Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
PyPI glances · Upgrade to 4.5.6 or later · >= 4.5.2, < 4.5.6 · CVE-2026-62982 · GHSA-73wf-9vmv-5pv9
PyPI glances · Upgrade to 4.5.6 or later · <= 4.5.5 · CVE-2026-68518 · GHSA-qcpp-8x79-hhp3
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.18 (pre-release) or later · <= 1.0.0-rc.17 · CVE-2026-71479 · GHSA-8r8v-xf7q-rcpr · amended
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.11 (pre-release) or later · < 1.0.0-rc.11 · CVE-2026-64868 · GHSA-v828-m3pf-vq9q · amended
Go github.com/QuantumNous/new-api · Upgrade to 1.0.0-rc.7 (pre-release) or later · < 1.0.0-rc.7 · CVE-2026-64859 · GHSA-6x2c-phff-wx57 · amended
npm @medplum/core · Upgrade to 5.1.6 or later · <= 5.1.5 · CVE-2026-53728 · GHSA-m44r-7c5h-m6mj
GitHub Actions wktk/conflibot · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-55158 · GHSA-2qvg-qr73-mqxp · amended
npm deepmerge-ts · Upgrade to 8.0.0 or later · < 8.0.0 · CVE-2026-40345 · GHSA-ggr8-5vv4-36mx
crates.io quinn-proto · Upgrade to 0.11.17 or later · >= 0.11.15, < 0.11.17 · GHSA-qfwj-vfxf-92j2
npm @ooples/token-optimizer-mcp · Upgrade to 5.1.0 or later · < 5.1.0 · CVE-2026-55157 · GHSA-49mq-fc6q-3h46
Maven com.mchange:mchange-commons-java · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-55153 · GHSA-h84g-69h7-mw6v · amended
Maven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-53660 · GHSA-fpmh-vx4h-xc33 · amended
Packagist getgrav/grav · Upgrade to 2.0.0-rc.8 (pre-release) or 1.7.53 by release line · >= 2.0.0-beta.1, < 2.0.0-rc.8; < 1.7.53 · CVE-2026-53653 · GHSA-4x9g-vw65-vvf9 · amended
npm @budibase/server · Upgrade to 3.41.3 or later · < 3.41.3 · CVE-2026-35219 · GHSA-5fpj-28rv-84r7
Go github.com/authorizerdev/authorizer · Upgrade to 0.0.0-20260807033110-66fe488fd2a4 (pre-release) or later · < 0.0.0-20260807033110-66fe488fd2a4 · CVE-2026-35511 · GHSA-29rf-f4vv-pvq6 · amended
crates.io bip322 · Upgrade to 0.0.11 or later · >= 0.0.6, < 0.0.11 · GHSA-5chw-87w3-j9cv
npm @trigger.dev/core · Upgrade to 4.5.6 or later · >= 3.3.8, <= 4.5.5 · CVE-2026-73654 · GHSA-p28v-f755-9qrg
PyPI atomic-agents-stack · Upgrade to 1.1.0 or later · <= 1.0.0 · GHSA-rm43-82j9-r4mj
Packagist pimcore/pimcore · Upgrade to 2026.1.5 or 12.3.9 by release line · >= 2026.1.0, <= 2026.1.4; < 12.3.9 · CVE-2026-55072 · GHSA-2mhj-fhvg-v428 · amended
PyPI ansible-jailexec · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2026-55074 · GHSA-cxgv-hp74-jj7r
NuGet sipsorcery · Upgrade to 10.0.14 or later · >= 10.0.5, <= 10.0.13 · GHSA-pfvm-w89x-94jw · amended
NuGet sipsorcery · Upgrade to 10.0.14 or later · < 10.0.14 · CVE-2026-123805 · GHSA-jwjp-4649-v8jp · amended
package in ado_package_installPyPI stata-mcp · Upgrade to 1.19.0 or later · < 1.19.0 · CVE-2026-55071 · GHSA-49m4-vp58-wgc9
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260526080459-dd1b4287899e (pre-release) or later · < 0.0.0-20260526080459-dd1b4287899e · CVE-2026-54917 · GHSA-w62w-66v9-vvgv · amended
PyPI apache-airflow · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-68968 · GHSA-j4jc-cq9h-xrhr
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.