Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
%2F-encoded path bypasses route/group middleware guarding a statically-served pathGo github.com/labstack/echo/v4 · Upgrade to 4.16.0 or later · < 4.16.0 · +1 more package · CVE-2026-118650 · GHSA-375p-5qhx-8wq4 · amended
npm mcp-sanitizer · Upgrade to 1.4.0 or later · < 1.4.0 · GHSA-4mfg-r38w-w8fg · amended
npm mcp-sanitizer · Upgrade to 1.4.0 or later · < 1.4.0 · GHSA-7w82-6f9j-v9jp · amended
PyPI rucio · Upgrade to 41.0.0rc1 (pre-release), 38.6.0 or 35.9.0 by release line · >= 1.16.1, < 35.9.0; >= 36.0.0rc1, < 38.6.0; >= 39.0.0rc1, < 41.0.0rc1 · CVE-2026-58273 · GHSA-5j9r-fx4x-rpvg · amended
crates.io juniper · Upgrade to 0.17.2 or later · >= 0.0.0-0, < 0.17.2 · GHSA-36rq-8957-mjrx
ENABLE_WIKILINKScrates.io pulldown-cmark · Upgrade to 0.13.6 or later · >= 0.13.0, < 0.13.6
crates.io calamine · Upgrade to 0.38.0 or later · >= 0.0.0-0, < 0.38.0
crates.io juniper · Upgrade to 0.17.2 or later · >= 0.0.0-0, < 0.17.2 · GHSA-34cw-x8g7-rcv5
crates.io juniper_hyper · Upgrade to 0.10.1 or later · >= 0.0.0-0, < 0.10.1 · GHSA-pfrg-qg4f-grmv
PyPI mlflow · Upgrade to 3.17.0 or later · >= 3.10.0, < 3.17.0 · CVE-2026-116690 · GHSA-m65p-9j7q-6w33 · amended
PyPI mlflow · Upgrade to 3.17.0 or later · >= 3.12.0rc0, < 3.17.0 · CVE-2026-116692 · GHSA-26p8-2jq9-3vq9 · amended
npm dd-trace · Upgrade to 6.20.1 or 5.131.1 by release line · >= 2.0.0, < 5.131.1; >= 6.0.0, < 6.20.1 · CVE-2026-116693 · GHSA-x94g-w73q-hpcw · amended
data-mce-object serializationNuGet tinymce +2 · Upgrade all 3 to 8.9.3 or 7.9.4 by release line · >= 8.5.1, < 8.9.3; >= 7.9.3, < 7.9.4 · CVE-2026-116675 · GHSA-mf2p-h6hf-fcwm · amended
npm ckeditor5 +1 · Upgrade all 2 to 48.5.1 or 47.7.4 by release line · >= 45.0.0, < 47.7.4; >= 48.0.0, < 48.5.1 · CVE-2026-116688 · GHSA-rh54-vffm-5fvp · amended
Go github.com/runatlantis/atlantis · Upgrade to 0.47.1 or later · >= 0.4.0, < 0.47.1 · CVE-2026-116676 · GHSA-rjh2-4xgw-p2hj · amended
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260814233832-4126edeb07a0 (pre-release) or later · < 0.0.0-20260814233832-4126edeb07a0 · CVE-2026-116682 · GHSA-mgqf-5mf5-prfj · amended
npm undici · Upgrade to 8.12.2 or 7.30.1 by release line · >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109829 · GHSA-4w7w-5xrc-9h26 · amended
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 4.0.0, < 6.29.1; >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-109383 · GHSA-2m5v-pch6-74hx · amended
npm undici · Upgrade to 8.12.2, 7.30.1 or 6.29.1 by release line · >= 4.2.1, < 6.29.1; >= 7.0.0, < 7.30.1; >= 8.0.0, < 8.12.2 · CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm · amended
npm @modelcontextprotocol/sdk · Upgrade to 1.30.1 or later · >= 1.10.0, < 1.30.1 · +3 more packages · GHSA-f897-62hf-6gxq · amended
Packagist symfony/symfony +1 · Upgrade all 2 to 8.1.6, 7.4.18, 6.4.45 or 5.4.54 by release line · >= 2.0.0, < 5.4.54; >= 6.0.0, < 6.4.45; >= 7.0.0, < 7.4.18; >= 8.0.0, < 8.1.6 · CVE-2026-109413 · GHSA-2v3c-qxhr-7vpv · amended
Packagist symfony/symfony +1 · Upgrade all 2 to 8.1.7, 7.4.19, 6.4.46 or 5.4.54 by release line · >= 6.0.1, < 6.4.46; >= 7.0.0, < 7.4.19; >= 8.0.0, < 8.1.7; >= 4.1.0, < 5.4.54 · CVE-2026-108082 · GHSA-r925-mgvr-h9cc · amended
PyPI hydra-core · Upgrade to 1.4.0rc3 (pre-release) or 1.3.8 by release line · >= 1.3.6, < 1.3.8; >= 1.4.0.dev9, < 1.4.0rc3 · GHSA-wf6j-7hvr-gr93 · amended
npm undici · Upgrade to 8.11.2 or later · >= 8.11.0, < 8.11.2 · CVE-2026-109855 · GHSA-qq8j-7v2v-3rwp · amended
PyPI authlib · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.