Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
7001–7025 of 30,985 matching · newest first
fetchWebContent MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass isPrivateOrLocalHostnamenpm open-websearch · Upgrade to 2.1.7 or later · <= 2.1.6 · CVE-2026-42260 · GHSA-v228-72c7-fx8j · amended
NuGet yafnet.core · Upgrade to 4.0.5 or 3.2.12 by release line · >= 4.0.0-beta01, <= 4.0.4; <= 3.2.11 · CVE-2026-43939 · GHSA-8rq5-wwpp-fmj2
/Admin/RunSqlNuGet yafnet.core · Upgrade to 4.0.5 or later · <= 4.0.4 · CVE-2026-43937 · GHSA-xhw7-j96h-c3g5
User-Agent HeaderNuGet yafnet.core · Upgrade to 4.0.5 or 3.2.12 by release line · >= 4.0.0-beta01, <= 4.0.4; <= 3.2.11 · CVE-2026-43938 · GHSA-33gv-fc78-qgf5
npm parse-server · Upgrade to 9.9.0-alpha.2 (pre-release) or 8.6.76 by release line · >= 9.0.0, < 9.9.0-alpha.2; < 8.6.76 · CVE-2026-43930 · GHSA-jpq4-7fmq-q5fj · amended
npm ssrfcheck · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2025-8267 · GHSA-p4hc-9pjh-55c8 · amended
crates.io rustfs · Upgrade to 1.0.0-alpha.98 (pre-release) or later · <= 1.0.0-alpha.91 · GHSA-mm2q-qcmx-gw4w
Go github.com/gofiber/fiber/v3 · Upgrade to 3.2.0 or later · <= 3.1.0 · +1 more package · CVE-2026-42554 · GHSA-qjv7-627w-8qjv
npm link-preview-js · Upgrade to 4.0.1 or later · <= 4.0.0 · CVE-2026-43897 · GHSA-4gp8-rjrq-ch6q · amended
uenc Parameter in stockAction()Packagist openmage/magento-lts · Upgrade to 20.18.0 or later · <= 20.17.0 · CVE-2026-42207 · GHSA-qpgq-5g92-j5q8
Maven org.postgresql:postgresql · Upgrade to 42.7.11 or later · >= 42.2.0, < 42.7.11 · CVE-2026-42198 · GHSA-98qh-xjc8-98pq
PyPI django-s3file · Upgrade to 7.0.2 or later · < 7.0.2 · CVE-2026-42196 · GHSA-67qg-7284-2277 · amended
ReadMultiple Storage-REST EndpointGo github.com/minio/minio · Upgrade to 0.0.0-20260414213245 (pre-release) or later · >= 0.0.0-20220724015452, < 0.0.0-20260414213245 · CVE-2026-42600 · GHSA-xh8f-g2qw-gcm7
Packagist admidio/admidio · Upgrade to 5.0.9 or later · <= 5.0.8 · CVE-2026-42194 · GHSA-hcjj-chvw-fmw9
Maven org.geysermc.geyser:core · Upgrade to 2.9.3 or later · <= 2.9.2 · CVE-2026-42188 · GHSA-xcfg-fcr5-gw9r
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260420173541-6d2e0506e2b4 (pre-release) or later · < 0.0.0-20260420173541-6d2e0506e2b4 · CVE-2026-42186 · GHSA-vv66-6rp4-wr4f
npm exiftool-vendored · Upgrade to 35.19.0 or later · <= 35.18.0 · CVE-2026-43893 · GHSA-cw26-7653-2rp5 · amended
PyPI requests-hardened · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-42175 · GHSA-vh75-fwv3-pqrh · amended
Packagist openmage/magento-lts · Upgrade to 20.18.0 or later · <= 20.17.0 · CVE-2026-42155 · GHSA-2cwr-gcf9-pvxr
Go github.com/prometheus/prometheus · Upgrade to 0.311.3 or 0.305.2 by release line; some affected versions have no fix yet · >= 0.306.0, < 0.311.3; < 0.305.2; >= 1.0.0-rc.0, <= 2.5.0 · CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Go github.com/prometheus/prometheus · Upgrade to 0.311.3 or later · >= 0.45.2, < 0.311.3 · CVE-2026-42151 · GHSA-wg65-39gg-5wfj
Maven org.xwiki.contrib.plantuml:macro-plantuml-macro · Upgrade to 2.4.1 or later · < 2.4.1 · CVE-2026-42140 · GHSA-42fc-7w97-8vrc
crates.io gix · Upgrade to 0.83.0 or later · < 0.83.0 · +1 more package · GHSA-fr8x-3vfx-f45h
crates.io gix · Upgrade to 0.83.0 or later · < 0.83.0 · +1 more package · GHSA-pg4w-g64p-qwhj
crates.io gix-pack · Upgrade to 0.69.0 or later · <= 0.68.0 · GHSA-x494-mj8g-cj27
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.