Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
9451–9475 of 31,071 matching · newest first
Go github.com/gtsteffaniak/filebrowser · Upgrade to 0.0.0-20260307130210-09713b32a5f6 (pre-release) or later · < 0.0.0-20260307130210-09713b32a5f6 · CVE-2026-30934 · GHSA-r633-fcgp-m532
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260307130210-09713b32a5f6 (pre-release) or later · < 0.0.0-20260307130210-09713b32a5f6 · CVE-2026-30933 · GHSA-525j-95gf-766f
Packagist admidio/admidio · Upgrade to 5.0.6 or later · < 5.0.6 · CVE-2026-30927 · GHSA-7pfv-hr63-h7cw
npm parse-server · Upgrade to 9.5.0-alpha.11 (pre-release) or 8.6.10 by release line · >= 9.0.0-alpha.1, < 9.5.0-alpha.11; < 8.6.10 · CVE-2026-30863 · GHSA-x6fw-778m-wr9v · amended
__type introspection bypass via inline fragments when public introspection is disablednpm parse-server · Upgrade to 9.5.0-alpha.10 (pre-release) or later · >= 9.3.1-alpha.3, < 9.5.0-alpha.10 · CVE-2026-30854 · GHSA-q5q9-2rhp-33qw · amended
beforeFind / afterFind trigger authorizationnpm parse-server · Upgrade to 9.5.0-alpha.9 (pre-release) or 8.6.9 by release line · < 8.6.9; >= 9.0.0-alpha.1, < 9.5.0-alpha.9 · CVE-2026-30850 · GHSA-hwx8-q9cg-mqmc · amended
PagesRouter path traversal allows reading files outside configured pages directorynpm parse-server · Upgrade to 9.5.0-alpha.8 (pre-release) or 8.6.8 by release line · < 8.6.8; >= 9.0.0-alpha.1, < 9.5.0-alpha.8 · CVE-2026-30848 · GHSA-hm3f-q6rw-m6wh · amended
npm @oneuptime/common · Upgrade to 10.0.19 or later · < 10.0.19 · CVE-2026-30920 · GHSA-656w-6f6c-m9r6 · amended
Go github.com/kubewarden/kubewarden-controller · Upgrade to 1.33.0 or later · < 1.33.0 · CVE-2026-29773 · GHSA-6r7f-3fwq-hq74
Go github.com/gravitl/netmaker · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-29196 · GHSA-4hgg-c4rr-6h7f
Go github.com/gravitl/netmaker · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-29195 · GHSA-ch3w-9456-38v3
Go github.com/gravitl/netmaker · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-29194 · GHSA-hmqr-wjmj-376c
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260307173642-b59e35cb59ae (pre-release) or later · < 0.0.0-20260307173642-b59e35cb59ae · CVE-2026-28513 · GHSA-qh6q-598w-w6m2
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260228130835-3a339e33191c (pre-release) or later · < 0.0.0-20260228130835-3a339e33191c · CVE-2026-28512 · GHSA-9h33-g3ww-mqff
npm @budibase/server · Upgrade to 3.23.32 or later · < 3.23.32 · CVE-2026-25041 · GHSA-726g-59wr-cj4c · amended
PyPI apache-airflow-providers-amazon · Upgrade to 9.22.0 or later · < 9.22.0 · CVE-2026-25604 · GHSA-rv5f-ccpm-xjj4 · amended
PyPI apache-airflow-providers-http · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2025-69219 · GHSA-9r5j-7r2x-rv4g · amended
Maven org.apache.iotdb:iotdb-core · Upgrade to 2.0.7 or 1.3.7 by release line · >= 1.0.0, < 1.3.7; >= 2.0.0, < 2.0.7 · CVE-2026-24015 · GHSA-74cf-pgh9-m5q2
Maven org.apache.iotdb:iotdb-core · Upgrade to 2.0.7 or 1.3.7 by release line · >= 1.0.0, < 1.3.7; >= 2.0.0, < 2.0.7 · CVE-2026-24713 · GHSA-6w48-2g9j-v9q5
Maven org.apache.zookeeper:zookeeper · Upgrade to 3.9.5 or 3.8.6 by release line · >= 3.8.0, < 3.8.6; >= 3.9.0, < 3.9.5 · CVE-2026-24281 · GHSA-7xrh-hqfc-g7qr
Maven org.apache.zookeeper:zookeeper · Upgrade to 3.9.5 or 3.8.6 by release line · >= 3.9.0, < 3.9.5; >= 3.8.0, < 3.8.6 · CVE-2026-24308 · GHSA-crhr-qqj8-rpxc
Packagist wpmetabox/meta-box · Upgrade to 5.11.2 or later · < 5.11.2 · CVE-2025-14675 · GHSA-m4q3-832v-44j6
crates.io soroban-env-host · Upgrade to 26.0.0 or later · < 26.0.0 · GHSA-pm4j-7r4q-ccg8
npm @oneuptime/common · Upgrade to 10.0.20 or later · < 10.0.20 · CVE-2026-30921 · GHSA-4j36-39gm-8vq8 · amended
PyPI x402 · Upgrade to 2.3.0 or later · < 2.3.0 · +2 more packages · GHSA-qr2g-p6q7-w82m · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.