coursevault-preview has a path traversal due to improper base-directory boundary validation
npm coursevault-preview · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-35613 · GHSA-9h9m-rr67-9jpg · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
8101–8125 of 31,057 matching · newest first
npm coursevault-preview · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-35613 · GHSA-9h9m-rr67-9jpg · amended
RubyGems addressable · Upgrade to 2.9.0 or later · >= 2.3.0, < 2.9.0 · CVE-2026-35611 · GHSA-h27x-rffw-24p4
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.1 or later · < 2.63.1 · CVE-2026-35607 · GHSA-7526-j432-6ppp
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.1 or later · < 2.63.1 · CVE-2026-35606 · GHSA-67cg-cpj7-qgc9
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.1 or later · < 2.63.1 · CVE-2026-35604 · GHSA-v9w4-gm2x-6rvf
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.1 or later · < 2.63.1 · CVE-2026-35605 · GHSA-5q48-q4fm-g3m6
PyPI pyload-ng · Upgrade to 0.5.0b3.dev97 (pre-release) or later · < 0.5.0b3.dev97 · CVE-2026-35592 · GHSA-mvwx-582f-56r7 · amended
PyPI pyload-ng · Upgrade to 0.5.0b3.dev97 (pre-release) or later · < 0.5.0b3.dev97 · CVE-2026-35586 · GHSA-ppvx-rwh9-7rj7 · amended
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.33.8 or later · < 2.33.8 · CVE-2026-35585 · GHSA-jvpw-637p-h3pw
PyPI litellm · Upgrade to 1.83.0 or later · < 1.83.0 · GHSA-69x8-hrgq-fjj8 · amended
Go stdlib · Upgrade to 1.26.2 or later · >= 1.26.0-0, < 1.26.2 · CVE-2026-33810
Go stdlib · Upgrade to 1.26.2 or 1.25.9 by release line · < 1.25.9; >= 1.26.0-0, < 1.26.2 · CVE-2026-32283
Go stdlib · Upgrade to 1.26.2 or 1.25.9 by release line · < 1.25.9; >= 1.26.0-0, < 1.26.2 · CVE-2026-32280
Go toolchain · Upgrade to 1.26.2 or 1.25.9 by release line · < 1.25.9; >= 1.26.0-0, < 1.26.2 · CVE-2026-27144
Go stdlib · Upgrade to 1.26.2 or 1.25.9 by release line · < 1.25.9; >= 1.26.0-0, < 1.26.2 · CVE-2026-32282
Go toolchain · Upgrade to 1.26.2 or 1.25.9 by release line · < 1.25.9; >= 1.26.0-0, < 1.26.2 · CVE-2026-27143
Go stdlib · Upgrade to 1.26.2 or 1.25.9 by release line · < 1.25.9; >= 1.26.0-0, < 1.26.2 · CVE-2026-32281
PyPI monai · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2026-100846 · GHSA-89gg-p5r5-q6r4 · amended
Maven gov.nsa.emissary:emissary · Upgrade to 8.39.0 or later · < 8.39.0 · CVE-2026-35571 · GHSA-cpm7-cfpx-3hvp · amended
Maven io.modelcontextprotocol.sdk:mcp-core · Upgrade to 1.0.0 or later · < 1.0.0 · CVE-2026-35568 · GHSA-8jxr-pr72-r468
crates.io mise · Upgrade to 2026.6.4 or later · >= 2026.2.18, < 2026.6.4 · CVE-2026-35533 · GHSA-436v-8fw5-4mj8
crates.io netavark · Upgrade to 1.17.1 or later · >= 1.16.0, <= 1.17.0 · CVE-2026-35406 · GHSA-hfpq-x728-986j
baggage header extraction causes excessive allocations (remote dos amplification)Go go.opentelemetry.io/otel · Upgrade to 1.41.0 or later · >= 1.36.0, <= 1.40.0 · CVE-2026-29181 · GHSA-mh2q-q3fh-2475
PyPI openviking · Upgrade to 0.3.3 or later · < 0.3.3 · CVE-2026-22680 · GHSA-h336-2wxm-pr6q · amended
Maven org.apache.cassandra:cassandra-all · Upgrade to 5.0.7, 4.1.11 or 4.0.20 by release line · >= 4.0, < 4.0.20; >= 4.1, < 4.1.11; >= 5.0, < 5.0.7 · CVE-2026-32588 · GHSA-qffm-gf3j-6mvg
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.