Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 53 matching · newest first

Show all severities

Exploited 26 Jun 2026 ×Clear filters

High, CVSS 7.126 Jun 2026
pnpm: stage download writes outside its destination directory via manifest name/version traversal
npm pnpm · Upgrade to 11.5.3 or later · >= 11.3.0, < 11.5.3 · CVE-2026-55700 · GHSA-v23m-ccfg-pq9h · amended
26 Jun 2026Evidence →
High, CVSS 8.826 Jun 2026
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55698 · GHSA-w466-c33r-3gjp · amended
26 Jun 2026Evidence →
High, CVSS 7.126 Jun 2026
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49338 · GHSA-hmgp-w9jm-vp95
26 Jun 2026Evidence →
High, CVSS 7.126 Jun 2026
gonic: Path Traversal in playlist id bypasses ownership check, enabling any user to read/delete other users' playlists
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49339 · GHSA-2fp4-5v5c-4448
26 Jun 2026Evidence →
High, CVSS 8.126 Jun 2026
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49340 · GHSA-4gxv-p5g5-j7w7
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55697 · GHSA-gj8w-mvpf-x27x · amended
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55487 · GHSA-5wx6-mg75-v57r · amended
26 Jun 2026Evidence →
Critical, CVSS 9.126 Jun 2026
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
Go github.com/nezhahq/nezha · Upgrade to 2.0.13 or later · < 2.0.13 · CVE-2026-53519 · GHSA-5c25-7vpj-9mqh
26 Jun 2026Evidence →
High, CVSS 7.326 Jun 2026
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50015 · GHSA-rxhj-4m44-96r4 · amended
26 Jun 2026Evidence →
High, CVSS 8.826 Jun 2026
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50016 · GHSA-hwx4-2j3j-g496 · amended
26 Jun 2026Evidence →
Critical, CVSS 9.926 Jun 2026
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
Go github.com/nezhahq/nezha · Upgrade to 2.0.10; some affected versions have no fix yet · >= 1.14.13, <= 1.14.14; >= 2.0.0, <= 2.0.9 · GHSA-q6xx-5vr8-p898
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
npm js-toml · Upgrade to 1.1.2 or later · < 1.1.2 · CVE-2026-49293 · GHSA-wp3c-266w-4qfq · amended
26 Jun 2026Evidence →
High, CVSS 8.926 Jun 2026
SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings
Packagist solidinvoice/solidinvoice · Upgrade to 2.3.16 or later · <= 2.3.15 · GHSA-7vfx-4246-jcfh
26 Jun 2026Evidence →
High, CVSS 7.426 Jun 2026
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
Packagist statamic/cms · Upgrade to 6.20.0 or 5.73.23 by release line · < 5.73.23; >= 6.0.0, < 6.20.0 · CVE-2026-49287 · GHSA-m92m-r54r-x8r2
26 Jun 2026Evidence →
High, CVSS 8.126 Jun 2026
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Packagist pontedilana/php-weasyprint · Upgrade to 2.6.0 or later · <= 2.5.1 · CVE-2026-49286 · GHSA-2fmj-p74r-3wjm
26 Jun 2026Evidence →
High, CVSS 8.826 Jun 2026
Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication
npm line-desktop-mcp · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-49357 · GHSA-4hf8-5mjm-rfgq · amended
26 Jun 2026Evidence →
High, CVSS 8.226 Jun 2026
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
Packagist pontedilana/php-weasyprint · Upgrade to 2.5.1 or later · <= 2.5.0 · CVE-2026-49260 · GHSA-f5gc-qxf8-mh9g
26 Jun 2026Evidence →
High, CVSS 8.126 Jun 2026
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.4 or later · <= 4.1.3 · GHSA-985r-q3qp-299h
26 Jun 2026Evidence →
Critical, CVSS 10.026 Jun 2026
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
PyPI mcp-pinot-server · Upgrade to 3.1.0 or later · <= 3.0.1 · CVE-2026-49257 · GHSA-73cv-556c-w3g6 · amended
26 Jun 2026Evidence →
High, CVSS 8.126 Jun 2026
mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
PyPI mcp-memory-service · Upgrade to 10.65.3 or later · <= 10.65.1 · CVE-2026-49291 · GHSA-2r68-g678-7qr3 · amended
26 Jun 2026Evidence →
Critical, CVSS 9.926 Jun 2026
deepstream is vulnerable to prototype pollution
npm @deepstream/server · Upgrade to 10.0.5 or later · < 10.0.5 · CVE-2026-49252 · GHSA-9v98-6g37-x9g6 · amended
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server
npm better-helperjs · Upgrade to 3.0.6 or later · <= 3.0.5 · GHSA-3p34-w4f6-5xh2 · amended
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Packagist php-standard-library/php-standard-library +1 · Upgrade all 2 to 6.2.1 or 6.1.2 by release line · >= 6.1.0, < 6.1.2; >= 6.2.0, < 6.2.1 · CVE-2026-48979 · GHSA-pw9p-jvrm-f7rm
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
npm muhammara · Upgrade to 6.0.5 or later · < 6.0.5 · CVE-2026-125107 · GHSA-fhp4-pr5j-46m5 · amended
26 Jun 2026Evidence →
High, CVSS 8.726 Jun 2026
Flawfinder output manipulation via untrusted filenames and source text
PyPI flawfinder · Upgrade to 2.0.20 or later · < 2.0.20 · CVE-2026-48813 · GHSA-4c3c-r6p8-c863 · amended
26 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings

Statamic CMS's unsafe method invocation via collection sorting allows data destruction

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

deepstream is vulnerable to prototype pollution

better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Flawfinder output manipulation via untrusted filenames and source text

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence