Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 46 matching · newest first

Show all severities

Exploited 21 Jul 2026 ×Clear filters

High, CVSS 7.521 Jul 2026
fast-uri vulnerable to host confusion via literal backslash authority delimiter
npm fast-uri · Upgrade to 4.1.1, 3.1.4 or 2.4.3 by release line · >= 2.3.1, <= 2.4.2; >= 3.0.0, <= 3.1.3; >= 4.0.0, <= 4.1.0 · CVE-2026-16221 · GHSA-v2hh-gcrm-f6hx · amended
21 Jul 2026Evidence →
High, CVSS 7.021 Jul 2026
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
npm sharp · Upgrade to 0.35.0 or later · < 0.35.0 · CVE-2026-114113 · GHSA-f88m-g3jw-g9cj · amended
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
npm fast-xml-parser · Upgrade to 5.10.1 or later · >= 5.9.3, < 5.10.1 · CVE-2026-73569 · GHSA-8r6m-32jq-jx6q · amended
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
PyPI gitpython · Upgrade to 3.1.52 or later · < 3.1.52 · CVE-2026-67322 · GHSA-rwj8-pgh3-r573 · amended
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.21.4 or 2.18.8 by release line · < 2.18.8; >= 2.19.0, < 2.21.4 · +1 more package · CVE-2026-68494 · GHSA-r7wm-3cxj-wff9
21 Jul 2026Evidence →
High, CVSS 7.121 Jul 2026
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · >= 1.5.0, < 1.26.3 · CVE-2026-20779 · GHSA-gx3v-q759-g323
21 Jul 2026Evidence →
High, CVSS 7.621 Jul 2026
Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
Go code.gitea.io/gitea · Upgrade to 1.26.4 or later · < 1.26.4 · CVE-2026-58422 · GHSA-g9g6-qhrc-p3qc
21 Jul 2026Evidence →
High, CVSS 8.821 Jul 2026
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-27775 · GHSA-649p-mmhf-85c7
21 Jul 2026Evidence →
High, CVSS 7.721 Jul 2026
Gitea: Two SSRF findings
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58314 · GHSA-2fcr-jfvc-vgg2
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58436 · GHSA-fw57-jgch-pgf3
21 Jul 2026Evidence →
High, CVSS 7.121 Jul 2026
Gitea: Repository Visibility Manipulation via Git Push Options
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58437 · GHSA-8p9h-49rc-qgxj
21 Jul 2026Evidence →
High, CVSS 8.121 Jul 2026
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-55987 · GHSA-vrhc-jjfc-m3m3
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-54481 · GHSA-94v3-77j7-vm48
21 Jul 2026Evidence →
Critical, CVSS 9.621 Jul 2026
Gitea: Public-only repository tokens can update private PR head branches
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58443 · GHSA-xxjv-752h-3vp2
21 Jul 2026Evidence →
High, CVSS 8.921 Jul 2026
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-58424 · GHSA-777r-4v59-6486
21 Jul 2026Evidence →
High, CVSS 7.721 Jul 2026
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · >= 1.23.0, < 1.26.3 · CVE-2026-58423 · GHSA-7wvc-rvp7-w99x
21 Jul 2026Evidence →
Critical, CVSS 9.821 Jul 2026
Gitea Docker image: REVERSE_PROXY_TRUSTED_PROXIES = * default lets any source IP impersonate any user via X-WEBAUTH-USER
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-20896 · GHSA-f75j-4cw6-rmx4
21 Jul 2026Evidence →
Critical, CVSS 9.621 Jul 2026
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-22874 · GHSA-2r5c-gw76-rh3w
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
Gitea: Privilege Escalation via Access Token Scope Escalation in API
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56654 · GHSA-683j-3ff6-hh2x
21 Jul 2026Evidence →
High, CVSS 7.121 Jul 2026
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56755 · GHSA-6hm7-3pwj-22rm
21 Jul 2026Evidence →
Critical, CVSS 9.121 Jul 2026
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56750 · GHSA-rgv6-xp99-6mgj
21 Jul 2026Evidence →
High, CVSS 8.421 Jul 2026
GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()
PyPI gitpython · Upgrade to 3.1.51 or later · <= 3.1.50 · CVE-2026-67323 · GHSA-956x-8gvw-wg5v · amended
21 Jul 2026Evidence →
High, CVSS 8.821 Jul 2026
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
PyPI gitpython · Upgrade to 3.1.51 or later · <= 3.1.50 · CVE-2026-67325 · GHSA-2f96-g7mh-g2hx · amended
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
GitPython unsafe clone option gate bypass through joined short options
PyPI gitpython · Upgrade to 3.1.51 or later · >= 3.1.50, <= 3.1.50 · CVE-2026-67324 · GHSA-v396-v7q4-x2qj · amended
21 Jul 2026Evidence →
High, CVSS 8.221 Jul 2026
SVGO removeScripts plugin leaves some executable scripts intact
npm svgo · Upgrade to 4.0.2, 3.3.4 or 2.8.3 by release line · >= 1.0.0, < 2.8.3; >= 3.0.0, < 3.3.4; >= 4.0.0, < 4.0.2 · CVE-2026-73650 · GHSA-2p49-hgcm-8545 · amended
21 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

fast-uri vulnerable to host confusion via literal backslash authority delimiter

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Two SSRF findings

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea: Repository Visibility Manipulation via Git Push Options

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Gitea: Public-only repository tokens can update private PR head branches

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

GitPython unsafe clone option gate bypass through joined short options

SVGO removeScripts plugin leaves some executable scripts intact

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence