Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
PyPI apm-cli · Upgrade to 0.8.12 or later · <= 0.8.11 · CVE-2026-44641 · GHSA-xhrw-5qxx-jpwr · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
6751–6775 of 30,985 matching · newest first
PyPI apm-cli · Upgrade to 0.8.12 or later · <= 0.8.11 · CVE-2026-44641 · GHSA-xhrw-5qxx-jpwr · amended
Go github.com/lin-snow/Ech0 · Upgrade to 1.4.8-0.20260503041146-eab62379c795 (pre-release) or later · < 1.4.8-0.20260503041146-eab62379c795 · GHSA-fpw6-hrg5-q5x5
Go github.com/lin-snow/Ech0 · Upgrade to 1.4.8-0.20260503040728-a7e8b8e84bd1 (pre-release) or later · < 1.4.8-0.20260503040728-a7e8b8e84bd1 · GHSA-p64j-f4x9-wq66
PyPI gdal · Upgrade to 3.13.0 or later · < 3.13.0 · CVE-2026-8087 · GHSA-h9rh-5ffh-h669 · amended
PyPI gdal · Upgrade to 3.13.0 or later · < 3.13.0 · CVE-2026-8088 · GHSA-j3f5-rw74-g4rv · amended
Go github.com/lin-snow/ech0 · Upgrade to 1.4.8-0.20260503040602-091d26d2d942 (pre-release) or later · < 1.4.8-0.20260503040602-091d26d2d942 · GHSA-8mc6-xjpr-h98x
Go github.com/lin-snow/Ech0 · Upgrade to 1.4.8-0.20260503035905-cecc2c19b590 (pre-release) or later · < 1.4.8-0.20260503035905-cecc2c19b590 · GHSA-pj6q-4vq4-r8cg
Go github.com/lin-snow/ech0 · Upgrade to 1.4.8-0.20260503040728-a7e8b8e84bd1 (pre-release) or later · < 1.4.8-0.20260503040728-a7e8b8e84bd1 · GHSA-rgj7-vg8v-j4wr
Go github.com/lin-snow/Ech0 · Upgrade to 1.4.8-0.20260503035519-fd320fe3e902 (pre-release) or later · < 1.4.8-0.20260503035519-fd320fe3e902 · GHSA-3v85-fqvh-7rxf
Go github.com/lin-snow/Ech0 · Upgrade to 1.4.8-0.20260503034700-cb8d7a997dd8 (pre-release) or later · < 1.4.8-0.20260503034700-cb8d7a997dd8 · GHSA-rj4g-rqgh-rx9h
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260501152247-18b587758667 (pre-release) or later · < 0.0.0-20260501152247-18b587758667 · CVE-2026-44523 · GHSA-q6mh-rqwh-g786
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260501152243-db3f72bff780 (pre-release) or later · < 0.0.0-20260501152243-db3f72bff780 · CVE-2026-44522 · GHSA-g49p-4qxj-88v3
Packagist web-auth/webauthn-framework · Upgrade to 5.3.1 or later · >= 5.3.0, < 5.3.1 · GHSA-h4fw-6r7f-w494
crates.io zebrad · Upgrade to 4.4.0 or later · < 4.4.0 · GHSA-cwfq-rfcr-8hmp · amended
crates.io zebra-script · Upgrade to 6.0.0 or later · <= 5.0.1 · +1 more package · CVE-2026-44497 · GHSA-gq4h-3grw-2rhv
crates.io zebra-chain · Upgrade to 7.0.0 or later · <= 6.0.3 · +2 more packages · CVE-2026-44500 · GHSA-438q-jx8f-cccv
crates.io zebrad · Upgrade to 4.4.0 or later · < 4.4.0 · CVE-2026-44498 · GHSA-jv4h-j224-23cc · amended
npm nuxt-og-image · Upgrade to 6.4.9 or later · >= 6.2.5, < 6.4.9 · CVE-2026-44589 · GHSA-c2rm-g55x-8hr5 · amended
Packagist facturascripts/facturascripts · Upgrade to 2025.81 or 2025.8 by release line · < 2025.8; >= 2025.11, < 2025.81 · CVE-2026-27964 · GHSA-gq5c-rw37-g46c · amended
Packagist facturascripts/facturascripts · Upgrade to 2026 or later · < 2026 · CVE-2026-27892 · GHSA-q7f2-rv22-2xgr · amended
PyPI gdal · Upgrade to 3.13.0 or later · < 3.13.0 · CVE-2026-8086
PyPI gdal · Upgrade to 3.13.0 or later · < 3.13.0 · CVE-2026-8084
Packagist krayin/laravel-crm · Upgrade to 2.1.6 or later · >= 2.1.5, <= 2.1.5 · CVE-2026-36341 · GHSA-j822-46r5-h4qx
npm cinny · Upgrade to 4.10.3 or later · < 4.10.3 · CVE-2026-42553 · GHSA-j944-w549-3453 · amended
bentoml build via symlink traversal in the build contextPyPI bentoml · Upgrade to 1.4.39 or later · <= 1.4.38 · CVE-2026-40610 · GHSA-mcfx-4vc6-qgxv · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.