Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Packagist web-token/jwt-library +1 · Upgrade all 2 to 4.1.7, 4.0.7 or 3.4.10 by release line · < 3.4.10; >= 4.0.0, < 4.0.7; >= 4.1.0, < 4.1.7 · GHSA-3prj-6hqw-cm82
Packagist spomky-labs/otphp · Upgrade to 11.4.3 or later · < 11.4.3 · GHSA-g7m4-839x-ch6v
npm gemini-mcp-tool · Upgrade to 1.1.6 or later · >= 1.1.2, < 1.1.6 · CVE-2026-0755 · GHSA-4h5r-5jm8-jxjm · amended
npm openclaw · Upgrade to 2026.5.2 or later · < 2026.5.2 · CVE-2026-53865 · GHSA-rx78-29qr-5hq8 · amended
npm openclaw · Upgrade to 2026.5.2 or later · < 2026.5.2 · CVE-2026-53858 · GHSA-wc84-j36w-pw4x · amended
npm openclaw · Upgrade to 2026.5.7 or later · <= 2026.5.6 · CVE-2026-53849 · GHSA-cw4q-gqg5-g38h · amended
npm openclaw · Upgrade to 2026.4.29 or later · < 2026.4.29 · CVE-2026-53846 · GHSA-24vr-rprv-67rf · amended
npm openclaw · Upgrade to 2026.5.12 or later · < 2026.5.12 · CVE-2026-53853 · GHSA-v2ww-5rh7-2h5v · amended
npm openclaw · Upgrade to 2026.5.3 or later · <= 2026.5.2 · CVE-2026-53857 · GHSA-8c59-hr4w-qg69 · amended
npm openclaw · Upgrade to 2026.4.2 or later · < 2026.4.2 · CVE-2026-53855 · GHSA-5cj2-3jr2-5h77 · amended
npm @theia/workspace +2 · Upgrade all 3 to 1.69.0 or later · < 1.69.0 · CVE-2026-44691 · GHSA-g9jw-92q7-g7fj · amended
npm @theia/ai-code-completion +5 · Upgrade all 6 to 1.71.0 or later · < 1.71.0 · CVE-2026-46580 · GHSA-m973-pr9r-hp2w · amended
npm @theia/ai-code-completion +6 · Upgrade all 7 to 1.71.0 or later · < 1.71.0 · CVE-2026-44688 · GHSA-3jww-hxqj-wfq2 · amended
PyPI crawl4ai · Upgrade to 0.9.0 or later · <= 0.8.9 · CVE-2026-57573 · GHSA-wm69-2pc3-rmmf · amended
PyPI crawl4ai · Upgrade to 0.9.0 or later · <= 0.8.9 · CVE-2026-57572 · GHSA-r253-r9jw-qg44 · amended
PyPI crawl4ai · Upgrade to 0.9.0 or later · <= 0.8.9 · CVE-2026-57571 · GHSA-2jq4-q6vv-4cp3 · amended
npm budibase · Upgrade to 3.39.19 or later · < 3.39.19 · CVE-2026-64657 · GHSA-qqf5-x7mj-v43p · amended
npm @acastellon/auth · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2026-58399 · GHSA-gfj5-979r-92pw · amended
PyPI netlicensing-mcp · Upgrade to 0.1.8 or later · < 0.1.8 · CVE-2026-57496 · GHSA-hxpf-9xvq-wph8 · amended
npm @agenticmail/claudecode · Upgrade to 0.2.39 or later · < 0.2.39 · +3 more packages · CVE-2026-57495 · GHSA-fq4x-789w-jg5h · amended
npm @agenticmail/api · Upgrade to 0.9.64 or later · < 0.9.64 · CVE-2026-57494 · GHSA-hjwc-26pj-v3pm · amended
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-11719 · GHSA-5gf6-gc35-xjpc
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-11718 · GHSA-wcpr-6g7x-p44r
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-11717 · GHSA-8fcc-w5hv-4gxv
/ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SIDPyPI pipecat-ai · Upgrade to 1.4.0 or later · >= 0.0.77, < 1.4.0 · CVE-2026-54695 · GHSA-j8cv-x86q-rj85 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.