Low, CVSS 2.1
MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler
PyPI mysql-mcp-server · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-11529 · GHSA-mvq4-39wx-6h5g · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–33 of 33 matching · newest first
- Medium, CVSS 4.8
actual Allows Electron to Run As Node
npm actual · Upgrade to 26.5.0 or later · < 26.5.0 · CVE-2026-42890 · GHSA-7rvm-xjpp-63r9 · amended
- Medium, CVSS 5.4
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
PyPI authlib · Upgrade to 1.7.1 or 1.6.10 by release line · < 1.6.10; >= 1.7.0, <= 1.7.0 · CVE-2026-41479 · GHSA-w8p2-r796-3vmq · amended
- High, CVSS 8.2
Routinator crashes when sending a maliciously crafted select-asn query parameter
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49234 · GHSA-gc6q-cwcj-3vh9
- High, CVSS 8.7
Routinator crashes when encountering maliciously crafted RRDP XML files
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49235 · GHSA-5qf9-cf9c-hjc6
- High, CVSS 8.3
Routinator has cache path traversal when processing the module component of rsync URIs
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49233 · GHSA-33mj-99mg-8g73
- Medium, CVSS 5.3
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
PyPI geonode · Upgrade to 5.0.2 or 4.4.5 by release line · >= 4.0.0, < 4.4.5; >= 5.0.0, < 5.0.2 · CVE-2026-39922 · GHSA-hw9r-6m78-w6h3 · amended
- Critical, CVSS 9.5
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
npm cordova-plugin-inappbrowser · Upgrade to 6.0.1 or later · < 6.0.1 · CVE-2026-47430 · GHSA-q42j-x8rq-pjg6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.