9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
npm 9router · Upgrade to 0.5.2 or later · <= 0.4.80 · CVE-2026-56675 · GHSA-x5c9-v98j-722r · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
26–37 of 37 matching · newest first
npm 9router · Upgrade to 0.5.2 or later · <= 0.4.80 · CVE-2026-56675 · GHSA-x5c9-v98j-722r · amended
HISTORY_IGNORE Configuration VariableMaven org.jline:jline-reader · Upgrade to 4.3.1 or 3.30.15 by release line · >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.30.15 · CVE-2026-77420 · GHSA-5q95-hrpc-m3w3 · amended
Maven io.moquette:moquette-broker · Upgrade to 0.18.1 or later · <= 0.18.0 · CVE-2026-85724 · GHSA-5f42-97gr-vfhq · amended
Packagist solspace/craft-freeform · Upgrade to 5.10.14 or later · >= 5.0.0, <= 5.10.13 · CVE-2026-73858 · GHSA-gxrg-x694-283w · amended
Packagist redaxo/source · Upgrade to 5.21.2 or later · <= 5.21.1 · CVE-2026-63000 · GHSA-m8r3-22v6-g877 · amended
Packagist redaxo/source · Upgrade to 5.21.2 or later · <= 5.21.1 · CVE-2026-63002 · GHSA-w998-qmw9-mf4m · amended
mediaIsInUse()Packagist redaxo/source · Upgrade to 5.21.2 or later · <= 5.21.1 · CVE-2026-63001 · GHSA-mf2p-wjp4-99pq · amended
PyPI zapros · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2026-61541 · GHSA-5vjj-2r48-q622 · amended
PyPI zapros · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2026-61652 · GHSA-6cp7-3m3c-5x5c · amended
PyPI plone-app-portlets · Upgrade to 7.0.2, 6.0.4 or 5.0.8 by release line · >= 7.0.0, <= 7.0.1; >= 6.0.0, <= 6.0.3; >= 5.0.0, <= 5.0.7 · CVE-2026-57149 · GHSA-rr49-f9g6-c9r5 · amended
crates.io rustpython-vm · Upgrade to 0.6.0 or later · >= 0.3.0, < 0.6.0
uncbv: archive extraction is vulnerable to path traversal (zip-slip)crates.io uncbv · Upgrade to 0.3.1 or later · >= 0.0.0-0, < 0.3.1
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.