Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 41 matching · newest first

Show all severities

Exploited 20 Jul 2026 ×Clear filters

High, CVSS 7.520 Jul 2026
Pillow: Controlled heap out-of-bounds write in Pillow ImageCmsTransform.apply() via output mode mismatch
PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59205 · GHSA-9hw9-ch79-4vh6 · amended
20 Jul 2026Evidence →
High, CVSS 8.720 Jul 2026
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
PyPI pillow · Upgrade to 12.3.0 or later · >= 8.2.0, < 12.3.0 · CVE-2026-59204 · GHSA-vjc4-5qp5-m44j · amended
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
PyPI pillow · Upgrade to 12.3.0 or later · >= 5.1.0, < 12.3.0 · CVE-2026-59200 · GHSA-jjj6-mw9f-p565 · amended
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Pillow: Heap out-of-bounds write Image.paste() / Image.crop() via signed coordinate overflow
PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59199 · GHSA-6r8x-57c9-28j4 · amended
20 Jul 2026Evidence →
High, CVSS 8.220 Jul 2026
Pillow: Heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand
PyPI pillow · Upgrade to 12.3.0 or later · < 12.3.0 · CVE-2026-59197 · GHSA-xj96-63gp-2gmr · amended
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50651 · GHSA-wp74-jgxh-gv4q · amended
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50525 · GHSA-8q5v-6pqq-x66h
20 Jul 2026Evidence →
High, CVSS 8.220 Jul 2026
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50528 · GHSA-qvw7-jm5c-6hqw
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50648 · GHSA-23rf-6693-g89p
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50524 · GHSA-w7cw-xp7h-6j5j · amended
20 Jul 2026Evidence →
High, CVSS 8.120 Jul 2026
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-47304 · GHSA-g8r8-53c2-pm3f
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · +12 more packages · CVE-2026-47302 · GHSA-cvvh-rhrc-wg4q
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-57108 · GHSA-rp2p-6cmp-jxj9 · amended
20 Jul 2026Evidence →
High, CVSS 8.320 Jul 2026
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.31.1, < 0.33.0; >= 1.15.2, < 1.18.0 · CVE-2026-67320 · GHSA-gcfj-64vw-6mp9 · amended
20 Jul 2026Evidence →
High, CVSS 8.120 Jul 2026
File Browser: Colliding username normalization gives two users the same home directory
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · <= 2.63.16 · CVE-2026-62685 · GHSA-7rc3-g7h6-22m7
20 Jul 2026Evidence →
High, CVSS 8.220 Jul 2026
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
npm astro · Upgrade to 6.4.8 or later · >= 6.4.7, < 6.4.8 · CVE-2026-59731 · GHSA-vj59-8hwv-xxmv · amended
20 Jul 2026Evidence →
Critical, CVSS 9.220 Jul 2026
node-tar: Decompression/parse DoS via unlimited input
npm tar · Upgrade to 7.5.19 or later · <= 7.5.18 · CVE-2026-59873 · GHSA-23hp-3jrh-7fpw · amended
20 Jul 2026Evidence →
High, CVSS 8.720 Jul 2026
node-tar: Negative tar entry size causes infinite loop in archive replace
npm tar · Upgrade to 7.5.18 or later · <= 7.5.17 · CVE-2026-59874 · GHSA-8x88-c5mf-7j5w · amended
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
npm engine.io · Upgrade to 6.6.7 or later · >= 4.1.0, < 6.6.7 · CVE-2026-59725 · GHSA-r635-g3xr-vw7x · amended
20 Jul 2026Evidence →
High, CVSS 8.720 Jul 2026
shell-quote: Quadratic-complexity Denial of Service in parse() (CWE-407)
npm shell-quote · Upgrade to 1.9.0 or later · <= 1.8.4 · CVE-2026-13311 · GHSA-395f-4hp3-45gv · amended
20 Jul 2026Evidence →
High, CVSS 8.620 Jul 2026
Directus: Authorization-dependent response served from unsegmented cache key
npm directus · Upgrade to 12.0.0 or later · < 12.0.0 · CVE-2026-61836 · GHSA-c6w9-5g5j-jh2p · amended
20 Jul 2026Evidence →
High, CVSS 7.720 Jul 2026
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
npm directus · Upgrade to 12.0.0 or later · < 12.0.0 · CVE-2026-61835 · GHSA-j5h6-vqc3-phqh · amended
20 Jul 2026Evidence →
Critical, CVSS 9.320 Jul 2026
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
PyPI lightrag-hku · Upgrade to 1.5.4 or later · < 1.5.4 · CVE-2026-61740 · GHSA-f4vv-55c2-5789 · amended
20 Jul 2026Evidence →
Critical, CVSS 9.320 Jul 2026
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
PyPI lightrag-hku · Upgrade to 1.5.4 or later · <= 1.5.3 · CVE-2026-61736 · GHSA-6x6h-qqr7-855w · amended
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Mistune plugins/formatting: quadratic-time parsing on long runs of ~~x~~, ==x==, and ^^x^^ markers (strikethrough / mark / insert)
PyPI mistune · Upgrade to 3.3.0 or later · < 3.3.0 · CVE-2026-59922 · GHSA-c8j7-8cv4-2xmq · amended
20 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

File Browser: Colliding username normalization gives two users the same home directory

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

node-tar: Decompression/parse DoS via unlimited input

node-tar: Negative tar entry size causes infinite loop in archive replace

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Directus: Authorization-dependent response served from unsegmented cache key

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Mistune plugins/formatting: quadratic-time parsing on long runs of `x`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence