Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-50137 · GHSA-35c4-rvc8-frhm · amended
PyPI vllm · Upgrade to 0.22.1 or later · < 0.22.1 · CVE-2026-54232 · GHSA-jrf6-vqxq-pjv2
npm @budibase/server · Upgrade to 3.39.2 or later · < 3.39.2 · CVE-2026-50136 · GHSA-jj36-r9w3-3pfh · amended
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-50132 · GHSA-v7j5-vc4m-723w · amended
npm scim-patch · Upgrade to 0.9.1 or later · <= 0.9.0 · CVE-2026-48170 · GHSA-9m6g-wc8r-q59c · amended
npm @budibase/server · Upgrade to 3.39.0 or later · < 3.39.0 · CVE-2026-48153 · GHSA-4q6h-8p4v-67vq · amended
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-47267 · GHSA-c4v7-xg93-qf8g
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46608 · GHSA-87qc-fj39-wccr · amended
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46607 · GHSA-9837-48hr-q32j · amended
PyPI glances · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2026-46606 · GHSA-v5r2-qh84-fjx5 · amended
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 5.1.1 or later · <= 5.1.0 · CVE-2026-46495 · GHSA-43x2-g84q-fmqx
PyPI motioneye · Upgrade to 0.44.0 or later · < 0.44.0 · CVE-2026-46488 · GHSA-r3cw-c95m-wfh9 · amended
Maven io.spinnaker.rosco:rosco-core +1 · Upgrade all 2 to 2026.0.3, 2025.4.4 or 2025.3.3 by release line · < 2025.3.3; >= 2025.4.0, < 2025.4.4; >= 2026.0.0, < 2026.0.3 · CVE-2026-44795 · GHSA-c8q4-9h32-2ww8
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.1 or later · >= 13.0.0, < 16.1.1 · CVE-2026-44203 · GHSA-fq9h-c788-fx73 · amended
Maven com.xwiki.pro:xwiki-pro-macros · Upgrade to 1.14.5 or later · >= 1.13, < 1.14.5 · CVE-2026-44179 · GHSA-w56x-9778-rppx
_queryId ParameterMaven org.openidentityplatform.openam:openam-core-rest · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-41573 · GHSA-2vg8-q4c2-5cw3 · amended
PyPI comfyui-manager · Upgrade to 3.38 or later · < 3.38 · CVE-2025-67303 · GHSA-95pq-hr8p-f5g7 · amended
Packagist wwbn/avideo · Upgrade to 29.0 or later · < 29.0 · CVE-2026-33692 · GHSA-wf69-r4mx-43rr
PyPI chainlit · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2026-56104 · GHSA-c39v-8hrw-h448 · amended
crates.io mise · Upgrade to 2026.3.10 or later · < 2026.3.10 · CVE-2026-33646 · GHSA-fjj5-v948-whjj
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-25119 · GHSA-w6j9-vw59-27wv
PyPI pycti · Upgrade to 6.8.16 or later · < 6.8.16 · CVE-2026-21887 · GHSA-ffm6-vvph-g5f5 · amended
Packagist paymenter/paymenter · Upgrade to 1.2.11 or later · < 1.2.11 · CVE-2025-58048 · GHSA-5pm9-r2m8-rcmj
PyPI doris-mcp-server · Upgrade to 0.6.1 or later · < 0.6.1 · CVE-2025-66336 · GHSA-pqrj-4gwg-h5f7 · amended
Maven org.apache.nifi:nifi-web-api · Upgrade to 2.9.0 or later · >= 1.12.0, < 2.9.0 · CVE-2026-44914 · GHSA-r2g5-993q-664g
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.