Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1301–1325 of 30,910 matching · newest first
npm payload · Upgrade to 4.0.0-canary.27 (pre-release) or 3.88.0 by release line · < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27 · CVE-2026-105805 · GHSA-9g87-32v6-3c2r · amended
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.35.0 or later · >= 1.25.1, < 1.35.0 · CVE-2026-105795 · GHSA-6gw6-rv2g-25mg · amended
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.35.0 or later · >= 0.5.0, < 1.35.0 · CVE-2026-105796 · GHSA-rm89-rhwj-9j92 · amended
npm @modelcontextprotocol/sdk · Upgrade to 1.31.0 or later · >= 1.12.0, < 1.31.0 · +1 more package · CVE-2026-104850 · GHSA-6qxp-vccf-f47h · amended
npm i18next-http-backend · Upgrade to 4.0.2 or later · < 4.0.2 · CVE-2026-105800 · GHSA-xvq9-wjp8-hwqf · amended
NuGet microsoft.native.quic.msquic.openssl · Upgrade to 2.6.1, 2.5.11 or 2.4.20 by release line · < 2.4.20; >= 2.5.0, < 2.5.11; >= 2.6.0, < 2.6.1 · CVE-2026-105794 · GHSA-w5f4-fx9m-m4q7 · amended
PyPI openapi-python-client · Upgrade to 0.29.1 or later · < 0.29.1 · CVE-2026-105801 · GHSA-5293-mq8x-g3xj · amended
npm @langchain/redis · Upgrade to 1.1.1 or later · <= 1.1.0 · CVE-2026-105799 · GHSA-5x6v-p487-7qh2 · amended
Go github.com/external-secrets/external-secrets · Upgrade to 1.3.2 or later · >= 0.10.0, < 1.3.2 · CVE-2026-26287 · GHSA-q7hv-xx6h-q2x8 · amended
PyPI vyper · Upgrade to 0.2.6 or later · < 0.2.6 · CVE-2020-37286 · GHSA-2r3x-4mrv-mcxf · amended
PyPI vyper · Upgrade to 0.2.6 or later · < 0.2.6 · CVE-2020-37287 · GHSA-4v7v-gqf9-ww2g · amended
PyPI vyper · Upgrade to 0.2.3 or later · >= 0.1.0b10, < 0.2.3 · CVE-2020-37288 · GHSA-vg88-3v92-rjx2 · amended
npm sharp · Upgrade to 0.35.5 or later · < 0.35.5 · CVE-2026-114111 · GHSA-wq5f-xc86-pv6w · amended
PyPI docling +1 · Upgrade all 2 to 2.131.0 or later · >= 2.45.0, < 2.131.0 · CVE-2026-105747 · GHSA-3cr3-8m4c-fpxw · amended
quote() command injection via a line terminator in a token after a { comment } tokennpm shell-quote · Upgrade to 1.11.0 or later · >= 1.8.4, < 1.11.0 · CVE-2026-102422 · GHSA-pqg4-j6r4-53mv · amended
npm pbkdf2 · Upgrade to 3.1.7 or later · <= 3.1.6 · CVE-2026-102414 · GHSA-477h-4r7f-fvrx · amended
PyPI langflow · Upgrade to 1.10.3 or later · < 1.10.3 · +3 more packages · GHSA-j8f7-x8jm-wmm4 · amended
PyPI langflow · Upgrade to 1.10.1 or later · < 1.10.1 · CVE-2026-10561 · GHSA-8qpj-27x8-pwpq · amended
crates.io noyalib · Upgrade to 0.0.53 or later · >= 0.0.0-0, < 0.0.53 · GHSA-4xcc-23fx-w2wj
enable_local_fetch is not enforced in HTML browser-rendering modePyPI docling +1 · Upgrade all 2 to 2.118.1 or later · >= 2.82.0, < 2.118.1 · CVE-2026-105750 · GHSA-q43m-vhcp-mhvm · amended
PyPI vllm · Upgrade to 0.28.0 or later · < 0.28.0 · CVE-2026-105753 · GHSA-ph3r-5jfg-f84f · amended
cache_salt — restoring a cross-tenant prefix-cache membership oraclePyPI vllm · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-105752 · GHSA-935w-9g4m-p28p · amended
PyPI werkzeug · Upgrade to 3.1.9 or later · < 3.1.9 · CVE-2026-102598 · GHSA-g6x2-hccm-hh4m · amended
VISUAL editor environment variable is omitted from unsafe editor detectionnpm @simple-git/argv-parser · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2026-102829 · GHSA-v5rq-49vh-5v5c · amended
npm simple-git · Upgrade to 4.0.1 or later · >= 3.15.0, < 4.0.1 · CVE-2026-102828 · GHSA-x6jw-m9v5-85vh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.