Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
8426–8450 of 31,057 matching · newest first
/api/chats/export and /api/chats/delete allows arbitrary file read/delete within user data rootnpm sillytavern · Upgrade to 1.17.0 or later · <= 1.16.0 · CVE-2026-34524 · GHSA-vprr-q85p-79mf · amended
npm sillytavern · Upgrade to 1.17.0 or later · <= 1.16.0 · CVE-2026-34523 · GHSA-525j-2hrj-m8fp · amended
/api/chats/import allows arbitrary file write outside intended chat directorynpm sillytavern · Upgrade to 1.17.0 or later · <= 1.16.0 · CVE-2026-34522 · GHSA-xvww-xhx6-22pf · amended
npm payload · Upgrade to 3.79.1 or later · < 3.79.1 · CVE-2026-34749 · GHSA-p6mr-xf3r-ghq4 · amended
PyPI aiohttp · Upgrade to 3.13.4 or later · <= 3.13.3 · CVE-2026-34515 · GHSA-p998-jp59-783m · amended
npm payload · Upgrade to 3.79.1 or later · < 3.79.1 · CVE-2026-34746 · GHSA-6r7f-q7f5-wpx8 · amended
npm @payloadcms/next · Upgrade to 3.78.0 or later · < 3.78.0 · CVE-2026-34748 · GHSA-mmxc-95ch-2j7c · amended
PyPI aiohttp · Upgrade to 3.13.4 or later · <= 3.13.3 · CVE-2026-34514 · GHSA-2vrm-gr82-f7m5 · amended
PyPI aiohttp · Upgrade to 3.13.4 or later · <= 3.13.3 · CVE-2026-34513 · GHSA-hcc4-c3v8-rx92 · amended
npm payload · Upgrade to 3.79.1 or later · < 3.79.1 · CVE-2026-34747 · GHSA-7xxh-373w-35vg · amended
PyPI anthropic · Upgrade to 0.87.0 or later · >= 0.86.0, < 0.87.0 · CVE-2026-34452 · GHSA-w828-4qhx-vxx3 · amended
npm @anthropic-ai/sdk · Upgrade to 0.81.0 or later · >= 0.79.0, < 0.81.0 · CVE-2026-34451 · GHSA-5474-4w2j-mq4c · amended
PyPI anthropic · Upgrade to 0.87.0 or later · >= 0.86.0, < 0.87.0 · CVE-2026-34450 · GHSA-q5f5-3gjm-7mfm · amended
PyPI onnx · Upgrade to 1.21.0 or later · < 1.21.0 · CVE-2026-34447 · GHSA-p433-9wv8-28xj · amended
PyPI onnx · Upgrade to 1.21.0 or later · <= 1.20.1 · CVE-2026-34446 · GHSA-cmw6-hcpp-c6jp · amended
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74881 · GHSA-c65f-x25w-62jv · amended
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74880 · GHSA-4rh7-jwg9-m28m · amended
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74879 · GHSA-2vhw-q7vh-7xv2 · amended
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74877 · GHSA-hvc7-763r-4f3h · amended
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74876 · GHSA-8h88-gxp3-j7pg · amended
PyPI onnx · Upgrade to 1.21.0 or later · <= 1.20.1 · CVE-2026-34445 · GHSA-538c-55jv-c5g9 · amended
Go github.com/modelcontextprotocol/go-sdk · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-34742 · GHSA-xw59-hvm2-8pj6
Go github.com/netbirdio/netbird · Upgrade to 0.65.3 or later · <= 0.65.2 · GHSA-rxmp-8h9v-56cx
PyPI poetry-plugin-tweak-dependencies-version · Upgrade to 1.5.6 or later · <= 1.5.5 · GHSA-5qvp-pr9f-2g2v · amended
PyPI c2cciutils · Upgrade to 1.1.67 or later · <= 1.1.66 · GHSA-qc22-xmq4-qg46 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.