Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
HmacSha256.hash (despite the Hmac naming) computed a plain unkeyed digest; clarified by deprecation in favour of Sha256.hash / Sha256.hmacMaven org.http4k:http4k-core · Upgrade to 6.49.0.0 or later · < 6.49.0.0 · GHSA-m4w9-hjfw-vwj4
PyPI vcrpy · Upgrade to 8.2.1 or later · < 8.2.1 · GHSA-rpj2-4hq8-938g · amended
PyPI ultimate-sitemap-parser · Upgrade to 1.8.1 or later · <= 1.8.0 · GHSA-p5wc-9w9r-m232 · amended
PyPI ultimate-sitemap-parser · Upgrade to 1.8.1 or later · <= 1.8.0 · GHSA-8823-qg2x-pv9f · amended
npm tinacms · Upgrade to 3.9.3 or later · < 3.9.3 · +1 more package · CVE-2026-55660 · GHSA-g5qx-h5f3-mp2f · amended
Packagist craftcms/cms · Upgrade to 5.10 or 4.18 by release line · >= 5.0.0-RC1, < 5.10; >= 4.0.0-RC1, < 4.18 · CVE-2026-55791 · GHSA-c55v-343g-5xff
npm @tinacms/cli · Upgrade to 2.4.3 or later · < 2.4.3 · CVE-2026-54074 · GHSA-4936-9hrh-qqpw · amended
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-55691 · GHSA-7h5p-637f-jfr7
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-55690 · GHSA-c29q-5xm7-5p62
npm flat-to-nested · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-55091 · GHSA-hp36-v28f-w3r4 · amended
npm @cyclonedx/cyclonedx-npm · Upgrade to 5.0.0 or later · >= 2.1.0, < 5.0.0 · CVE-2026-55849 · GHSA-v75r-vx73-82pj · amended
Go github.com/0xERR0R/blocky · Upgrade to 0.32.0 or later · >= 0.28.0, < 0.32.0 · GHSA-x845-2f78-7v36
AtomicReference#update livelocks when the stored value is Float::NANRubyGems concurrent-ruby · Upgrade to 1.3.7 or later · < 1.3.7 · CVE-2026-54904 · GHSA-h8w8-99g7-qmvj
npm kozou +3 · Upgrade all 4 to 1.8.1 or later · <= 1.8.0 · GHSA-v52w-28xh-v562 · amended
NuGet corewcf.primitives · Upgrade to 1.9.1 or later · >= 1.9.0, < 1.9.1 · CVE-2026-54784 · GHSA-2288-8h3r-cqgg
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54783 · GHSA-gqv6-pwcg-87r8
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54782 · GHSA-xjr9-gg9q-jx3v
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54781 · GHSA-48pq-2xq3-c2m4
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54774 · GHSA-rpj7-hr7h-w6p9
NuGet corewcf.netframingbase · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54772 · GHSA-p86g-xrr2-pf7c
RubyGems oj · Upgrade to 3.17.3 or later · <= 3.17.2 · CVE-2026-54897 · GHSA-9ppp-w3g4-fh4q
RubyGems oj · Upgrade to 3.17.3 or later · < 3.17.3 · CVE-2026-54592 · GHSA-3m6q-jj5j-38c9
PyPI jupyterlab-git · Upgrade to 0.54.0 or later · <= 0.53.0 · CVE-2026-54528 · GHSA-436q-jwfr-rm2h · amended
PyPI jupyterlab-git +2 · Upgrade all 3 to 0.54.0 or later · >= 0.30.0b3, < 0.54.0 · CVE-2026-54527 · GHSA-f962-v9hr-pfg5 · amended
PyPI stanza · Upgrade to 1.12.2 or later · <= 1.12.1 · CVE-2026-54499 · GHSA-v5jw-96jm-7h2c · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.