Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
7501–7525 of 31,057 matching · newest first
Maven org.apache.httpcomponents.client5:httpclient5 · Upgrade to 5.6.1 or later · >= 5.6-alpha1, < 5.6.1 · CVE-2026-40542 · GHSA-v468-qcjx-r72w
Maven org.springframework.security:spring-security-config · Upgrade to 7.0.5 or later · >= 7.0.0, <= 7.0.4 · CVE-2026-22754 · GHSA-4vrc-j85c-598c
Maven org.springframework.security:spring-security-oauth2-jose · Upgrade to 7.0.5 or 6.5.10 by release line; some affected versions have no fix yet · >= 6.3.0, <= 6.3.14; >= 6.4.0, <= 6.4.14; >= 6.5.0, <= 6.5.9; >= 7.0.0, <= 7.0.4 · CVE-2026-22748 · GHSA-cvc6-q2cp-2xhw
Maven org.springframework.security:spring-security-config · Upgrade to 7.0.5 or later · >= 7.0.0, <= 7.0.4 · CVE-2026-22753 · GHSA-4wrg-8wpc-h923
Maven org.springframework.security:spring-security-web · Upgrade to 7.0.5 or later · >= 7.0.0, <= 7.0.4 · CVE-2026-22747 · GHSA-2jrg-rf5x-568g
Maven org.springframework.security:spring-security-core · Upgrade to 7.0.5 or 6.5.10 by release line; some affected versions have no fix yet · >= 5.7.0, <= 5.7.22; >= 5.8.0, <= 5.8.24; >= 6.3.0, <= 6.3.15; >= 6.4.0, <= 6.4.15; >= 6.5.0, <= 6.5.9; >= 7.0.0, <= 7.0.4 · CVE-2026-22746 · GHSA-vxf7-qj7q-83fh
Maven org.springframework.security:spring-security-core · Upgrade to 7.0.5 or 6.5.10 by release line; some affected versions have no fix yet · >= 6.5.0, < 6.5.10; >= 7.0.3, < 7.0.5; >= 6.4.0, <= 6.4.13 · CVE-2026-22751 · GHSA-x2wq-9x2f-fhj7
npm astro · Upgrade to 6.1.6 or later · < 6.1.6 · CVE-2026-41067 · GHSA-j687-52p2-xcff · amended
PyPI lxml · Upgrade to 6.1.0 or later · < 6.1.0 · CVE-2026-41066 · GHSA-vfmq-68hx-4jfw · amended
Go github.com/tektoncd/pipeline · Upgrade to 1.11.1, 1.9.3, 1.6.2 or 2 more by release line · >= 1.10.0, < 1.11.1; >= 1.7.0, < 1.9.3; >= 1.4.0, < 1.6.2; >= 1.2.0, < 1.3.4; >= 1.0.0, < 1.0.2 · CVE-2026-40938 · GHSA-94jr-7pqp-xhcq
Go github.com/tektoncd/pipeline · Upgrade to 1.11.1, 1.9.3, 1.6.2 or 2 more by release line · >= 1.10.0, < 1.11.1; >= 1.0.0, < 1.0.2; >= 1.2.0, < 1.3.4; >= 1.4.0, < 1.6.2; >= 1.7.0, < 1.9.3 · CVE-2026-40924 · GHSA-m2cx-gpqf-qf74
Go github.com/tektoncd/pipeline · Upgrade to 1.11.1, 1.9.3, 1.6.2 or 2 more by release line · >= 1.10.0, < 1.11.1; >= 1.7.0, < 1.9.3; >= 1.4.0, < 1.6.2; >= 1.2.0, < 1.3.4; >= 1.0.0, < 1.0.2 · CVE-2026-40923 · GHSA-rx35-6rhx-7858
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41264 · GHSA-3hjv-c53m-58jj · amended
crates.io brillig · Upgrade to 1.0.0-beta.19 (pre-release) or later · <= 1.0.0-beta.18 · CVE-2026-41197 · GHSA-jj7c-x25r-r8r3
Packagist openmage/magento-lts · Upgrade to 20.17.0 or later · <= 20.16.0 · CVE-2026-40488 · GHSA-3j5q-7q7h-2hhv
Go github.com/tektoncd/pipeline · Upgrade to 1.11.1, 1.9.3, 1.6.2 or 2 more by release line · >= 1.0.0, < 1.0.2; >= 1.2.0, < 1.3.4; >= 1.4.0, < 1.6.2; >= 1.7.0, < 1.9.3; >= 1.10.0, < 1.11.1 · CVE-2026-40161 · GHSA-wjxp-xrpv-xpff
npm @anthropic-ai/claude-code · Upgrade to 2.1.64 or later · < 2.1.64 · CVE-2026-39861 · GHSA-vp62-r36r-9xqp · amended
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260420162526-f58111d2ca54 (pre-release) or later · < 0.0.0-20260420162526-f58111d2ca54 · CVE-2026-40264 · GHSA-p49j-v9wc-wg57
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260420155735-b596b0882620 (pre-release) or later · < 0.0.0-20260420155735-b596b0882620 · CVE-2026-39946 · GHSA-6vgr-cp5c-ffx3
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260420180337-2b2a901aa9f7 (pre-release) or later · < 0.0.0-20260420180337-2b2a901aa9f7 · CVE-2026-39396 · GHSA-r65v-xgwc-g56j
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260420160924-abe84e1af4c3 (pre-release) or later · < 0.0.0-20260420160924-abe84e1af4c3 · CVE-2026-39388 · GHSA-7ccv-rp6m-rffr
Go github.com/m1k1o/neko/server · Upgrade to 3.0.11 or 0.0.0-20260406184107-c54bcf1ee211 (pre-release) by release line · >= 3.0.0, < 3.0.11; >= 0.0.0-20250322225643-212bf8a60756, < 0.0.0-20260406184107-c54bcf1ee211 · CVE-2026-39386 · GHSA-2gw9-c2r2-f5qf
PyPI nbconvert · Upgrade to 7.17.1 or later · >= 6.5.0, < 7.17.1 · CVE-2026-39378 · GHSA-7jqv-fw35-gmx9 · amended
PyPI nbconvert · Upgrade to 7.17.1 or later · >= 6.5.0, < 7.17.1 · CVE-2026-39377 · GHSA-4c99-qj7h-p3vg · amended
npm signalk-server · Upgrade to 2.25.0 or later · < 2.25.0 · CVE-2026-39320 · GHSA-7gcj-phff-2884 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.