Low, CVSS 2.9
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
Go github.com/stacklok/toolhive · Upgrade to 0.31.0 or later · < 0.31.0 · CVE-2026-58196 · GHSA-pr64-jmmf-jp54
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–25 of 42 matching · newest first
- High, CVSS 8.8
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
npm @andrea9293/mcp-documentation-server · Upgrade to 1.13.1 or later · >= 1.13.0, <= 1.13.0 · CVE-2026-54504 · GHSA-6f5r-5672-72j7 · amended
- High, CVSS 8.7
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
npm systeminformation · Upgrade to 5.31.7 or later · <= 5.31.6 · CVE-2026-50289 · GHSA-5xpp-75jx-m839 · amended
- High, CVSS 7.5
Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
Go github.com/pomerium/pomerium · Upgrade to 0.32.8 or later · >= 0.32.6, < 0.32.8 · CVE-2026-50285 · GHSA-ggw3-5987-rx77
- High, CVSS 7.5
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
RubyGems datadog · Upgrade to 2.32.0 or later · < 2.32.0 · CVE-2026-50276 · GHSA-p5f6-rccc-jv98
- High, CVSS 7.5
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
NuGet datadog.trace.opentracing +1 · Upgrade all 2 to 3.43.0 or later · < 3.43.0 · CVE-2026-50273 · GHSA-38wr-vpc7-2mp4
- High, CVSS 7.5
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
npm dd-trace · Upgrade to 5.100.0 or later · < 5.100.0 · CVE-2026-50272 · GHSA-wxqq-gcq8-c443 · amended
- High, CVSS 7.5
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
PyPI ddtrace · Upgrade to 4.8.2 or later · < 4.8.2 · CVE-2026-50271 · GHSA-mw54-j2v2-42hr · amended
- High, CVSS 7.5
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Maven com.datadoghq:dd-java-agent · Upgrade to 1.62.0 or later · < 1.62.0 · CVE-2026-50270 · GHSA-74xj-wh4w-vqxc
- Medium, CVSS 6.8
ViewComponent: Reused Component Instances Retain Stale Render Context
RubyGems view_component · Upgrade to 4.12.0 or later · >= 4.0.0, < 4.12.0 · CVE-2026-54497 · GHSA-9h85-g7w3-rh49
- High, CVSS 8.7
ViewComponent: around_render HTML-Safety Bypass
RubyGems view_component · Upgrade to 4.12.0 or later · >= 4.0.0, < 4.12.0 · CVE-2026-54498 · GHSA-97jw-64cj-jc58
- High, CVSS 8.7
django-haystack: Remote Code Execution via
eval()in Elasticsearch Result DeserializationPyPI django-haystack · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-105315 · GHSA-r3hx-x5rh-p9vv · amended
- Medium, CVSS 5.1
serde_with: KeyValueMap serialization panics on empty sequence or map entries
crates.io serde_with · Upgrade to 3.21.0 or later · >= 2.3.0, < 3.21.0 · GHSA-7gcf-g7xr-8hxj
- Medium, CVSS 6.3
websocket-driver: Resource limit bypass via message compression
npm websocket-driver · Upgrade to 0.7.5 or later · < 0.7.5 · CVE-2026-54490 · GHSA-mp7j-qc5w-4988 · amended
- Critical, CVSS 9.2
websocket-driver: Message corruption via abuse of protocol length headers
npm websocket-driver · Upgrade to 0.7.5 or later · < 0.7.5 · CVE-2026-54466 · GHSA-xv26-6w52-cph6 · amended
- Medium, CVSS 6.3
websocket-driver: Memory exhaustion in HTTP header parser
RubyGems websocket-driver · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-54465 · GHSA-8j3g-f24p-4mpw
- Medium, CVSS 6.3
websocket-driver: Resource limit bypass via message compression
RubyGems websocket-driver · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-54464 · GHSA-33ph-fccm-39pj
- Medium, CVSS 6.9
websocket-driver: Memory exhaustion via abuse of protocol length headers
RubyGems websocket-driver · Upgrade to 0.8.1 or later · < 0.8.1 · CVE-2026-54463 · GHSA-ghhp-3qvg-889p
- Medium, CVSS 6.9
Pixeldrain API key shared with unverified thirdparty sites
PyPI cyberdrop-dl-patched · Upgrade to 9.14.0 or later · >= 8.5.0, < 9.14.0 · CVE-2026-54254 · GHSA-f5pf-q7c7-m3vv · amended
- High, CVSS 7.7
TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint
PyPI tensorzero · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-54457 · GHSA-824w-x939-6cmc · amended
- Medium, CVSS 6.9
safeurl is Missing IPv6 CIDR Ranges in Blocklist
Go github.com/doyensec/safeurl · Upgrade to 0.2.4 or later · < 0.2.4 · CVE-2026-54452 · GHSA-xgch-x3mx-cm3c
- Medium, CVSS 6.3
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
PyPI fiftyone · Upgrade to 1.17.0 or later · < 1.17.0 · CVE-2026-53656 · GHSA-q78p-hj9h-5466 · amended
- High, CVSS 8.8
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
npm obsidian-local-rest-api · Upgrade to 4.1.3 or later · < 4.1.3 · GHSA-62gx-5q78-wrvx · amended
- Low, CVSS 2.9
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
Go github.com/stacklok/toolhive · Upgrade to 0.29.1 or later · <= 0.29.0 · CVE-2026-54450 · GHSA-pph6-vfjv-vpjw
- High, CVSS 8.6
MantisBT: Stored XSS in print_all_bug_page_word.php
Packagist mantisbt/mantisbt · Upgrade to 2.28.4 or later · <= 2.28.3 · CVE-2026-62944 · GHSA-h2wf-967x-gxvw
A vendor fix does not resolve your finding until you verify it in your own systems.