Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–46 of 46 matching · newest first

Show all severities

Exploited 21 Jul 2026 ×Clear filters

Critical, CVSS 9.421 Jul 2026
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
npm @vitest/browser · Upgrade to 5.0.0-beta.6 (pre-release), 4.1.10 or 3.2.7 by release line · >= 4.0.0, < 4.1.10; < 3.2.7; >= 5.0.0-beta.1, < 5.0.0-beta.6 · CVE-2026-73653 · GHSA-p63j-vcc4-9vmv · amended
21 Jul 2026Evidence →
Critical, CVSS 9.621 Jul 2026
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
npm @sigstore/oci · Upgrade to 0.7.1 or later · < 0.7.1 · CVE-2026-59891 · GHSA-pf56-329r-95rw · amended
21 Jul 2026Evidence →
High, CVSS 8.521 Jul 2026
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-57894 · GHSA-82f7-87hm-852x
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
PyPI pyasn1 · Upgrade to 0.6.4 or later · <= 0.6.3 · CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r · amended
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
PyPI pyasn1 · Upgrade to 0.6.4 or later · <= 0.6.3 · CVE-2026-59885 · GHSA-8ppf-4f7h-5ppj · amended
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
PyPI pyasn1 · Upgrade to 0.6.4 or later · < 0.6.4 · CVE-2026-59884 · GHSA-m4p7-r5rc-7g4j · amended
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
OpenTelemetry JavaScript: Denial of service in JaegerPropagator via unhandled exception on a malformed header
npm @opentelemetry/propagator-jaeger · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2026-59892 · GHSA-45rx-2jwx-cxfr · amended
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text
npm linkify-it · Upgrade to 5.0.2 or later · <= 5.0.1 · CVE-2026-59887 · GHSA-v245-v573-v5vm · amended
21 Jul 2026Evidence →
High, CVSS 7.021 Jul 2026
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
npm aws-cdk-lib · Upgrade to 2.260.0 or later · < 2.260.0 · CVE-2026-13760 · GHSA-vcrf-j523-4mrf · amended
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
fast-uri vulnerable to host confusion via failed IDN canonicalization
npm fast-uri · Upgrade to 4.0.1, 3.1.3 or 2.4.2 by release line · >= 4.0.0, < 4.0.1; >= 3.0.0, < 3.1.3; >= 2.3.1, < 2.4.2 · CVE-2026-13676 · GHSA-4c8g-83qw-93j6 · amended
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
npm immutable · Upgrade to 5.1.8, 4.3.9 or 3.8.4 by release line · >= 5.0.0-beta.1, < 5.1.8; >= 4.0.0-beta.1, < 4.3.9; < 3.8.4 · CVE-2026-59880 · GHSA-xvcm-6775-5m9r · amended
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
Immutable.js List 32-bit trie overflow → unrecoverable DoS
npm immutable · Upgrade to 5.1.8, 4.3.9 or 3.8.4 by release line · >= 5.0.0-beta.1, < 5.1.8; >= 4.0.0-rc.1, < 4.3.9; < 3.8.4 · CVE-2026-59879 · GHSA-v56q-mh7h-f735 · amended
21 Jul 2026Evidence →
High, CVSS 8.921 Jul 2026
websocket-driver-ruby: Denial of service via malformed Host header
RubyGems websocket-driver · Upgrade to 0.8.2 or later · < 0.8.2 · CVE-2026-61666 · GHSA-2x63-gw47-w4mm · amended
21 Jul 2026Evidence →
Critical, CVSS 9.021 Jul 2026
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
PyPI homeassistant · Upgrade to 2026.6.0 or later · < 2026.6.0 · CVE-2026-64825 · GHSA-5hxg-r395-fqxx · amended
21 Jul 2026Evidence →
High, CVSS 8.221 Jul 2026
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
Maven org.postgresql:postgresql · Upgrade to 42.7.12 or later · >= 42.7.4, < 42.7.12 · CVE-2026-54291 · GHSA-j92g-9f8w-j867
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.6, 9.0.15 or 8.0.26 by release line · >= 10.0.0, <= 10.0.5; >= 9.0.0, <= 9.0.14; >= 8.0.0, <= 8.0.25 · CVE-2026-56170 · GHSA-j8gr-8fp3-5q5h
21 Jul 2026Evidence →
High, CVSS 7.021 Jul 2026
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
NuGet microsoft.net.build.containers · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-50526 · GHSA-55jh-fwmh-39m4
21 Jul 2026Evidence →
High, CVSS 8.821 Jul 2026
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.authentication.negotiate · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-47300 · GHSA-8prm-248r-h957
21 Jul 2026Evidence →
High, CVSS 8.821 Jul 2026
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.authentication.negotiate · Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.28 · CVE-2026-47303 · GHSA-2p3q-h3hg-jcqq
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line · >= 10.0.0, <= 10.0.9; >= 9.0.0, <= 9.0.17; >= 8.0.0, <= 8.0.3 · CVE-2026-50527 · GHSA-mmjf-rqrv-855v
21 Jul 2026Evidence →
High, CVSS 7.821 Jul 2026
Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.10, 9.0.18 or 8.0.29 by release line · >= 10.0.0, < 10.0.10; >= 9.0.0, < 9.0.18; >= 8.0.0, < 8.0.29 · CVE-2026-50650 · GHSA-2969-4q4w-w5h3 · amended
21 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

fast-uri vulnerable to host confusion via failed IDN canonicalization

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

websocket-driver-ruby: Denial of service via malformed Host header

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability

Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence