Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Go github.com/kubev2v/assisted-migration-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53476 · GHSA-7j4w-x8x8-5mvg · amended
file.create permissionsPackagist pterodactyl/panel · Upgrade to 1.12.3 or later · < 1.12.3 · +1 more package · CVE-2026-54593 · GHSA-8r6w-3qq5-4p4r · amended
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53471 · GHSA-2fqw-7c6r-2cq6 · amended
Go github.com/kubev2v/migration-planner · Upgrade to 0.13.5 or later · < 0.13.5 · CVE-2026-53469 · GHSA-6xvf-9742-48w2 · amended
Go github.com/kubev2v/assisted-migration-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53475 · GHSA-8g5p-jxp9-457c · amended
Go github.com/apache/answer +1 · Upgrade all 2 to 2.0.1 or later · <= 1.7.1 · CVE-2026-25700 · GHSA-4gw2-vg4x-7p29 · amended
npm mlflow · Upgrade to 3.15.0 or later · < 3.15.0 · CVE-2026-69148 · GHSA-gqch-g4w5-7qcw
PyPI mlflow · Upgrade to 3.15.0 or later · >= 3.3.0, < 3.15.0 · CVE-2026-64849 · GHSA-7gwp-5pfp-969j · amended
DigestAuthProvider.verify did not bind to request URIMaven org.http4k:http4k-security-digest · Upgrade to 6.50.0.0, 5.42.0.0 or 4.51.0.0 by release line · >= 6.0.0.0, < 6.50.0.0; >= 5.0.0.0, < 5.42.0.0; >= 4.0.0.0, < 4.51.0.0 · CVE-2026-54148 · GHSA-p28p-j94q-pg32 · amended
w:basedOn Style Chain leads to Denial of ServiceMaven org.docx4j:docx4j-core · Upgrade to 11.5.14 or later · <= 11.5.13 · CVE-2026-53752 · GHSA-gc95-3vw8-vg43 · amended
ServerFilters.GZip / RequestFilters.GunZip allowed memory-exhaustion DoSMaven org.http4k:http4k-core · Upgrade to 6.49.0.0 or 5.42.0.0 by release line; some affected versions have no fix yet · >= 5.0.0.0, < 5.42.0.0; <= 4.48.2.0; >= 6.0.0.0, < 6.49.0.0 · CVE-2026-53659 · GHSA-g4w2-6h2r-3m3w
PyPI atomic-agents-stack · Upgrade to 1.1.0 or later · <= 1.0.0 · GHSA-j659-8xh6-5pq5
PyPI atomic-agents-stack · Upgrade to 1.1.0 or later · <= 1.0.0 · GHSA-xhcr-cqfr-m3hv
Maven io.netty:netty-transport-sctp · Upgrade to 4.2.17.Final or 4.1.137.Final by release line · >= 4.2.0.Final, <= 4.2.16.Final; <= 4.1.136.Final · CVE-2026-59902 · GHSA-2qj4-mmr9-4v2f · amended
Go gitlab.com/uniget-org/cli · Upgrade to 0.28.9 or later · >= 0.27.4, < 0.28.9 · GHSA-fhgh-wq4q-r37x · amended
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.6.dev0 · CVE-2026-59893 · GHSA-prg7-hcfm-mfcr
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-54284 · GHSA-pwgv-4x5q-6m9f
npm ep_etherpad-lite · Upgrade to 3.3.0 or later · <= 1.8.14 · CVE-2026-55090 · GHSA-2jp7-wwpg-3p9w · amended
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · GHSA-v836-6xw4-9cx3
builtin: ['*'] exposes os and dns — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)npm vm2 · Upgrade to 3.11.6 or later · < 3.11.6 · CVE-2026-92960 · GHSA-m5w8-4gq2-6f8x · amended
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47698 · GHSA-cfcw-xp6x-25gj · amended
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47686 · GHSA-m283-3h24-438v · amended
npm vm2 · Upgrade to 3.11.6 or later · <= 3.11.5 · CVE-2026-47683 · GHSA-gmc2-2x9w-cgh9
PyPI sqlparse · Upgrade to 0.6.0 or later · <= 0.5.5 · CVE-2026-71491 · GHSA-f2ff-p2ww-7p4p
--disable-config-exec does not cover on-alert action commands (incomplete fix of CVE-2026-53925)PyPI glances · Upgrade to 4.5.6 or later · <= 4.5.5 · CVE-2026-68519 · GHSA-59fj-m2j6-hcxh
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.