MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
PyPI stata-mcp · Upgrade to 1.17.3 or later · < 1.17.3 · CVE-2026-47708 · GHSA-4p62-hqp5-g644 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
PyPI stata-mcp · Upgrade to 1.17.3 or later · < 1.17.3 · CVE-2026-47708 · GHSA-4p62-hqp5-g644 · amended
npm @cap-js/openapi · Upgrade to 1.4.2 or later · >= 1.4.1, <= 1.4.1 · GHSA-jpvj-wpmj-h7rv · amended
Maven org.apache.fory:fory-core · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-50076 · GHSA-8f39-v287-78jf
Go github.com/klever-io/klever-go · Upgrade to 1.7.17 or later · < 1.7.17 · GHSA-74m6-4hjp-7226
npm react-router · Upgrade to 7.14.0 or later · >= 7.0.0, < 7.14.0 · +1 more package · CVE-2026-34077 · GHSA-rxv8-25v2-qmq8 · amended
Go github.com/nuclio/nuclio · Upgrade to 0.0.0-20260513101907-1915cd26d514 (pre-release) or later · < 0.0.0-20260513101907-1915cd26d514 · CVE-2026-45730 · GHSA-m8xg-8xg9-mxhm
npm better-auth · Upgrade to 1.6.11 or later · >= 1.6.0, < 1.6.11 · CVE-2026-45337 · GHSA-cq3f-vc6p-68fh · amended
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44496 · GHSA-hfxv-24rg-xrqf · amended
npm axios · Upgrade to 1.16.0 or later · >= 1.7.0, < 1.16.0 · CVE-2026-44488 · GHSA-777c-7fjr-54vf · amended
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44487 · GHSA-p92q-9vqr-4j8v · amended
npm axios · Upgrade to 1.16.0 or 0.32.0 by release line · >= 1.0.0, < 1.16.0; <= 0.31.1 · CVE-2026-44486 · GHSA-j5f8-grm9-p9fc · amended
PyPI mistral · Upgrade to 20.1.1; some affected versions have no fix yet · >= 20.0.0, < 20.1.1; >= 21.0.0, <= 21.0.0; >= 22.0.0, <= 22.0.0 · CVE-2026-41283 · GHSA-9hfw-w3f4-c4p8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.