MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-11720 · GHSA-vwxw-jrg6-9jxv · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–57 of 57 matching · newest first
Go github.com/googleapis/mcp-toolbox · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2026-11720 · GHSA-vwxw-jrg6-9jxv · amended
Go code.gitea.io/gitea · Upgrade to 1.26.0 or later · < 1.26.0 · CVE-2026-27780 · GHSA-vhq7-fwwh-7hjf · amended
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-25782 · GHSA-qm72-8prh-g92x · amended
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-27660 · GHSA-x92v-f5gc-r34v · amended
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-27779 · GHSA-v8f2-2ghq-9whv · amended
Go code.gitea.io/gitea · Upgrade to 1.25.5 or later · < 1.25.5 · CVE-2026-26292 · GHSA-rc56-rj3f-xggf · amended
Maven org.freemarker:freemarker · Upgrade to 2.3.35 or later · >= 2.2.0, <= 2.3.34 · CVE-2026-84939 · GHSA-27j2-h3m2-8237 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.