@enclave-vm/core is vulnerable to Sandbox Escape
npm @enclave-vm/core · Upgrade to 2.11.1 or later · <= 2.10.1 · CVE-2026-27597 · GHSA-f229-3862-4942 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @enclave-vm/core · Upgrade to 2.11.1 or later · <= 2.10.1 · CVE-2026-27597 · GHSA-f229-3862-4942 · amended
password argument type and webhook JSON extraction bypasses shell safety checksGo github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260222101908-4bbd2eab1532 (pre-release) or later · < 0.0.0-20260222101908-4bbd2eab1532 · CVE-2026-27626 · GHSA-49gm-hh7w-wfvf
PyPI bugsink · Upgrade to 2.0.13 or later · < 2.0.13 · CVE-2026-27614 · GHSA-vp6q-7m36-pq3w · amended
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260221163904-dbcfba993b85 (pre-release) or later · < 0.0.0-20260221163904-dbcfba993b85 · CVE-2026-27611 · GHSA-8vrh-3pm2-v4v6
Go github.com/esm-dev/esm.sh · Upgrade to 0.0.0-20250616164159-0593516c4cfa (pre-release) or later · < 0.0.0-20250616164159-0593516c4cfa · CVE-2025-50180 · GHSA-3c9r-837r-qqm4
PyPI fickling · Upgrade to 0.1.8 or later · < 0.1.8 · GHSA-mxhj-88fx-4pcv · amended
Packagist statamic/cms · Upgrade to 6.7.1 or 5.73.10 by release line · < 5.73.10; >= 6.0.0-alpha.1, < 6.7.1 · CVE-2026-27593 · GHSA-jxq9-79vj-rgvw
Go github.com/gofiber/fiber/v3 · Upgrade to 3.1.0 or later · <= 3.0.0 · CVE-2026-25899 · GHSA-2mr3-m5q5-wgp6
Go github.com/gofiber/fiber/v3 · Upgrade to 3.1.0 or later · <= 3.0.0 · CVE-2026-25891 · GHSA-m3c2-496v-cw3v
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.1 or later · < 2.11.1 · CVE-2026-27590 · GHSA-5r3v-vc8m-m96g
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.1 or later · < 2.11.1 · CVE-2026-27588 · GHSA-x76f-jf84-rqj8
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.1 or later · < 2.11.1 · CVE-2026-27587 · GHSA-g7pc-pc7g-h8jh
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.1 or later · < 2.11.1 · CVE-2026-27586 · GHSA-hffm-g8v7-wrv7
npm @actual-app/sync-server · Upgrade to 26.2.1 or later · < 26.2.1 · CVE-2026-27584 · GHSA-m2cq-xjgm-f668 · amended
PyPI mindsdb · Upgrade to 25.9.1.1 or later · < 25.9.1.1 · CVE-2026-27483 · GHSA-4894-xqv6-vrfq · amended
npm @oneuptime/common · Upgrade to 10.0.0 or later · < 10.0.0 · CVE-2026-27574 · GHSA-v264-xqh4-9xmm · amended
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.3 or later · < 14.10.3 · CVE-2026-25989 · GHSA-7355-pwx2-pm84
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.3 or later · < 14.10.3 · CVE-2026-25985 · GHSA-v7g2-m8c5-mf84
NuGet magick.net-q8-arm64 +17 · Upgrade all 18 to 14.10.3 or later · < 14.10.3 · CVE-2026-25967 · GHSA-72hf-fj62-w6j4
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.3 or later · < 14.10.3 · CVE-2026-25965 · GHSA-8jvj-p28h-9gm7
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.3 or later · < 14.10.3 · CVE-2026-25794 · GHSA-vhqj-f5cj-9x8h
PyPI apache-superset · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2026-23984 · GHSA-mwf2-qr4v-94h2 · amended
PyPI apache-superset · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2026-23982 · GHSA-3m2g-v7jf-7fxc · amended
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 14.10.3 or later · < 14.10.3 · CVE-2026-24485 · GHSA-pqgj-2p96-rx85
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.10.3 or later · < 14.10.3 · CVE-2026-24481 · GHSA-96pc-27rx-pr36
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.