Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

76–100 of 162 matching · newest first

Exploited 19 Jun 2026 ×Clear filters

High, CVSS 8.219 Jun 2026
Concurrent Ruby : AtomicReference#update livelocks when the stored value is Float::NAN
RubyGems concurrent-ruby · Upgrade to 1.3.7 or later · < 1.3.7 · CVE-2026-54904 · GHSA-h8w8-99g7-qmvj
19 Jun 2026Evidence →
High, CVSS 8.419 Jun 2026
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
npm kozou +3 · Upgrade all 4 to 1.8.1 or later · <= 1.8.0 · GHSA-v52w-28xh-v562 · amended
19 Jun 2026Evidence →
High, CVSS 7.419 Jun 2026
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
NuGet corewcf.primitives · Upgrade to 1.9.1 or later · >= 1.9.0, < 1.9.1 · CVE-2026-54784 · GHSA-2288-8h3r-cqgg
19 Jun 2026Evidence →
High, CVSS 7.419 Jun 2026
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54783 · GHSA-gqv6-pwcg-87r8
19 Jun 2026Evidence →
Critical, CVSS 10.019 Jun 2026
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54782 · GHSA-xjr9-gg9q-jx3v
19 Jun 2026Evidence →
High, CVSS 7.419 Jun 2026
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54781 · GHSA-48pq-2xq3-c2m4
19 Jun 2026Evidence →
Low, CVSS 3.719 Jun 2026
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54780 · GHSA-4v55-cpmv-3vcm
19 Jun 2026Evidence →
Medium, CVSS 5.919 Jun 2026
CoreWCF: SAML token replay protection is inoperative
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54779 · GHSA-9jr3-rj99-8jq3
19 Jun 2026Evidence →
Medium, CVSS 6.219 Jun 2026
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
NuGet corewcf.unixdomainsocket · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54778 · GHSA-q6v9-43v5-jv9q
19 Jun 2026Evidence →
Medium, CVSS 6.519 Jun 2026
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
NuGet corewcf.netnamedpipe · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54777 · GHSA-6jj2-4q5c-x8g6
19 Jun 2026Evidence →
Medium, CVSS 4.419 Jun 2026
CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
NuGet corewcf.unixdomainsocket · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54776 · GHSA-wjpq-6766-7f5j
19 Jun 2026Evidence →
Medium, CVSS 6.519 Jun 2026
CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.
NuGet corewcf.kafka · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54775 · GHSA-m744-jhq9-ppw6
19 Jun 2026Evidence →
High, CVSS 7.419 Jun 2026
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54774 · GHSA-rpj7-hr7h-w6p9
19 Jun 2026Evidence →
Medium, CVSS 5.919 Jun 2026
CoreWCF: WS-Security signature substitution via document-wide Signature lookup
NuGet corewcf.primitives · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54773 · GHSA-jc6x-rj79-w4mx
19 Jun 2026Evidence →
High, CVSS 7.519 Jun 2026
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
NuGet corewcf.netframingbase · Upgrade to 1.9.1 or 1.8.1 by release line · < 1.8.1; >= 1.9.0, < 1.9.1 · CVE-2026-54772 · GHSA-p86g-xrr2-pf7c
19 Jun 2026Evidence →
Medium, CVSS 5.319 Jun 2026
Python Liquid: Infinite loop when parsing malformed {% case %} tags
PyPI python-liquid · Upgrade to 2.2.1 or later · < 2.2.1 · CVE-2026-55865 · GHSA-vq2f-vcc9-j8mv · amended
19 Jun 2026Evidence →
High, CVSS 8.719 Jun 2026
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close
RubyGems oj · Upgrade to 3.17.3 or later · <= 3.17.2 · CVE-2026-54897 · GHSA-9ppp-w3g4-fh4q
19 Jun 2026Evidence →
Low, CVSS 2.119 Jun 2026
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
npm parse-server · Upgrade to 9.9.1-alpha.11 (pre-release) or 8.6.81 by release line · >= 9.0.0, < 9.9.1-alpha.11; <= 8.6.80 · CVE-2026-55778 · GHSA-v8x7-r927-cc93 · amended
19 Jun 2026Evidence →
High, CVSS 7.519 Jun 2026
Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input
RubyGems oj · Upgrade to 3.17.3 or later · < 3.17.3 · CVE-2026-54592 · GHSA-3m6q-jj5j-38c9
19 Jun 2026Evidence →
High, CVSS 7.119 Jun 2026
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
PyPI jupyterlab-git · Upgrade to 0.54.0 or later · <= 0.53.0 · CVE-2026-54528 · GHSA-436q-jwfr-rm2h · amended
19 Jun 2026Evidence →
High, CVSS 8.619 Jun 2026
jupyterlab-git extension: Stored XSS leading to RCE
PyPI jupyterlab-git +2 · Upgrade all 3 to 0.54.0 or later · >= 0.30.0b3, < 0.54.0 · CVE-2026-54527 · GHSA-f962-v9hr-pfg5 · amended
19 Jun 2026Evidence →
Medium, CVSS 5.319 Jun 2026
Oj: intern.c form_attr (uninitialized stack read)
RubyGems oj · Upgrade to 3.17.3 or later · < 3.17.3 · CVE-2026-54500 · GHSA-fm7p-mprw-wjm9
19 Jun 2026Evidence →
High, CVSS 7.519 Jun 2026
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
PyPI stanza · Upgrade to 1.12.2 or later · <= 1.12.1 · CVE-2026-54499 · GHSA-v5jw-96jm-7h2c · amended
19 Jun 2026Evidence →
High, CVSS 7.619 Jun 2026
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
PyPI homeassistant · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-54317 · GHSA-x84v-g949-293w · amended
19 Jun 2026Evidence →
High, CVSS 7.519 Jun 2026
Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
RubyGems faraday · Upgrade to 2.14.3 or 1.10.6 by release line · >= 2.0.0, <= 2.14.2; >= 1.0.0, <= 1.10.5 · CVE-2026-54297 · GHSA-98m9-hrrm-r99r
19 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

CoreWCF: SAML token replay protection is inoperative

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close

parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

jupyterlab-git extension: Stored XSS leading to RCE

Oj: intern.c form_attr (uninitialized stack read)

Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence