Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
826–850 of 30,910 matching · newest first
PyPI graphifyy · Upgrade to 0.9.70 or later · >= 0.7.2, < 0.9.70 · GHSA-pcc4-rvhr-2pr8 · amended
PyPI mercury · Upgrade to 3.2.6 or later · <= 3.2.5 · CVE-2026-111058 · GHSA-rv4m-xm3f-3ccq · amended
PyPI loopx · Upgrade to 0.4.5 or later · >= 0.0.1, < 0.4.5 · CVE-2026-108372 · GHSA-vx2m-gpq4-8j5q · amended
crates.io wasmtime · Upgrade to 43.0.0 or 36.0.19 by release line · < 36.0.19; >= 37.0.0, < 43.0.0 · CVE-2026-115889 · GHSA-897f-g5gm-fmxm · amended
crates.io wasmtime · Upgrade to 49.0.4 or 48.0.7 by release line · >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 · CVE-2026-115892 · GHSA-9pvw-hwfg-92h5 · amended
wasi-http p3: forwarded trailers aren't checked against is_forbidden_header hookcrates.io wasmtime-wasi-http · Upgrade to 49.0.4 or 48.0.7 by release line · >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 · CVE-2026-121440 · GHSA-jxcf-8qw5-5c33 · amended
affinitypool::spawn_local futurecrates.io surrealdb · Upgrade to 3.3.0 or later · >= 0.0.0-0, < 3.3.0 · CVE-2026-121417 · GHSA-pm86-cc75-q463
wasi-http: Guests can add conflicting content lengths to messagescrates.io wasmtime-wasi-http · Upgrade to 49.0.4, 48.0.7 or 36.0.19 by release line · >= 0.0.0-0, < 36.0.19; >= 37.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 · CVE-2026-121441 · GHSA-r8xh-cgf7-392j · amended
wasi-http p3: Guests can set incorrect content-length for spliced response bodiescrates.io wasmtime-wasi-http · Upgrade to 49.0.4 or 48.0.7 by release line · >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 · CVE-2026-121439 · GHSA-9prg-84vf-g5fc · amended
br_table instructioncrates.io wasmtime · Upgrade to 49.0.4, 48.0.7 or 36.0.19 by release line · < 36.0.19; >= 37.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 · CVE-2026-115893 · GHSA-mghf-wjfp-p5xm · amended
ENABLE_WIKILINKScrates.io pulldown-cmark · Upgrade to 0.13.5 or later · >= 0.13.0, < 0.13.5
PyPI lmcache · Upgrade to 0.5.6 or later · >= 0.3.9, < 0.5.6 · CVE-2026-105192 · GHSA-w5f2-9q9c-ff4h · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.146.0 or later · < 0.146.0 · CVE-2026-100349 · GHSA-74vm-87hj-r66f · amended
crates.io wasmtime-wasi · Upgrade to 46.0.1, 45.0.3, 36.0.12 or 24.0.11 by release line · < 24.0.11; >= 25.0.0, < 36.0.12; >= 37.0.0, < 45.0.3; >= 46.0.0, < 46.0.1 · CVE-2026-58494 · GHSA-4ch3-9j33-3pmj · amended
crates.io lopdf · Upgrade to 0.42.0 or later · < 0.42.0 · GHSA-6fj4-rcr3-r7rr · amended
Maven org.bytedeco:javacv · Upgrade to 1.5.14 or later · < 1.5.14 · CVE-2026-102834 · GHSA-rxjv-24xq-76wc · amended
PyPI claude-agent-sdk · Upgrade to 0.2.121 or later · < 0.2.121 · CVE-2026-96620 · GHSA-h4mw-j7qp-8mwm · amended
k8s_external headless AXFR can emit an empty transfer batch that panics the transfer pluginGo github.com/coredns/coredns · Upgrade to 1.14.5 or later · >= 1.9.4, <= 1.14.4 · CVE-2026-62994 · GHSA-74w3-63xv-x9mv · amended
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.112 or later · < 0.4.112 · CVE-2026-76894 · GHSA-vqff-r82h-9crc · amended
PyPI clickmigrate · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2026-68549 · GHSA-vgf9-9mxx-hq54 · amended
Go github.com/gomarkdown/markdown · Upgrade to 0.0.0-20260724235538-61af6e1e6971 (pre-release) or later · < 0.0.0-20260724235538-61af6e1e6971 · CVE-2026-102941 · GHSA-cv23-7vc5-jfh7 · amended
InBuffer::poscrates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 7.2.2, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
Seekable reads a NULL or out-of-bounds seek tablecrates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 7.2.2, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
crates.io zstd · Upgrade to 0.4.10 or later · >= 0.1.1, < 0.4.10
OutBuffer::around_pos exposes uninitialized memorycrates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 4.0.0, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.