Critical, CVSS 9.6
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
npm @zereight/mcp-gitlab · Upgrade to 2.1.27 or later · >= 0.0.1, < 2.1.27 · CVE-2026-61559 · GHSA-2h44-8472-frjj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1–19 of 19 matching · newest first
- Critical, CVSS 9.6
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
npm @zereight/mcp-gitlab · Upgrade to 2.1.30 or later · < 2.1.30 · CVE-2026-61568 · GHSA-vmp7-252j-cwp7 · amended
- High, CVSS 8.1
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
npm @zereight/mcp-gitlab · Upgrade to 2.1.30 or later · < 2.1.30 · GHSA-5648-rgj9-v224 · amended
- High, CVSS 7.5
emp3r0r has an unauthenticated HTTP Polling DoS
Go github.com/jm33-m0/emp3r0r/core · Upgrade to 0.0.0-20260531142011-aed3d81641ab (pre-release) or later · < 0.0.0-20260531142011-aed3d81641ab · CVE-2026-61554 · GHSA-4595-rvpx-4q34 · amended
- High, CVSS 7.5
Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.37 or later · <= 0.23.36 · +2 more packages · CVE-2026-88975 · GHSA-gq9p-f254-h286 · amended
- High, CVSS 8.2
libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
crates.io libp2p-quic · Upgrade to 0.13.1 or later · < 0.13.1 · CVE-2026-61544 · GHSA-5hq8-qhww-jm7q · amended
- Medium, CVSS 5.9
Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
Maven org.http4s:http4s-server_3 · Upgrade to 1.0.0-M47 (pre-release) or 0.23.35 by release line · <= 0.23.34; >= 1.0.0-M1, <= 1.0.0-M46 · +2 more packages · CVE-2026-69201 · GHSA-crq5-92j2-j7wv · amended
- High, CVSS 7.5
Http4s Ember HTTP/2: unbounded continuation frame accumulation
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69218 · GHSA-cp4q-fqw9-4hf6 · amended
- Medium, CVSS 5.4
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69216 · GHSA-jrpm-956j-96jg · amended
- Medium, CVSS 6.8
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
Maven org.http4s:http4s-client_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69215 · GHSA-grh8-3p95-f9rr · amended
- Medium, CVSS 6.8
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
Maven org.http4s:http4s-client_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69214 · GHSA-wv64-j4fq-5f9x · amended
- High, CVSS 7.5
Http4s Ember HTTP/2 has an unbounded outbound frame queue
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69213 · GHSA-8f3q-3jmv-7prw · amended
- High, CVSS 7.5
Http4s: DigestAuth nonce map grows unbounded
Maven org.http4s:http4s-ember-server_2.13 · Upgrade to 1.0.0-M47 (pre-release) or 0.23.35 by release line · <= 0.23.34; >= 1.0.0-M1, <= 1.0.0-M46 · +2 more packages · CVE-2026-69208 · GHSA-fm4g-76c9-7w69 · amended
- Medium, CVSS 5.9
Http4s: DigestAuth allows replay of captured requests
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69206 · GHSA-9xww-74xv-gjfp · amended
- High, CVSS 8.7
Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69205 · GHSA-9998-894r-fwvr · amended
- Critical, CVSS 9.2
Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69204 · GHSA-8h4c-x2wg-6xp8 · amended
- High, CVSS 7.5
Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69203 · GHSA-9vwc-pc8p-253q · amended
- High, CVSS 7.5
Http4s Ember HTTP/2: unbounded inbound body buffering
Maven org.http4s:http4s-ember-core_2.12 · Upgrade to 0.23.35 or later · <= 0.23.34 · +2 more packages · CVE-2026-69202 · GHSA-6m4x-pp6q-5jmm · amended
- Medium, CVSS 5.3
Netmaker has a boolean‑based SQL Injection
Go github.com/gravitl/netmaker · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-32599 · GHSA-r8cr-4f9w-7r75 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.