High, CVSS 7.4
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77246 · GHSA-wv8v-v4c5-v75j · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77248 · GHSA-cc5h-2pwp-pvcc · amended
- High, CVSS 7.5
SIPGO: DoS via unvalidated WebSocket frame length
Go github.com/emiago/sipgo · Upgrade to 1.4.3 or later · <= 1.4.2 · CVE-2026-77322 · GHSA-8h6x-h86x-75wh · amended
- High, CVSS 7.5
MPXJ: XXE Vulnerability in MerlinReader
RubyGems mpxj +6 · Upgrade all 7 to 16.4.1 or later · >= 5.5.5, < 16.4.1 · CVE-2026-61570 · GHSA-5vvx-3h34-f3gj · amended
- High, CVSS 7.5
SIPGO: DoS via unvalidated Content-Length in the stream parser
Go github.com/emiago/sipgo · Upgrade to 1.4.1 or later · <= 1.4.0 · CVE-2026-58268 · GHSA-pg59-5vwg-4jxq · amended
- High, CVSS 8.8
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
npm @deepstream/server · Upgrade to 10.1.1 or later · >= 10.1.0, <= 10.1.0 · CVE-2026-63116 · GHSA-89vx-jh4q-vg3w · amended
- High, CVSS 7.5
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
npm request-filtering-agent · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2026-62985 · GHSA-r3r9-wp5j-pq5g · amended
- High, CVSS 7.5
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry
PyPI psd-tools · Upgrade to 1.17.4 or later · < 1.17.4 · CVE-2026-59991 · GHSA-8q6g-vjhf-jp8m · amended
- High, CVSS 7.3
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
npm 9router · Upgrade to 0.5.8 or later · <= 0.5.4 · CVE-2026-56681 · GHSA-5mj8-gf6m-fhw8 · amended
- High, CVSS 8.1
Sync-in Server has a complete 2FA Bypass via
POST /api/auth/tokennpm @sync-in/server · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-58269 · GHSA-92cr-jxw4-5wjg · amended
- High, CVSS 7.1
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
npm @roomi-fields/notebooklm-mcp · Upgrade to 2.0.3 or later · >= 1.6.0, < 2.0.3 · CVE-2026-61647 · GHSA-jjhp-8crj-mppq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.