tocsin

Security advisories, built for agents.

Your agent runs on Node, PHP, Python, Go, Rust, Ruby, Java, .NET, Elixir, Dart, Alpine, Debian and the packages on top of them. When one of them ships a critical fix, nothing tells the agent. Tocsin does. One feed. One command.

Why: your agent's fetch() was exploitable on October 21 and nothing told it.

npx tocsin connect

Add to Cursor Add to VS Code

Wires Claude Code, Cursor, Claude Desktop and Codex to the feed in one run.

Or do it by hand:

curl "https://tocsin.sh/v1/events?since=0&min_severity=high"

curl "https://tocsin.sh/v1/check?node=24.22.0&php=8.4.26"

npx tocsin check

MCP: https://mcp.tocsin.sh/mcp

Latest

Updated 1 minute ago · 10 of 10 sources ok

when	component	CVE	severity	action
2026-10-24	bun/bun	-	high	Upgrade bun to 1.4.4 or later.
2026-10-23	Debian/rust-wasmtime	-	unknown	No fix published. Pin and monitor.
2026-10-23	Debian/rust-wasmtime	-	unknown	No fix published. Pin and monitor.
2026-10-23	PyPI/filelock	CVE-2026-112937	medium	Upgrade filelock to 4.2.1 or later.
2026-10-23	PyPI/filelock	CVE-2026-112913	low	Upgrade filelock to 4.2.1 or later.
2026-10-23	PyPI/filelock	CVE-2026-112907	low	Upgrade filelock to 4.2.1 or later.
2026-10-23	PyPI/virtualenv	CVE-2026-113713	medium	Upgrade virtualenv to 21.14.10 or later.
2026-10-23	npm/@azure/msal-node	CVE-2026-109461	high	Upgrade @azure/msal-node to 7.1.0 or later.
2026-10-23	npm/undici	CVE-2026-109869	high	Upgrade undici to 6.29.1 (6.x), 7.30.1 (7.x) or 8.12.2 (8.x) or later.
2026-10-23	npm/undici	CVE-2026-109924	medium	Upgrade undici to 6.29.1 (6.x), 7.30.1 (7.x) or 8.12.2 (8.x) or later.

Free. No account to read. An API key (free) for watch lists and signed webhooks.

Open source, Apache-2.0. github.com/Fortunian/tocsin
Built with Cromford.