Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

101–125 of 162 matching · newest first

Exploited 19 Jun 2026 ×Clear filters

High, CVSS 8.419 Jun 2026
containerd CRI checkpoint restore CDI annotation smuggling
Go github.com/containerd/containerd/v2 · Upgrade to 2.3.2, 2.2.5 or 2.1.9 by release line · >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 · CVE-2026-53492 · GHSA-33vj-92qq-66hc
19 Jun 2026Evidence →
High, CVSS 7.119 Jun 2026
Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
Go github.com/containerd/containerd/v2 · Upgrade to 2.3.2, 2.2.5 or 2.1.9 by release line · >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 · CVE-2026-53489 · GHSA-rgh6-rfwx-v388
19 Jun 2026Evidence →
High, CVSS 8.719 Jun 2026
containerd CRI — image-config LABEL flows to restart-monitor binary:// logger: host-root command execution from an image pull
Go github.com/containerd/containerd · Upgrade to 1.7.33 or later · >= 1.7.0, < 1.7.33 · +1 more package · CVE-2026-53488 · GHSA-xhf5-7wjv-pqxp
19 Jun 2026Evidence →
Medium, CVSS 5.619 Jun 2026
containerd: CRI checkpoint import allows local image tag poisoning
Go github.com/containerd/containerd/v2 · Upgrade to 2.3.2, 2.2.5 or 2.1.9 by release line · >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 · CVE-2026-50195 · GHSA-cvxm-645q-p574
19 Jun 2026Evidence →
Medium, CVSS 6.919 Jun 2026
parse-server: Relation $relatedTo query bypasses protectedFields and owning-object ACL
npm parse-server · Upgrade to 9.9.1-alpha.6 (pre-release) or 8.6.80 by release line · >= 9.0.0, < 9.9.1-alpha.6; < 8.6.80 · CVE-2026-53726 · GHSA-wmwx-jr2p-4j4r · amended
19 Jun 2026Evidence →
Medium, CVSS 5.919 Jun 2026
parse-server: Endpoints /login and /verifyPassword disclose MFA secrets and protected fields when _User get is denied
npm parse-server · Upgrade to 9.9.1-alpha.5 (pre-release) or later · >= 9.8.0, < 9.9.1-alpha.5 · CVE-2026-53725 · GHSA-75v4-m273-5j49 · amended
19 Jun 2026Evidence →
Low, CVSS 2.119 Jun 2026
parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
npm parse-server · Upgrade to 9.9.1-alpha.4 (pre-release) or 8.6.79 by release line · >= 9.0.0, < 9.9.1-alpha.4; <= 8.6.78 · CVE-2026-53724 · GHSA-7wqv-xjf3-x35v · amended
19 Jun 2026Evidence →
Medium, CVSS 5.119 Jun 2026
symfony/ux-autocomplete: XSS via unescaped AJAX response data
Packagist symfony/ux-autocomplete · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.2.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49216 · GHSA-mwqm-4fw3-cjvr
19 Jun 2026Evidence →
Low, CVSS 2.119 Jun 2026
symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.22.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49215 · GHSA-4m4j-hmqq-3gxm
19 Jun 2026Evidence →
Low, CVSS 2.319 Jun 2026
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49212 · GHSA-34w5-c283-j9fg
19 Jun 2026Evidence →
Medium, CVSS 6.319 Jun 2026
symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Packagist symfony/ux-autocomplete · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.2.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49211 · GHSA-946h-jp5c-8fvh
19 Jun 2026Evidence →
Medium, CVSS 5.119 Jun 2026
symfony/ux-live-component: XSS via attacker-controlled child component tag
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49210 · GHSA-38x5-rcv4-xf7x
19 Jun 2026Evidence →
Low, CVSS 1.319 Jun 2026
symfony/ux-live-component: Denial of service via unbounded batch action requests
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.5.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49209 · GHSA-mm82-c99c-h2cf
19 Jun 2026Evidence →
Medium, CVSS 6.919 Jun 2026
parse-server: Server option routeAllowList is bypassable through batch sub-requests
npm parse-server · Upgrade to 9.9.1-alpha.3 (pre-release) or later · >= 9.8.0, < 9.9.1-alpha.3 · CVE-2026-50008 · GHSA-p84r-h6rx-f2xr · amended
19 Jun 2026Evidence →
Medium, CVSS 6.919 Jun 2026
containerd image-triggered runtime DoS via unbounded group parsing
Go github.com/containerd/containerd · Upgrade to 1.7.33 or later · >= 1.7.0, < 1.7.33 · +1 more package · CVE-2026-47262 · GHSA-jpcc-p29g-p8mq
19 Jun 2026Evidence →
High, CVSS 8.719 Jun 2026
Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle
RubyGems oj · Upgrade to 3.17.2 or later · < 3.17.2 · CVE-2026-54899 · GHSA-2cw7-v8ff-p88r
19 Jun 2026Evidence →
Medium, CVSS 6.919 Jun 2026
ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
Packagist symfony/ux-live-component · Upgrade to 3.1.0 or 2.36.0 by release line · >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0 · CVE-2026-49208 · GHSA-89g7-22c8-3j23
19 Jun 2026Evidence →
High, CVSS 8.019 Jun 2026
py7zr: Arbitrary File Write Vulnerability
PyPI py7zr · Upgrade to 1.1.3 or later · <= 1.1.2 · CVE-2026-23879 · GHSA-q6rc-2cgv-63h7 · amended
19 Jun 2026Evidence →
Medium, CVSS 5.919 Jun 2026
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)
npm typeorm · Upgrade to 0.3.29 or later · >= 0.1.12, <= 0.3.28 · GHSA-9ggv-8w38-r7pm · amended
19 Jun 2026Evidence →
High, CVSS 7.719 Jun 2026
Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
Go github.com/gohugoio/hugo · Upgrade to 0.163.1 or later · >= 0.162.0, < 0.163.1 · GHSA-r46f-3rpw-hxrv
19 Jun 2026Evidence →
High, CVSS 7.519 Jun 2026
AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content
RubyGems alchemy_cms · Upgrade to 8.2.6, 8.1.14, 8.0.15 or 7.4.15 by release line · >= 8.2.0, <= 8.2.5; >= 8.1.0, <= 8.1.13; >= 8.0.0.a, <= 8.0.14; <= 7.4.14 · GHSA-mqq5-j7w8-2hgh
19 Jun 2026Evidence →
Medium, CVSS 6.019 Jun 2026
Hugo: Symlink confinement bypass in os.ReadFile
Go github.com/gohugoio/hugo · Upgrade to 0.163.1 or later · >= 0.123.0, < 0.163.1 · GHSA-c3wq-j5vh-68rc
19 Jun 2026Evidence →
Medium, CVSS 5.119 Jun 2026
Hugo: XSS via unescaped code-fence language in default code block renderer
Go github.com/gohugoio/hugo · Upgrade to 0.163.3 or later · >= 0.60.0, < 0.163.3 · GHSA-q76j-gcg9-vxc6
19 Jun 2026Evidence →
Low, CVSS 3.319 Jun 2026
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
npm @openzeppelin/wizard · Upgrade to 0.10.11 or later · <= 0.10.10 · +3 more packages · CVE-2026-57583 · GHSA-9wxg-vf3r-56hc · amended
19 Jun 2026Evidence →
Low, CVSS 1.719 Jun 2026
Nokogiri: Possible Use-After-Free when setting an attribute value via Nokogiri::XML::Attr#value= or #content=
RubyGems nokogiri · Upgrade to 1.19.4 or later · < 1.19.4 · GHSA-phwj-rprq-35pp
19 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

containerd CRI checkpoint restore CDI annotation smuggling

Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

containerd: CRI checkpoint import allows local image tag poisoning

parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

symfony/ux-autocomplete: XSS via unescaped AJAX response data

symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted

symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding

symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

symfony/ux-live-component: XSS via attacker-controlled child component tag

symfony/ux-live-component: Denial of service via unbounded batch action requests

parse-server: Server option routeAllowList is bypassable through batch sub-requests

containerd image-triggered runtime DoS via unbounded group parsing

Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor

py7zr: Arbitrary File Write Vulnerability

TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)

AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

Hugo: Symlink confinement bypass in os.ReadFile

Hugo: XSS via unescaped code-fence language in default code block renderer

OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence