Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Joi.string().isoDate()npm joi · Upgrade to 18.2.6 or 17.13.7 by release line · >= 17.2.0, < 17.13.7; >= 18.0.0, < 18.2.6 · CVE-2026-92599 · GHSA-6h2x-m376-mqjq · amended
npm electron · Upgrade to 43.0.0, 42.5.2 or 41.10.4 by release line · < 41.10.4; >= 42.0.0-alpha.1, < 42.5.2; >= 43.0.0-alpha.1, < 43.0.0 · CVE-2026-102673 · GHSA-hq2x-r82h-9wj4 · amended
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102674 · GHSA-gr2m-v5gq-v685 · amended
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102675 · GHSA-j84w-jfhq-vhvj · amended
npm electron · Upgrade to 44.0.0-beta.5 (pre-release), 43.4.1, 42.9.2 or 41.10.6 by release line · < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · CVE-2026-102676 · GHSA-9qh4-3jw8-366w · amended
npm electron · Upgrade to 44.0.0-beta.6 (pre-release), 43.5.0 or 42.10.0 by release line · >= 42.3.3, < 42.10.0; >= 43.0.0-beta.1, < 43.5.0; >= 44.0.0-alpha.1, < 44.0.0-beta.6 · CVE-2026-102677 · GHSA-qmv3-fv6v-rmhq · amended
Packagist phpcsstandards/phpcsutils · Upgrade to 1.2.3 or later · >= 1.0.0-alpha1, < 1.2.3 · CVE-2026-65954 · GHSA-r6hr-vr92-vv28 · amended
npm @angular/platform-server · Upgrade to 22.1.6, 21.2.23 or 20.3.31 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.6; >= 21.0.0, < 21.2.23; >= 20.0.0, < 20.3.31; <= 19.2.25 · CVE-2026-101895 · GHSA-f67j-2jqw-jpq7 · amended
npm fast-uri · Upgrade to 4.1.4, 3.1.7 or 2.4.6 by release line · < 2.4.6; >= 3.0.0, < 3.1.7; >= 4.0.0, < 4.1.4 · CVE-2026-84292 · GHSA-qw65-cvwx-89v3 · amended
npm fast-uri · Upgrade to 4.1.4, 3.1.7 or 2.4.6 by release line · >= 2.4.5, <= 2.4.5; >= 3.1.6, <= 3.1.6; >= 4.1.3, <= 4.1.3 · CVE-2026-84394 · GHSA-58mr-gqgx-xq4g · amended
npm @angular/platform-server · Upgrade to 22.1.4, 21.2.22 or 20.3.30 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.4; >= 21.0.0, < 21.2.22; >= 20.0.0, < 20.3.30; <= 19.2.25 · CVE-2026-88058 · GHSA-j3r3-mxqp-r2p4 · amended
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.2 or 3.1.6 by release line · >= 3.2.0, < 3.2.2; >= 3.0.0, < 3.1.6 · +1 more package · CVE-2026-68497 · GHSA-q4xh-88c3-wmh7 · amended
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.1 or later · < 0.91.1 · CVE-2026-61687 · GHSA-phg3-3g28-wq9v · amended
Go github.com/ubuntu/adsys · Upgrade to 0.16.3-0.20250318112551-8b1939f96d38 (pre-release) or later · < 0.16.3-0.20250318112551-8b1939f96d38 · CVE-2026-12249 · GHSA-crm4-q7v4-c2r2 · amended
grep_search Command Injection via Unescaped $() Shell Substitution (CWE-78)npm code-ollama · Upgrade to 0.36.1 or later · <= 0.36.0 · GHSA-456v-xq2p-r4cj · amended
PyPI scbe-aethermoore · Upgrade to 4.2.1 or later · >= 4.0.2, < 4.2.1 · CVE-2026-57443 · GHSA-q986-4x7x-gx39 · amended
NuGet cliinvoke.specializations · Upgrade to 3.0.0-beta.1 (pre-release), 2.10.5, 2.9.4 or 2.8.5 by release line · >= 2.2.0, <= 2.8.4; >= 2.9.0, <= 2.9.3; >= 2.10.0, <= 2.10.4; >= 3.0.0-alpha.1, <= 3.0.0-alpha.4; >= 3.0.0-alpha.8, <= 3.0.0-alpha.10 · +1 more package · CVE-2026-100368 · GHSA-wrvw-254r-wpmv · amended
NuGet cliinvoke · Upgrade to 3.0.0-beta.2 (pre-release), 2.10.5, 2.9.4 or 2.8.5 by release line · >= 2.0.0, <= 2.8.4; >= 2.9.0, <= 2.9.3; >= 2.10.0, <= 2.10.4; >= 3.0.0-alpha.1, <= 3.0.0-beta.1 · +1 more package · CVE-2026-100369 · GHSA-j73w-8hfr-4gc9 · amended
PyPI khoj · Upgrade to 2.0.0b25 (pre-release) or later · >= 2.0.0b23, < 2.0.0b25 · GHSA-62mm-xwmv-crhg · amended
npm knowns · Upgrade to 0.30.0 or later · <= 0.29.1 · CVE-2026-86439 · GHSA-9gfj-28hw-jchp · amended
VestingWalletConfidential: a malicious ERC-7984 token is able to extract private data from the vesting walletnpm @openzeppelin/confidential-contracts · Upgrade to 0.5.2, 0.4.2 or 0.3.2 by release line · < 0.3.2; >= 0.4.0-rc.0, < 0.4.2; >= 0.5.0-rc.0, < 0.5.2 · GHSA-29h2-jr22-frmh · amended
Packagist fof/oauth · Upgrade to 2.0.0-beta.4 (pre-release) or 1.7.4 by release line · < 1.7.4; >= 2.0.0-beta.1, < 2.0.0-beta.4 · CVE-2026-92161 · GHSA-g7vj-c29h-3h5m · amended
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-57440 · GHSA-v65j-hff3-753c · amended
Packagist code16/sharp · Upgrade to 9.22.5 or later · < 9.22.5 · CVE-2026-61823 · GHSA-qxg3-46rw-79j8 · amended
Packagist code16/sharp · Upgrade to 9.22.5 or later · < 9.22.5 · CVE-2026-61825 · GHSA-vj3q-vp3g-j9c8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.