Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
8901–8925 of 31,057 matching · newest first
Go github.com/ory/oathkeeper · Upgrade to 0.40.10-0.20260320084801-198a2bc82a99 (pre-release) or later · < 0.40.10-0.20260320084801-198a2bc82a99 · CVE-2026-33496 · GHSA-4mq7-pvjg-xp2r
Go github.com/ory/oathkeeper · Upgrade to 0.40.10-0.20260320084810-e9acca14a04d (pre-release) or later · < 0.40.10-0.20260320084810-e9acca14a04d · CVE-2026-33495 · GHSA-vhr5-ggp3-qq85
\r) in EventStream Data and Comment Fields (Bypass of CVE Fix)npm h3 · Upgrade to 2.0.1-rc.17 (pre-release) or 1.15.9 by release line · >= 2.0.0-beta.0, <= 2.0.1-rc.16; < 1.15.9 · CVE-2026-86252 · GHSA-4hxc-9384-m385 · amended
mount() Causes Middleware Execution on Unrelated Prefix-Matching Routesnpm h3 · Upgrade to 2.0.1-rc.17 (pre-release) or later · >= 2.0.1-alpha.0, <= 2.0.1-rc.16 · CVE-2026-33490 · GHSA-2j6q-whv2-gh6w · amended
serveStatic Bypasses resolveDotSegments Path Traversal Protection via %252e%252enpm h3 · Upgrade to 1.15.9 or later · <= 1.15.8 · CVE-2026-86251 · GHSA-72gr-qfp7-vwhw · amended
sql.lit(string) usage or similar methods that append string literal values into the compiled SQL stringsnpm kysely · Upgrade to 0.28.14 or later · <= 0.28.13 · CVE-2026-33468 · GHSA-8cpq-38p9-67gx · amended
npm kysely · Upgrade to 0.28.14 or later · >= 0.28.12, <= 0.28.13 · CVE-2026-33442 · GHSA-fr9j-6mvq-frcv · amended
PyPI langflow · Upgrade to 1.9.0 or later · >= 1.0.0, < 1.9.0 · CVE-2026-33484 · GHSA-7grx-3xcx-2xv5 · amended
Go github.com/anchore/syft · Upgrade to 1.42.3 or later · < 1.42.3 · CVE-2026-33481 · GHSA-rjcw-vg7j-m9rc
npm parse-server · Upgrade to 9.6.0-alpha.43 (pre-release) or 8.6.54 by release line · >= 9.0.0, < 9.6.0-alpha.43; < 8.6.54 · CVE-2026-33429 · GHSA-qpc3-fg4j-8hgm · amended
getB64BasePdf When basePdf Is Attacker-Controllednpm @pdfme/common · Upgrade to 5.5.10 or later · <= 5.5.9 · CVE-2026-82866 · GHSA-pgx6-7jcq-2qff · amended
npm @pdfme/schemas · Upgrade to 5.5.10 or later · <= 5.5.9 · CVE-2026-82865 · GHSA-xgx4-2wgv-4jhm · amended
npm @pdfme/pdf-lib · Upgrade to 5.5.10 or later · <= 5.5.9 · CVE-2026-82864 · GHSA-vrqm-gvq7-rrwh · amended
npm parse-server · Upgrade to 9.6.0-alpha.42 (pre-release) or 8.6.53 by release line · >= 9.0.0, < 9.6.0-alpha.42; < 8.6.53 · CVE-2026-33421 · GHSA-fph2-r4qg-9576 · amended
Go code.vikunja.io/api · Upgrade to 2.2.0 or later · >= 1.0.0-rc0, < 2.2.0 · CVE-2026-33474 · GHSA-wc83-79hj-hpmq
npm @dicebear/converter · Upgrade to 9.4.2 or later · <= 9.4.1 · CVE-2026-33418 · GHSA-7j2x-32w6-p43p · amended
crates.io aws-lc-sys · Upgrade to 0.39.0 or later · >= 0.15.0, < 0.39.0 · +1 more package · CVE-2026-4428 · GHSA-9f94-5g5w-gf6r · amended
crates.io aws-lc-sys · Upgrade to 0.39.0 or later · >= 0.32.0, < 0.39.0 · GHSA-394x-vwmw-crm3 · amended
AsyncLocalStorage context lost/contaminated inside Effect fibers under concurrent load with RPCnpm effect · Upgrade to 3.20.0 or later · < 3.20.0 · CVE-2026-32887 · GHSA-38f7-945m-qr2g · amended
npm @orpc/openapi · Upgrade to 1.13.9 or later · <= 1.13.8 · CVE-2026-33331 · GHSA-7f6v-3gx7-27q8 · amended
Go code.vikunja.io/api · Upgrade to 2.2.0 or later · >= 0.20.2, < 2.2.0 · CVE-2026-33312 · GHSA-564f-wx8x-878h
unpack_in can chmod arbitrary directories by following symlinkscrates.io tar · Upgrade to 0.4.45 or later · <= 0.4.44 · CVE-2026-33056 · GHSA-j4xf-2g29-59ph
crates.io tar · Upgrade to 0.4.45 or later · <= 0.4.44 · CVE-2026-33055 · GHSA-gchp-q4r4-x4ff
RubyGems graphiti · Upgrade to 1.10.2 or later · <= 1.10.1 · CVE-2026-33286 · GHSA-3m5v-4xp5-gjg2
PyPI pydicom · Upgrade to 3.0.2 or 2.4.5 by release line · >= 3.0.0, <= 3.0.1; < 2.4.5 · CVE-2026-32711 · GHSA-v856-2rf8-9f28 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.