Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 14,167 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 8.811 Nov 2026
Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-118745 · GHSA-x8x8-p968-x646 · amended
11 Nov 2026Evidence →
High, CVSS 8.811 Nov 2026
Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-114152 · GHSA-xf35-v9jh-g65w · amended
11 Nov 2026Evidence →
High, CVSS 7.511 Nov 2026
Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability
NuGet microsoft.testplatform.cli · Upgrade to 18.11.1, 18.10.2, 18.7.1 or 6 more by release line; some affected versions have no fix yet · >= 17.2.0-preview-20220301-01, < 17.3.4; >= 17.3.1, < 17.3.4; >= 17.3.2, < 17.3.4; >= 17.3.3, < 17.3.4; >= 17.8.0, < 17.8.1; >= 17.11.0, < 17.11.2; >= 17.11.1, < 17.11.2; >= 17.12.0, < 17.12.1; >= 17.14.0, < 17.14.2; >= 17.14.1, < 17.14.2; >= 18.0.0, < 18.0.2; >= 18.0.1, < 18.0.2; >= 18.7.0, < 18.7.1; >= 18.10.0, < 18.10.2; >= 18.10.1, < 18.10.2; >= 18.11.0, < 18.11.1; >= 17.4.0, <= 17.4.0; >= 17.4.1, <= 17.4.1; >= 17.5.0, <= 17.5.0; >= 17.6.0, <= 17.6.0; >= 17.6.1, <= 17.6.1; >= 17.6.2, <= 17.6.2; >= 17.6.3, <= 17.6.3; >= 17.7.0, <= 17.7.0; >= 17.7.1, <= 17.7.1; >= 17.7.2, <= 17.7.2; >= 17.9.0, <= 17.9.0; >= 17.10.0, <= 17.10.0; >= 17.13.0, <= 17.13.0; >= 18.3.0, <= 18.3.0; >= 18.4.0, <= 18.4.0; >= 18.5.0, <= 18.5.0; >= 18.5.1, <= 18.5.1; >= 18.6.0, <= 18.6.0; >= 18.8.0, <= 18.8.0; >= 18.8.1, <= 18.8.1; >= 18.9.0, <= 18.9.0; >= 17.4.0-preview-20220707-01, <= 17.4.0-preview-20220707-01; >= 17.4.0-preview-20220726-02, <= 17.4.0-preview-20220726-02; >= 17.4.0-preview-20221003-03, <= 17.4.0-preview-20221003-03; >= 17.4.0-release-20220926-01, <= 17.4.0-release-20220926-01; >= 17.5.0-preview-20221003-04, <= 17.5.0-preview-20221003-04; >= 17.5.0-preview-20221221-03, <= 17.5.0-preview-20221221-03; >= 17.6.0-preview-20230223-05, <= 17.6.0-preview-20230223-05; >= 17.7.0-preview-23364-03, <= 17.7.0-preview-23364-03; >= 17.7.0-preview.23280.1, <= 17.7.0-preview.23280.1; >= 17.8.0-preview-23371-04, <= 17.8.0-preview-23371-04; >= 17.8.0-preview-23424-02, <= 17.8.0-preview-23424-02; >= 17.8.0-release-23468-02, <= 17.8.0-release-23468-02; >= 17.9.0-preview-23503-02, <= 17.9.0-preview-23503-02; >= 17.9.0-preview-23531-01, <= 17.9.0-preview-23531-01; >= 17.9.0-preview-23577-04, <= 17.9.0-preview-23577-04; >= 17.9.0-release-23619-01, <= 17.9.0-release-23619-01; >= 17.10.0-preview-24080-01, <= 17.10.0-preview-24080-01; >= 17.10.0-release-24177-07, <= 17.10.0-release-24177-07; >= 17.11.0-release-24352-06, <= 17.11.0-release-24352-06; >= 17.11.0-release-24373-02, <= 17.11.0-release-24373-02; >= 17.14.0-preview-25107-01, <= 17.14.0-preview-25107-01; >= 17.3.0, < 17.3.4 · GHSA-6856-87hx-p5x7
11 Nov 2026Evidence →
High, CVSS 8.811 Nov 2026
Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-114151 · GHSA-fpxj-5c99-g7vj · amended
11 Nov 2026Evidence →
High, CVSS 8.811 Nov 2026
Microsoft Security Advisory CVE-2026-114158 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-114158 · GHSA-r8h3-p8p6-ggp7 · amended
11 Nov 2026Evidence →
High, CVSS 8.811 Nov 2026
Microsoft Security Advisory CVE-2026-114159 - Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0 · CVE-2026-114159 · GHSA-3cgx-w6gm-fqrx · amended
11 Nov 2026Evidence →
High, CVSS 7.311 Nov 2026
Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability
NuGet aspire.cli.linux-musl-x64 +11 · Upgrade all 12 to 13.6.5 or later · >= 13.3.0, < 13.6.5 · CVE-2026-120792 · GHSA-q6jf-24jf-m3cg · amended
11 Nov 2026Evidence →
High, CVSS 7.311 Nov 2026
Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability
NuGet aspire.cli.linux-musl-x64 +11 · Upgrade all 12 to 13.6.5 or later · >= 13.3.0, < 13.6.5 · CVE-2026-120778 · GHSA-m63f-xhvm-6mv5 · amended
11 Nov 2026Evidence →
High, CVSS 7.511 Nov 2026
Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.server.httpsys · Upgrade to 2.3.14 or later · >= 2.3.10, < 2.3.14; >= 2.3.11, < 2.3.14; >= 2.3.12, < 2.3.14; >= 2.3.13, < 2.3.14 · +3 more packages · CVE-2026-114154 · GHSA-3893-7fxc-qvff · amended
11 Nov 2026Evidence →
High, CVSS 7.511 Nov 2026
Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability
NuGet microsoft.aspnetcore.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-preview.1.23112.2, < 8.0.34; >= 9.0.0-preview.1.24081.5, < 9.0.23; >= 10.0.0-preview.1.25120.3, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-114157 · GHSA-7phj-vgxq-r67h · amended
11 Nov 2026Evidence →
High, CVSS 7.511 Nov 2026
Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-preview.1.23112.2, < 8.0.34; >= 9.0.0-preview.1.24081.5, < 9.0.23; >= 10.0.0-preview.1.25120.3, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-114147 · GHSA-wr8v-9x5q-ggcm · amended
11 Nov 2026Evidence →
High, CVSS 7.511 Nov 2026
Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +10 · Upgrade all 11 to 9.0.0-preview.4.24267.6 (pre-release) or 8.0.34 by release line · >= 8.0.0-preview.1.23112.2, < 8.0.34; >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6; >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6; >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 · CVE-2026-109478 · GHSA-r3qf-p3jm-8h4p · amended
11 Nov 2026Evidence →
Critical, CVSS 9.011 Nov 2026
Microsoft Security Advisory CVE-2026-114146 - ASP.NET Core Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 · Upgrade to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-preview.1.23112.2, < 8.0.34; >= 9.0.0-preview.1.24081.5, < 9.0.23; >= 10.0.0-preview.1.25120.3, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · +11 more packages · CVE-2026-114146 · GHSA-67wp-ghc2-fw2g · amended
11 Nov 2026Evidence →
High, CVSS 7.511 Nov 2026
Microsoft Security Advisory CVE-2026-118748 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +10 · Upgrade all 11 to 11.0.0 or later · >= 11.0.0-preview.7.26381.103, < 11.0.0 · CVE-2026-118748 · GHSA-5h82-77p6-2wp3 · amended
11 Nov 2026Evidence →
High, CVSS 7.511 Nov 2026
Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability
NuGet microsoft.dotnet.hotreload.watch.aspire · Upgrade to 11.0.100 or 10.0.404 by release line · >= 10.0.300, < 10.0.404; >= 10.0.400, < 10.0.404; >= 11.0.100-preview.3.26207.106, < 11.0.100 · CVE-2026-114155 · GHSA-q7j6-px74-p2vw · amended
11 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Microsoft Security Advisory CVE-2026-109481 - ASP.NET Core Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +10 · Upgrade all 11 to 11.0.0 or later · >= 11.0.0-preview.6.26359.118, < 11.0.0 · CVE-2026-109481 · GHSA-xw2x-23jm-j582 · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Microsoft Security Advisory CVE-2026-118750 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.webutilities · Upgrade to 2.3.14 or later · >= 2.3.0, < 2.3.14 · CVE-2026-118750 · GHSA-6527-9fp8-r4x6 · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability
NuGet aspire.hosting.apphost +1 · Upgrade all 2 to 13.6.5 or later · < 13.6.5 · CVE-2026-120006 · GHSA-f7vh-h5g3-7jrh · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-0, < 8.0.34; >= 9.0.0-0, < 9.0.23; >= 10.0.0-0, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-109475 · GHSA-3g4v-f5gv-c7xf · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability
NuGet system.formats.cbor · Upgrade to 11.0.0, 10.0.15, 9.0.24 or 8.0.2 by release line · >= 8.0.0-0, < 8.0.2; >= 9.0.0-0, < 9.0.24; >= 10.0.0-0, < 10.0.15; >= 11.0.0-0, < 11.0.0 · CVE-2026-118747 · GHSA-vmv3-wvjp-wqpj · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 11.0.0 or later · >= 11.0.0-rc.1.26425.128, < 11.0.0 · CVE-2026-118749 · GHSA-m28h-pj36-4364 · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 11.0.0, 10.0.15, 9.0.23 or 8.0.34 by release line · >= 8.0.0-preview.1.23112.2, < 8.0.34; >= 9.0.0-preview.1.24081.5, < 9.0.23; >= 10.0.0-preview.1.25120.3, < 10.0.15; >= 11.0.0-preview.1.26104.118, < 11.0.0 · CVE-2026-114149 · GHSA-x33c-w48q-qrgc · amended
10 Nov 2026Evidence →
Critical, CVSS 9.510 Nov 2026
React: Unauthenticated Remote Code Execution in React Server Components
npm react-server-dom-turbopack +2 · Upgrade all 3 to 19.3.1, 19.2.9, 19.1.10 or 19.0.9 by release line · >= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1 · CVE-2026-126187 · GHSA-xqc2-xf4c-x3h3 · amended
10 Nov 2026Evidence →
High, CVSS 8.810 Nov 2026
Active Storage: Possible arbitrary file read and remote code execution in video previews, analysis and image processing
RubyGems activestorage · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126186 · GHSA-v924-7rp8-4mxh · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Active Support: Possible DoS vulnerability in Active Support safe_constantize
RubyGems activesupport · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126080 · GHSA-8474-xrp6-wh69 · amended
10 Nov 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence

News

CISA security events · all vendors

Advisory watch · no fix evidence