Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–50 of 88 matching · newest first

Exploited 15 Jun 2026 ×Clear filters

High, CVSS 7.515 Jun 2026
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
PyPI starlette · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-48818 · GHSA-wqp7-x3pw-xc5r · amended
15 Jun 2026Evidence →
Medium, CVSS 5.315 Jun 2026
Starlette: Arbitrary HTTP method dispatched to HTTPEndpoint attributes via getattr
PyPI starlette · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-48817 · GHSA-x746-7m8f-x49c · amended
15 Jun 2026Evidence →
Medium, CVSS 5.315 Jun 2026
UAParser.js: Unbounded Sec-CH-UA-Model parsing can trigger ReDoS in withClientHints()
npm ua-parser-js · Upgrade to 2.0.10 or later · >= 2.0.1, < 2.0.10 · CVE-2026-48125 · GHSA-9h5v-pfqq-x599 · amended
15 Jun 2026Evidence →
High, CVSS 8.215 Jun 2026
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
npm protobufjs-cli · Upgrade to 2.5.0 or 1.3.2 by release line · <= 1.3.1; >= 2.0.0, <= 2.4.2 · CVE-2026-54271 · GHSA-pr59-h9ph-3fr8 · amended
15 Jun 2026Evidence →
Medium, CVSS 5.315 Jun 2026
protobufjs: Memory amplification from preserved unknown fields in binary decode
npm protobufjs · Upgrade to 8.5.0 or later · >= 8.2.0, <= 8.4.2 · CVE-2026-54270 · GHSA-94rc-8x27-4472 · amended
15 Jun 2026Evidence →
Low, CVSS 2.115 Jun 2026
DOMPurify: Trusted Types policy survives clearConfig() and can poison later RETURN_TRUSTED_TYPE output
npm dompurify · Upgrade to 3.4.9 or later · < 3.4.9 · CVE-2026-65899 · GHSA-vxr8-fq34-vvx9 · amended
15 Jun 2026Evidence →
High, CVSS 7.515 Jun 2026
Vulnerable OpenSSL included in cryptography wheels
PyPI cryptography · Upgrade to 48.0.1 or later · >= 0.5.0, < 48.0.1 · GHSA-537c-gmf6-5ccf · amended
15 Jun 2026Evidence →
High, CVSS 7.515 Jun 2026
Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.signalr.protocols.messagepack +3 · Upgrade all 4 to 10.0.9, 9.0.17 or 8.0.28 by release line · >= 8.0.0, <= 8.0.27; >= 9.0.0, <= 9.0.16; >= 10.0.0, <= 10.0.8 · CVE-2026-45591 · GHSA-f8h2-vmm9-qhj6
15 Jun 2026Evidence →
Medium, CVSS 6.615 Jun 2026
aiohttp: Incomplete websocket frame payloads bypass memory limits
PyPI aiohttp · Upgrade to 3.14.1 or later · <= 3.14.0 · CVE-2026-54274 · GHSA-xcgm-r5h9-7989 · amended
15 Jun 2026Evidence →
Low, CVSS 2.715 Jun 2026
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
PyPI aiohttp · Upgrade to 3.14.1 or later · <= 3.14.0 · CVE-2026-54275 · GHSA-4m7w-qmgq-4wj5 · amended
15 Jun 2026Evidence →
Low, CVSS 1.715 Jun 2026
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
PyPI aiohttp · Upgrade to 3.14.1 or later · <= 3.14.0 · CVE-2026-54280 · GHSA-9x8q-7h8h-wcw9 · amended
15 Jun 2026Evidence →
Medium, CVSS 6.615 Jun 2026
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
PyPI aiohttp · Upgrade to 3.14.1 or later · <= 3.14.0 · CVE-2026-54273 · GHSA-4fvr-rgm6-gqmc · amended
15 Jun 2026Evidence →
Medium, CVSS 6.615 Jun 2026
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
PyPI aiohttp · Upgrade to 3.14.1 or later · <= 3.14.0 · CVE-2026-54278 · GHSA-g3cq-j2xw-wf74 · amended
15 Jun 2026Evidence →
Medium, CVSS 6.615 Jun 2026
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
PyPI aiohttp · Upgrade to 3.14.1 or later · <= 3.14.0 · CVE-2026-54277 · GHSA-63hw-fmq6-xxg2 · amended
15 Jun 2026Evidence →
Medium, CVSS 6.315 Jun 2026
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
PyPI aiohttp · Upgrade to 3.14.1 or later · <= 3.14.0 · CVE-2026-54276 · GHSA-hpj7-wq8m-9hgp · amended
15 Jun 2026Evidence →
Low, CVSS 1.315 Jun 2026
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
PyPI aiohttp · Upgrade to 3.14.1 or later · < 3.14.1 · CVE-2026-54279 · GHSA-2fqr-mr3j-6wp8 · amended
15 Jun 2026Evidence →
Low, CVSS 2.715 Jun 2026
aiohttp: CRLF injection in multipart headers
PyPI aiohttp · Upgrade to 3.14.0 or later · <= 3.13.5 · CVE-2026-50269 · GHSA-m6qw-4cw2-hm4m · amended
15 Jun 2026Evidence →
Low, CVSS 3.115 Jun 2026
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
npm react-router · Upgrade to 7.15.1 or later · >= 7.12.0, < 7.15.1 · +1 more package · CVE-2026-53663 · GHSA-84g9-w2xq-vcv6 · amended
15 Jun 2026Evidence →
Critical, CVSS 9.815 Jun 2026
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
npm @vitest/browser · Upgrade to 5.0.0-beta.4 (pre-release), 4.1.8 or 3.2.5 by release line · >= 5.0.0-beta.0, <= 5.0.0-beta.3; >= 4.0.0, <= 4.1.7; >= 3.0.0, <= 3.2.4 · +1 more package · CVE-2026-53633 · GHSA-g8mr-85jm-7xhm · amended
15 Jun 2026Evidence →
Low, CVSS 2.015 Jun 2026
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside content when using DOM output modes
npm dompurify · Upgrade to 3.4.8 or later · >= 3.0.0, <= 3.4.7 · CVE-2026-65900 · GHSA-gvmj-g25r-r7wr · amended
15 Jun 2026Evidence →
Medium, CVSS 5.115 Jun 2026
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content
npm dompurify · Upgrade to 3.4.7 or later · <= 3.4.6 · CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq · amended
15 Jun 2026Evidence →
Medium, CVSS 6.115 Jun 2026
DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR
npm dompurify · Upgrade to 3.4.7 or later · < 3.4.7 · CVE-2026-65902 · GHSA-76mc-f452-cxcm · amended
15 Jun 2026Evidence →
Medium, CVSS 6.115 Jun 2026
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks
npm dompurify · Upgrade to 3.4.6 or later · <= 3.4.5 · CVE-2026-49458 · GHSA-hpcv-96wg-7vj8 · amended
15 Jun 2026Evidence →
Medium, CVSS 6.115 Jun 2026
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
npm dompurify · Upgrade to 3.4.6 or later · <= 3.4.5 · CVE-2026-49459 · GHSA-r47g-fvhr-h676 · amended
15 Jun 2026Evidence →
Medium, CVSS 5.315 Jun 2026
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
PyPI pyjwt · Upgrade to 2.13.0 or later · >= 2.8.0, <= 2.12.1 · CVE-2026-48525 · GHSA-w7vc-732c-9m39 · amended
15 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

protobufjs: Memory amplification from preserved unknown fields in binary decode

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

Vulnerable OpenSSL included in cryptography wheels

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

aiohttp: Incomplete websocket frame payloads bypass memory limits

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

aiohttp: CRLF injection in multipart headers

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside content when using DOM output modes

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence