High, CVSS 7.5
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
Go github.com/github/github-mcp-server · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-47427 · GHSA-w4q6-qw23-4rg7 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
lettre has TLS hostname verification disabled when using Boring TLS backend
crates.io lettre · Upgrade to 0.11.22 or later · >= 0.10.1, < 0.11.22 · CVE-2026-46428 · GHSA-4pj9-g833-qx53 · amended
- High, CVSS 8.6
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
Packagist wp-coding-standards/wpcs · Upgrade to 3.4.1 or later · >= 0.14.1, < 3.4.1 · CVE-2026-45293 · GHSA-3pwp-g2mj-5p3v · amended
- High, CVSS 8.2
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Maven io.appium:java-client · Upgrade to 10.1.1 or later · >= 8.2.1, <= 10.1.0 · CVE-2026-43910 · GHSA-28f5-38xr-jh2w · amended
- High, CVSS 8.5
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260419162744-978ac87deffe (pre-release) or later · < 0.0.0-20260419162744-978ac87deffe · CVE-2026-43983 · GHSA-w6p7-2fxx-4f44 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.