade to 1.1.2 or later · >= 1.0.0-beta4, < 1.1.2 · CVE-2025-43858 · GHSA-2jh5-g5ch-43q5
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 16.10.1, 16.4.6 or 15.10.16 by release line · >= 1.8, < 15.10.16; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.1 · CVE-2025-32969 · GHSA-f69v-xrj8-rhxf
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 16.10.1, 16.4.6 or 15.10.16 by release line · >= 1.6-milestone-1, < 15.10.16; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.1 · CVE-2025-32968 · GHSA-g9jj-75mx-wjcx
PyPI vllm · Upgrade to 0.8.0 or later · < 0.8.0 · GHSA-ggpf-24jw-3fcw · amended
npm xrpl · Upgrade to 4.2.5 or 2.14.3 by release line · >= 4.2.1, < 4.2.5; >= 2.14.2, <= 2.14.2 · CVE-2025-32965 · GHSA-33qr-m49q-rxfx · amended
Go github.com/wazuh/wazuh · Upgrade to 4.9.1 or later · >= 4.4.0, < 4.9.1 · CVE-2025-24016 · GHSA-hcrc-79hj-m3qh
NuGet amazon.iondotnet · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2025-3857 · GHSA-gm2p-wf5c-w3pj
Maven net.mingsoft:ms-mcms · Upgrade to 5.4.4 or later · < 5.4.4 · CVE-2025-29287 · GHSA-3922-2r6r-r4fv
Go github.com/osrg/gobgp/v3 · Upgrade to 3.35.0 or later · >= 3.11.0, < 3.35.0 · CVE-2025-43971 · GHSA-7m35-vw2c-696v
Go github.com/traefik/traefik/v3 · Upgrade to 3.4.0-rc2 (pre-release) or 3.3.6 by release line · < 3.3.6; >= 3.4.0-rc1, <= 3.4.0-rc1 · +1 more package · GHSA-5423-jcjm-2gpv
Go github.com/traefik/traefik/v3 · Upgrade to 3.4.0-rc2 (pre-release) or 3.3.6 by release line · < 3.3.6; >= 3.4.0-rc1, <= 3.4.0-rc1 · +1 more package · GHSA-3wqc-mwfx-672p
NuGet apache.nms.activemq · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2025-29953 · GHSA-9g64-r942-fvmp
torch.load with weights_only=True leads to remote code executionPyPI torch · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2025-32434 · GHSA-53q9-r3pm-6pq6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.