Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–50 of 90 matching · newest first

Exploited 20 Jul 2026 ×Clear filters

High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · +12 more packages · CVE-2026-47302 · GHSA-cvvh-rhrc-wg4q
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-57108 · GHSA-rp2p-6cmp-jxj9 · amended
20 Jul 2026Evidence →
High, CVSS 8.320 Jul 2026
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.31.1, < 0.33.0; >= 1.15.2, < 1.18.0 · CVE-2026-67320 · GHSA-gcfj-64vw-6mp9 · amended
20 Jul 2026Evidence →
Medium, CVSS 6.920 Jul 2026
Axios form serializer maxDepth bypass via {} metatoken
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.31.1, < 0.33.0; >= 1.15.1, < 1.18.0 · CVE-2026-67321 · GHSA-hcpx-6fm6-wx23 · amended
20 Jul 2026Evidence →
Medium, CVSS 6.320 Jul 2026
Axios: Nested axios option objects can consume polluted prototype values
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 0.8.0, < 0.33.0; >= 1.0.0, < 1.18.0 · CVE-2026-67319 · GHSA-7q8q-rj6j-mhjq · amended
20 Jul 2026Evidence →
Medium, CVSS 6.320 Jul 2026
Axios: HTTP/2 streamed uploads bypass maxBodyLength
npm axios · Upgrade to 1.18.0 or later · >= 1.13.0, < 1.18.0 · CVE-2026-67318 · GHSA-mwf2-3pr3-8698 · amended
20 Jul 2026Evidence →
Medium, CVSS 6.320 Jul 2026
Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength
npm axios · Upgrade to 1.18.0 or later · >= 1.7.0, < 1.18.0 · CVE-2026-67317 · GHSA-jqh4-m9w3-8hp9 · amended
20 Jul 2026Evidence →
Medium, CVSS 6.320 Jul 2026
Axios: Prototype pollution gadgets can alter axios request construction
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 1.0.0, < 1.18.0; < 0.33.0 · CVE-2026-67316 · GHSA-mmx7-hfxf-jppx · amended
20 Jul 2026Evidence →
Medium, CVSS 6.920 Jul 2026
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
npm axios · Upgrade to 1.18.0 or 0.33.0 by release line · >= 1.15.0, < 1.18.0; >= 0.31.0, < 0.33.0 · CVE-2026-67315 · GHSA-f4gw-2p7v-4548 · amended
20 Jul 2026Evidence →
High, CVSS 8.120 Jul 2026
File Browser: Colliding username normalization gives two users the same home directory
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · <= 2.63.16 · CVE-2026-62685 · GHSA-7rc3-g7h6-22m7
20 Jul 2026Evidence →
Low, CVSS 2.720 Jul 2026
File Browser: Share API exposes the password hash and bypass token
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · <= 2.63.16 · CVE-2026-62684 · GHSA-833g-cqhp-h72j
20 Jul 2026Evidence →
Medium, CVSS 6.820 Jul 2026
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.63.17 or later · >= 2.63.6, <= 2.63.16 · CVE-2026-62843 · GHSA-83xp-526h-j3ww
20 Jul 2026Evidence →
Medium, CVSS 4.820 Jul 2026
protobufjs: Text Format string map parsing can mutate returned map object prototype
npm protobufjs · Upgrade to 8.6.5 or later · >= 8.2.0, <= 8.6.4 · CVE-2026-59876 · GHSA-jfj6-75fj-8934 · amended
20 Jul 2026Evidence →
Medium, CVSS 5.320 Jul 2026
protobufjs: Denial of Service via infinite loop in .proto option parsing
npm protobufjs · Upgrade to 8.6.6 or 7.6.5 by release line · >= 7.5.0, <= 7.6.4; >= 8.0.0, <= 8.6.5 · CVE-2026-59877 · GHSA-j3f2-48v5-ccww · amended
20 Jul 2026Evidence →
Medium, CVSS 5.320 Jul 2026
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
npm webpack-dev-server · Upgrade to 5.2.6 or later · <= 5.2.5 · CVE-2026-14631 · GHSA-m28w-2pqf-7qgj · amended
20 Jul 2026Evidence →
Medium, CVSS 4.720 Jul 2026
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
npm webpack-dev-server · Upgrade to 5.2.6 or later · <= 5.2.5 · CVE-2026-14620 · GHSA-f5vj-f2hx-8m93 · amended
20 Jul 2026Evidence →
Medium, CVSS 4.720 Jul 2026
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Packagist guzzlehttp/guzzle · Upgrade to 7.12.3 or later · < 7.12.3 · CVE-2026-59883 · GHSA-g446-98w2-8p5w
20 Jul 2026Evidence →
High, CVSS 8.220 Jul 2026
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
npm astro · Upgrade to 6.4.8 or later · >= 6.4.7, < 6.4.8 · CVE-2026-59731 · GHSA-vj59-8hwv-xxmv · amended
20 Jul 2026Evidence →
Medium, CVSS 6.120 Jul 2026
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Packagist composer/composer · Upgrade to 2.10.2 or 2.2.29 by release line · >= 2.3.0, < 2.10.2; >= 1.0.0, < 2.2.29 · CVE-2026-59946 · GHSA-gjfg-22fp-rrxx
20 Jul 2026Evidence →
Medium, CVSS 4.720 Jul 2026
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Packagist composer/composer · Upgrade to 2.10.2 or 2.2.29 by release line · >= 2.3.0, < 2.10.2; >= 1.0.0, < 2.2.29 · CVE-2026-59947 · GHSA-g6xq-892h-64w3
20 Jul 2026Evidence →
Medium, CVSS 5.320 Jul 2026
node-tar: Process crash via PAX numeric path type confusion
npm tar · Upgrade to 7.5.18 or later · <= 7.5.17 · CVE-2026-59871 · GHSA-w8wr-v893-vjvp · amended
20 Jul 2026Evidence →
Critical, CVSS 9.220 Jul 2026
node-tar: Decompression/parse DoS via unlimited input
npm tar · Upgrade to 7.5.19 or later · <= 7.5.18 · CVE-2026-59873 · GHSA-23hp-3jrh-7fpw · amended
20 Jul 2026Evidence →
High, CVSS 8.720 Jul 2026
node-tar: Negative tar entry size causes infinite loop in archive replace
npm tar · Upgrade to 7.5.18 or later · <= 7.5.17 · CVE-2026-59874 · GHSA-8x88-c5mf-7j5w · amended
20 Jul 2026Evidence →
Medium, CVSS 5.320 Jul 2026
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
npm tar · Upgrade to 7.5.17 or later · <= 7.5.16 · CVE-2026-59875 · GHSA-gvwx-54wh-qm9j · amended
20 Jul 2026Evidence →
High, CVSS 7.520 Jul 2026
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
npm engine.io · Upgrade to 6.6.7 or later · >= 4.1.0, < 6.6.7 · CVE-2026-59725 · GHSA-r635-g3xr-vw7x · amended
20 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Axios form serializer maxDepth bypass via {} metatoken

Axios: Nested axios option objects can consume polluted prototype values

Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Axios: Prototype pollution gadgets can alter axios request construction

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

File Browser: Colliding username normalization gives two users the same home directory

File Browser: Share API exposes the password hash and bypass token

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

protobufjs: Text Format string map parsing can mutate returned map object prototype

protobufjs: Denial of Service via infinite loop in .proto option parsing

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

node-tar: Process crash via PAX numeric path type confusion

node-tar: Decompression/parse DoS via unlimited input

node-tar: Negative tar entry size causes infinite loop in archive replace

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence