tocsin
Security advisories, built for agents.
Your agent runs on Node, PHP, Python, Go, Rust, Ruby, Java, .NET, Elixir, Dart, Alpine, Debian and the packages on top of them. When one of them ships a critical fix, nothing tells the agent. Tocsin does. One feed. One command.
Why: your agent's fetch() was exploitable on October 21 and nothing told it.
npx tocsin connectWires Claude Code, Cursor, Claude Desktop and Codex to the feed in one run.
Or do it by hand:
curl "https://tocsin.sh/v1/events?since=0&min_severity=high"curl "https://tocsin.sh/v1/check?node=24.22.0&php=8.4.26"npx tocsin checkMCP: https://mcp.tocsin.sh/mcp
Latest
Updated · 10 of 10 sources ok
| when | component | CVE | severity | action |
|---|---|---|---|---|
| Hex/ash_postgres | CVE-2026-115627 | unknown | Upgrade ash_postgres to 2.15.2 or later. | |
| Hex/ash_postgres | CVE-2026-115635 | unknown | Upgrade ash_postgres to 2.15.2 or later. | |
| Hex/ash | CVE-2026-114214 | unknown | Upgrade ash to 3.37.1 or later. | |
| Debian/python3.15 | - | unknown | No fix published. Pin and monitor. | |
| Debian/python3.14 | - | unknown | No fix published. Pin and monitor. | |
| Debian/python3.13 | - | unknown | No fix published. Pin and monitor. | |
| Debian/python3.13 | - | unknown | No fix published. Pin and monitor. | |
| Debian/python3.11 | - | unknown | No fix published. Pin and monitor. | |
| Debian/libweb-simple-perl | - | unknown | No fix published. Pin and monitor. | |
| Debian/libweb-simple-perl | - | unknown | No fix published. Pin and monitor. |
Free. No account to read. An API key (free) for watch lists and signed webhooks.
Open source, Apache-2.0. github.com/Fortunian/tocsin
Built with Cromford.