High, CVSS 8.7
logto-tunnel serves files outside --experience-path via path traversal
npm @logto/tunnel · Upgrade to 0.3.9 or later · < 0.3.9 · CVE-2026-63188 · GHSA-rxjr-6c9q-h67x · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
logto-tunnel serves files outside
- High, CVSS 8.2
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Packagist getgrav/grav · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2026-62230 · GHSA-vwg3-w8w3-pc79 · amended
- High, CVSS 7.1
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
Packagist snipe/snipe-it · Upgrade to 8.6.3 or later · < 8.6.3 · CVE-2026-55694 · GHSA-3hgv-jr5j-cg9x
- High, CVSS 7.6
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
Packagist snipe/snipe-it · Upgrade to 8.6.3 or later · < 8.6.3 · CVE-2026-55643 · GHSA-c6w2-j4wq-mvwg
- High, CVSS 7.2
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
Maven org.geoserver:gs-main +2 · Upgrade all 3 to 2.27.0 or later · < 2.27.0 · CVE-2024-45747 · GHSA-wf6j-gr27-g7ch · amended
- High, CVSS 7.1
XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing
Maven org.xwiki.platform:xwiki-platform-livedata-livetable · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.4, 17.4.10 or 16.10.17 by release line · >= 13.4-rc-1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.10; >= 17.5.0-rc-1, < 17.10.4; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-53966 · GHSA-45ph-gxxr-gwgw · amended
- High, CVSS 8.7
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
Packagist mcp/sdk · Upgrade to 0.7.1 or later · >= 0.5.0, < 0.7.1 · CVE-2026-53965 · GHSA-7m52-jw36-44r3 · amended
- High, CVSS 7.2
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
PyPI document-merge-service · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-53964 · GHSA-w47q-945m-q9pc
- High, CVSS 7.7
Contentful MCP Server: export_space/import_space tools pass LLM-controlled
host/proxyargs to CMA client, redirecting server PAT to attacker-controlled endpointnpm @contentful/mcp-tools · Upgrade to 0.4.5 or later · < 0.4.5 · +1 more package · CVE-2026-53957 · GHSA-2xhg-73j7-rrgx · amended
- High, CVSS 8.8
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
PyPI copier · Upgrade to 9.15.2 or later · >= 9.5.0, <= 9.15.1 · CVE-2026-53951 · GHSA-9gmc-jqmh-3rvm
- High, CVSS 7.5
claude-faf-mcp has an arbitrary local file read/write via unconfined
pathargument in FAF toolsnpm claude-faf-mcp · Upgrade to 5.7.2 or later · <= 5.7.1 · GHSA-rr55-jp92-8wp2
- High, CVSS 7.5
faf-mcp has an arbitrary local file read/write via unconfined
pathargument in FAF toolsnpm faf-mcp · Upgrade to 2.1.3 or later · <= 2.1.2 · GHSA-j4r7-8ph4-43g3
- High, CVSS 7.5
grok-faf-mcp has an arbitrary local file read via unconfined
pathargument in FAF toolsnpm grok-faf-mcp · Upgrade to 1.5.3 or later · <= 1.5.2 · GHSA-cc2g-gq8c-r332
A vendor fix does not resolve your finding until you verify it in your own systems.