@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82860 · GHSA-4xrh-5m3m-328w · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82860 · GHSA-4xrh-5m3m-328w · amended
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82861 · GHSA-g43v-9x7q-83pq · amended
npm @hulumi/drift · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82858 · GHSA-2ffm-hxrq-qqmm · amended
npm mcp-server-kubernetes · Upgrade to 3.6.0 or later · < 3.6.0 · CVE-2026-46519 · GHSA-cr22-wjx7-2w6m · amended
crates.io p3-challenger · Upgrade to 0.5.3 or 0.4.3 by release line · < 0.4.3; >= 0.5.0, < 0.5.3 · CVE-2026-46654 · GHSA-vj64-rjf3-w3v7
Go github.com/fission/fission · Upgrade to 1.23.0 or later · <= 1.22.0 · CVE-2026-46617 · GHSA-85g2-pmrx-r49q
Go github.com/fission/fission · Upgrade to 1.23.0 or later · <= 1.22.0 · CVE-2026-46614 · GHSA-3g33-6vg6-27m8
Go github.com/fission/fission · Upgrade to 1.23.0 or later · <= 1.22.0 · CVE-2026-46612 · GHSA-chf8-4hv6-8pg6
crates.io nimiq-primitives · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-46545 · GHSA-mw3q-r9wh-h2ff
PyPI lmdeploy · Upgrade to 0.13.0 or later · <= 0.12.3 · CVE-2026-46517 · GHSA-9xq9-36w5-q796 · amended
PyPI pyfory · Upgrade to 1.0.0 or later · >= 0.13.0, < 1.0.0 · CVE-2026-48207 · GHSA-m5gw-83w2-7749 · amended
npm md-fileserver · Upgrade to 1.10.3 or later · < 1.10.3 · CVE-2026-46492 · GHSA-32q2-hhr5-6qvv · amended
PyPI sagemaker · Upgrade to 3.8.0 or 2.257.2 by release line · >= 2.199.0, <= 2.257.1; >= 3.0.0, <= 3.7.1 · CVE-2026-8596 · GHSA-7hh5-prp2-mfh5 · amended
PyPI lmdeploy · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2026-46432 · GHSA-m549-qq94-fvhg · amended
npm samlify · Upgrade to 2.13.0 or later · < 2.13.0 · CVE-2026-46490 · GHSA-34r5-q4jw-r36m · amended
PyPI windows-mcp · Upgrade to 0.7.5 or later · < 0.7.5 · CVE-2026-48989 · GHSA-vrxg-gm77-7q5g · amended
Maven org.open-metadata:openmetadata-service · Upgrade to 1.12.4 or later · < 1.12.4 · CVE-2026-46481 · GHSA-9vmh-whc4-7phg
Go github.com/apache/camel-k/v2 · Upgrade to 2.10.1, 2.9.2 or 2.8.1 by release line · < 2.8.1; >= 2.9.0, < 2.9.2; >= 2.10.0, <= 2.10.0 · CVE-2026-45760 · GHSA-q8ch-jx67-q52x
Go github.com/mattermost/mattermost-server · Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line · >= 11.6.0, <= 11.6.0; >= 11.5.0, < 11.5.4; >= 11.4.0, < 11.4.5; >= 10.11.0, < 10.11.15 · CVE-2026-4858 · GHSA-c4r7-j7pp-r8mp
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.