Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
6401–6425 of 30,985 matching · newest first
x-api-key header — full message processing on restricted endpointsPyPI open-webu +1 · Upgrade all 2 to 0.9.0 or later · <= 0.8.12 · CVE-2026-45339 · GHSA-57q6-fvp4-pqmm · amended
PyPI open-webui · Upgrade to 0.9.0 or later · <= 0.8.12 · CVE-2026-45338 · GHSA-24c9-2m8q-qhmh · amended
npm svelte · Upgrade to 5.55.7 or later · <= 5.55.6 · CVE-2026-42599 · GHSA-pr6f-5x2q-rwfp · amended
PyPI open-webui · Upgrade to 0.9.0 or later · <= 0.8.12 · CVE-2026-45331 · GHSA-4v7r-f4w8-8972 · amended
PyPI open-webui · Upgrade to 0.9.3 or later · <= 0.9.2 · CVE-2026-45317 · GHSA-j6w6-986j-2m2m · amended
PyPI open-webui · Upgrade to 0.9.3 or later · <= 0.9.2 · CVE-2026-45318 · GHSA-hcwp-82g6-8wxc · amended
PyPI open-webui · Upgrade to 0.9.3 or later · <= 0.9.2 · CVE-2026-45316 · GHSA-jx2x-j75f-xq3j · amended
PyPI open-webui · Upgrade to 0.9.3 or later · <= 0.9.2 · CVE-2026-45314 · GHSA-3856-3vxq-m6fc · amended
PyPI open-webui · Upgrade to 0.9.3 or later · <= 0.9.2 · CVE-2026-45315 · GHSA-m8f9-9whg-f4xr · amended
PyPI ha-mcp · Upgrade to 7.5.0 or later · < 7.5.0 · GHSA-g39v-cvjh-8fpf · amended
PyPI open-webui · Upgrade to 0.6.5 or later · < 0.6.5 · CVE-2026-45303 · GHSA-4vrc-m9ch-6m3r · amended
PyPI open-webui · Upgrade to 0.3.16 or later · <= 0.3.15 · CVE-2026-45301 · GHSA-r8wh-8m7r-fh33 · amended
PyPI open-webui · Upgrade to 0.8.0 or later · < 0.8.0 · CVE-2026-45299 · GHSA-6gh2-q7cp-9qf6 · amended
Go github.com/kumahq/kuma · Upgrade to 2.13.5, 2.12.10, 2.11.13 or 2 more by release line · < 2.7.25; >= 2.9.0, < 2.9.15; >= 2.11.0, < 2.11.13; >= 2.12.0, < 2.12.10; >= 2.13.0, < 2.13.5 · CVE-2026-45021 · GHSA-3vcp-chfh-f6r2
PyPI ethyca-fides · Upgrade to 2.84.5 or later · >= 2.33.0, < 2.84.5 · CVE-2026-44541 · GHSA-5qrq-9645-g5g2 · amended
xmp raw-text passthrough in sanitize-htmlnpm sanitize-html · Upgrade to 2.17.4 or later · >= 2.17.3, <= 2.17.3 · CVE-2026-44990 · GHSA-rpr9-rxv7-x643 · amended
npm @karakeep/sdk · Upgrade to 0.32.0 or later · <= 0.31.0 · GHSA-7rx4-c5vx-g8w3 · amended
Go github.com/go-git/go-billy/v6 · Upgrade to 6.0.0-alpha.1 (pre-release) or later · < 6.0.0-alpha.1 · +1 more package · CVE-2026-44973 · GHSA-qw64-3x98-g7q2
PyPI dbt-mcp · Upgrade to 1.17.1 or later · <= 1.17.0 · CVE-2026-44970 · GHSA-jj54-r8gm-2fcf · amended
PyPI dbt-mcp · Upgrade to 1.17.1 or later · <= 1.17.0 · CVE-2026-44969 · GHSA-7xgw-6qf3-7w59 · amended
PyPI dbt-mcp · Upgrade to 1.17.1 or later · <= 1.17.0 · CVE-2026-44968 · GHSA-xpww-f6pm-cfhq · amended
PyPI diffusers · Upgrade to 0.38.0 or later · < 0.38.0 · CVE-2026-44827 · GHSA-j7w6-vpvq-j3gm
npm @tanstack/start-server-core · Upgrade to 1.167.30 or later · < 1.167.30 · GHSA-9m65-766c-r333 · amended
PyPI mistune · Upgrade to 3.2.1 or later · >= 3.2.0, <= 3.2.0 · CVE-2026-44899 · GHSA-ccfx-mfmx-2fx9 · amended
PyPI mistune · Upgrade to 3.2.1 or later · >= 3.2.0, <= 3.2.0 · CVE-2026-44898 · GHSA-6269-cqxg-mhhv · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.