Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
eval() in Llama3 tool-call parsingPyPI xinference · Upgrade to 2.7.0 or later · <= 2.5.0 · CVE-2026-61539 · GHSA-x2rj-828p-hx9m · amended
join filter compile-time PHP code injection (SSTI leads to RCE)Packagist phalcon/cphalcon · Upgrade to 5.16.0 or later · <= 5.15.0 · CVE-2026-59989 · GHSA-hrwp-4hh9-c8r8 · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.141.0 or later · >= 0.10.0, < 0.141.0 · CVE-2026-76905 · GHSA-mmfr-pmjx-hw9w · amended
Go github.com/runatlantis/atlantis · Upgrade to 0.45.0 or later · >= 0.19.8, < 0.45.0 · CVE-2026-64679 · GHSA-26w5-6g95-gj28 · amended
graphql.maxTake bypass with negative takenpm @keystone-6/core · Upgrade to 6.5.3 or later · <= 6.5.2 · CVE-2026-63421 · GHSA-cqmq-8755-7xvh
npm defuddle · Upgrade to 0.19.1 or later · <= 0.19.0 · CVE-2026-61824 · GHSA-jg4p-g6xj-4qmf
Maven org.geotools.jdbc:gt-jdbc-postgis · Upgrade to 35.1, 34.5 or 33.6 by release line · >= 35.0, <= 35.0; >= 34.0, < 34.5; >= 30.5, < 33.6 · CVE-2026-76904 · GHSA-mqjf-5f49-2fjh · amended
npm unleash-server · Upgrade to 8.0.2, 7.6.5 or 7.5.2 by release line · < 7.5.2; >= 7.6.0, < 7.6.5; >= 8.0.0, < 8.0.2 · CVE-2026-63462 · GHSA-r5pq-6chh-j3xp
PyPI nltk · Upgrade to 3.10.1 or later · < 3.10.1 · CVE-2026-72818 · GHSA-qx2g-xrx7-vfh8
Packagist winter/wn-backend-module · Upgrade to 1.2.14 or later · < 1.2.14 · CVE-2026-125337 · GHSA-fm29-4mq3-phg6 · amended
Packagist winter/wn-system-module · Upgrade to 1.2.13 or later · >= 1.2.7, < 1.2.13 · CVE-2026-79774 · GHSA-8cfw-pcwh-v63w · amended
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63202 · GHSA-4899-mpch-38p3 · amended
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61827 · GHSA-hmq9-67w8-j5pw · amended
Maven io.netty.incubator:netty-incubator-codec-bhttp · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-63124 · GHSA-8cfx-wx3q-mh5q · amended
Maven io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl · Upgrade to 0.0.23.Final or later · <= 0.0.22.Final · CVE-2026-61798 · GHSA-2mc4-j865-9q4r · amended
Maven io.netty.incubator:netty-incubator-codec-ohttp · Upgrade to 0.0.23.Final or later · < 0.0.23.Final · CVE-2026-54251 · GHSA-vmr9-j6wf-pmh2 · amended
Go github.com/fleetdm/fleet +1 · Upgrade all 2 to 4.86.2 or later · < 4.86.2 · CVE-2026-54245 · GHSA-7q96-f8xw-jv5j · amended
Packagist backpack/crud · Upgrade to 7.0.36, 6.8.13, 5.6.2 or 4.1.72 by release line · >= 4.1.0, < 4.1.72; >= 5.0.0, < 5.6.2; >= 6.0.0, < 6.8.13; >= 7.0.0, < 7.0.36 · CVE-2026-54182 · GHSA-mrc5-3mm3-45c5 · amended
Packagist backpack/crud · Upgrade to 7.0.38 or 6.8.14 by release line · >= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38 · CVE-2026-54180 · GHSA-vgmv-8xjc-6rch · amended
Packagist backpack/crud · Partial vendor fix · >= 5.0.0; >= 6.0.0, < 6.8.12; >= 7.0.0, < 7.0.35 · CVE-2026-54178 · GHSA-8xjm-wqrp-2f25
Packagist backpack/crud · Upgrade to 7.0.34 or 6.8.11 by release line · < 6.8.11; >= 7.0.0-alpha.1, < 7.0.34 · CVE-2026-54175 · GHSA-xpv2-hrfc-hw62 · amended
npm @whyour/qinglong · Upgrade to 2.20.1 or later · < 2.20.1 · CVE-2026-55445 · GHSA-v667-gc2r-2xm7 · amended
Go github.com/openshift-pipelines/pipelines-as-code · Upgrade to 0.48.0, 0.42.1, 0.39.6 or 0.37.8 by release line · >= 0.43.0, < 0.48.0; >= 0.40.0, < 0.42.1; >= 0.38.0, < 0.39.6; < 0.37.8 · CVE-2026-54167 · GHSA-f5f4-3hh4-f54m · amended
npm node-opcua · Upgrade to 2.166.0 or later · < 2.166.0 · CVE-2026-54156 · GHSA-6wvw-vrw4-363w
Maven org.jsoup:jsoup · Upgrade to 1.23.2 or later · < 1.23.2 · CVE-2026-75140 · GHSA-65r4-943x-97jj · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.