fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
npm fast-jwt · Upgrade to 6.3.0 or later · >= 6.2.4, <= 6.2.4 · CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1076–1100 of 30,910 matching · newest first
npm fast-jwt · Upgrade to 6.3.0 or later · >= 6.2.4, <= 6.2.4 · CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx · amended
npm praisonai · Upgrade to 1.7.3 or later · < 1.7.3 · CVE-2026-61426 · GHSA-6wjp-v33h-5cvq · amended
PyPI praisonai-platform · Upgrade to 0.1.9 or later · <= 0.1.8 · CVE-2026-61442 · GHSA-c78w-2q4r-68r7 · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61434 · GHSA-cv3g-hj65-pcfh · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61445 · GHSA-9mp3-24cc-77mg · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-61427 · GHSA-hc5v-gxvj-58wh · amended
PyPI praisonai-platform · Upgrade to 0.1.9 or later · <= 0.1.8 · CVE-2026-61440 · GHSA-xxgv-vgvj-qvxh · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60085 · GHSA-5r6c-gj4g-r697 · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60091 · GHSA-4w49-gwv8-fpjg · amended
npm music-metadata · Upgrade to 11.16.0 or later · < 11.16.0 · CVE-2026-107391 · GHSA-f94x-6692-553q · amended
npm music-metadata · Upgrade to 11.16.0 or later · <= 11.12.3 · CVE-2026-107387 · GHSA-53v6-4h7p-p4gj · amended
npm music-metadata · Upgrade to 11.16.0 or later · <= 11.12.3 · CVE-2026-107388 · GHSA-jjpr-9cvf-cq55 · amended
npm music-metadata · Upgrade to 11.16.0 or later · < 11.16.0 · CVE-2026-107389 · GHSA-5gfj-9q3v-qfp3 · amended
PyPI pydantic-ai +1 · Upgrade all 2 to 2.53.0 or later · >= 2.10.0, < 2.53.0 · CVE-2026-107286 · GHSA-6fqq-452j-qhrp · amended
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107385 · GHSA-r3rv-jm3r-62q2 · amended
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · >= 3.2.0, < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107384 · GHSA-v6pj-gxxw-phfw · amended
npm mariadb · Upgrade to 3.5.4, 3.4.7, 3.3.4 or 3.2.5 by release line · < 3.2.5; >= 3.3.0, < 3.3.4; >= 3.4.0, < 3.4.7; >= 3.5.0-rc.0, < 3.5.4 · CVE-2026-107383 · GHSA-48qf-xh34-q73r · amended
npm mariadb · Upgrade to 3.5.4 or later · >= 3.3.0, < 3.5.4 · CVE-2026-107382 · GHSA-cx2f-j9fh-8g68 · amended
PyPI cairosvg · Upgrade to 2.9.1 or later · <= 2.9.0 · CVE-2026-107378 · GHSA-c3jg-qh8m-j3h2 · amended
Packagist enshrined/svg-sanitize · Upgrade to 1.0.0 or later · <= 0.22.0 · CVE-2026-107380 · GHSA-9rjx-3jch-6vjf · amended
nesting-DoS check in Resolver::processReferencesPackagist enshrined/svg-sanitize · Upgrade to 1.0.0 or later · <= 0.22.0 · CVE-2026-107381 · GHSA-m9xh-6747-9r6f · amended
Packagist enshrined/svg-sanitize · Upgrade to 1.0.0 or later · <= 0.22.0 · CVE-2026-107379 · GHSA-v383-3rw5-q8rf · amended
.dsf (residual of GHSA-v6c2-xwv6-8xf7)npm music-metadata · Upgrade to 11.15.0 or later · <= 11.14.0 · CVE-2026-107392 · GHSA-8j4c-6x6g-rq3j · amended
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.14.0 or later · < 1.14.0 · CVE-2026-107386 · GHSA-w6r9-248c-frg8 · amended
PyPI praisonai · Upgrade to 4.6.78 or later · <= 4.6.77 · CVE-2026-60086 · GHSA-4r3p-w3mc-5v34 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.