Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
crates.io mise · Upgrade to 2026.3.10 or later · < 2026.3.10 · CVE-2026-33646 · GHSA-fjj5-v948-whjj
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
crates.io mise · Upgrade to 2026.3.10 or later · < 2026.3.10 · CVE-2026-33646 · GHSA-fjj5-v948-whjj
Go gogs.io/gogs · Upgrade to 0.14.3 or later · <= 0.14.2 · CVE-2026-25119 · GHSA-w6j9-vw59-27wv
PyPI pycti · Upgrade to 6.8.16 or later · < 6.8.16 · CVE-2026-21887 · GHSA-ffm6-vvph-g5f5 · amended
Packagist paymenter/paymenter · Upgrade to 1.2.11 or later · < 1.2.11 · CVE-2025-58048 · GHSA-5pm9-r2m8-rcmj
PyPI doris-mcp-server · Upgrade to 0.6.1 or later · < 0.6.1 · CVE-2025-66336 · GHSA-pqrj-4gwg-h5f7 · amended
Maven org.apache.nifi:nifi-web-api · Upgrade to 2.9.0 or later · >= 1.12.0, < 2.9.0 · CVE-2026-44914 · GHSA-r2g5-993q-664g
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.