Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 86 matching · newest first

Exploited 22 Jul 2026 ×Clear filters

Medium, CVSS 5.322 Jul 2026
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72750 · GHSA-652q-gvq3-74qv · amended
22 Jul 2026Evidence →
Medium, CVSS 5.822 Jul 2026
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72775 · GHSA-jqwr-vx3p-r266 · amended
22 Jul 2026Evidence →
Medium, CVSS 5.822 Jul 2026
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
npm n8n · Upgrade to 2.32.1, 2.31.5 or 1.123.67 by release line · < 1.123.67; >= 2.32.0, < 2.32.1; >= 2.0.0-rc.0, < 2.31.5 · CVE-2026-72764 · GHSA-9cmh-xcqm-5hqr · amended
22 Jul 2026Evidence →
High, CVSS 8.622 Jul 2026
JupyterLab: Cross-site scripting (XSS) via crafted settings file (overrides.json)
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; >= 3.3.0, <= 4.5.9 · CVE-2026-73417 · GHSA-pppj-hq3g-57pj · amended
22 Jul 2026Evidence →
High, CVSS 7.522 Jul 2026
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; <= 4.5.9 · CVE-2026-73415 · GHSA-gx64-gj6p-pc4c · amended
22 Jul 2026Evidence →
Medium, CVSS 6.122 Jul 2026
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; >= 4.5.0, <= 4.5.9 · CVE-2026-73416 · GHSA-89vp-jrxv-24w8 · amended
22 Jul 2026Evidence →
Medium, CVSS 6.022 Jul 2026
JupyterLab PluginManager lock-rule enforcement bypass
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; >= 4.1.0, <= 4.5.9 · CVE-2026-73627 · GHSA-h5v5-8746-g7mm · amended
22 Jul 2026Evidence →
High, CVSS 7.722 Jul 2026
JupyterLab: Allowlist/blocklist check in PyPIExtensionManager.install() not enforced for direct callers (missing await)
PyPI jupyterlab · Upgrade to 4.6.2 or 4.5.10 by release line · >= 4.6.0, <= 4.6.1; <= 4.5.9 · CVE-2026-73626 · GHSA-whvh-wf3x-g77j · amended
22 Jul 2026Evidence →
High, CVSS 8.322 Jul 2026
Next.js: Server-Side Request Forgery in Server Actions on custom servers
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 14.1.1, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64649 · GHSA-89xv-2m56-2m9x · amended
22 Jul 2026Evidence →
Medium, CVSS 6.022 Jul 2026
Next.js: Cache confusion of response bodies for requests with bodies
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64648 · GHSA-68g3-v927-f742 · amended
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64647 · GHSA-4633-3j49-mh5q · amended
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Next.js: Unbounded Server Action payload in Edge runtime
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64646 · GHSA-4c39-4ccg-62r3 · amended
22 Jul 2026Evidence →
High, CVSS 8.322 Jul 2026
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64645 · GHSA-p9j2-gv94-2wf4 · amended
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Next.js: Denial of Service in the Image Optimization API using SVGs
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 15.5.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64644 · GHSA-q8wf-6r8g-63ch · amended
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Next.js: Unauthenticated disclosure of internal Server Function endpoints
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64643 · GHSA-955p-x3mx-jcvp · amended
22 Jul 2026Evidence →
High, CVSS 8.322 Jul 2026
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
npm next · Upgrade to 16.2.11 or later · >= 16.0.0, < 16.2.11 · CVE-2026-64642 · GHSA-6gpp-xcg3-4w24 · amended
22 Jul 2026Evidence →
High, CVSS 8.222 Jul 2026
Next.js: Denial of Service in App Router using Server Actions
npm next · Upgrade to 16.2.11 or 15.5.21 by release line · >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 · CVE-2026-64641 · GHSA-m99w-x7hq-7vfj · amended
22 Jul 2026Evidence →
High, CVSS 7.522 Jul 2026
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Maven org.eclipse.jetty:jetty-server · Upgrade to 11.0.23 or 10.0.23 by release line · >= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23 · CVE-2024-7708 · GHSA-9299-c6m4-mjhc
22 Jul 2026Evidence →
Medium, CVSS 5.322 Jul 2026
Eclipse Jetty: Path parameter traversal
Maven org.eclipse.jetty:jetty-util · Upgrade to 12.1.9 or 12.0.35 by release line · >= 12.0.0, <= 12.0.34; >= 12.1.0, <= 12.1.8 · CVE-2026-8384 · GHSA-w7x5-g22v-xqhr
22 Jul 2026Evidence →
Medium, CVSS 5.322 Jul 2026
Eclipse Jetty: HTTP Authority/Host mismatch
Maven org.eclipse.jetty:jetty-server · Upgrade to 12.1.9 or 12.0.35 by release line; some affected versions have no fix yet · >= 9.4.0.v20161208, <= 9.4.58.v20250814; >= 10.0.0, <= 10.0.26; >= 11.0.0, <= 11.0.26; >= 12.0.0, <= 12.0.34; >= 12.1.0, <= 12.1.8 · CVE-2026-6790 · GHSA-7p3p-8qv8-m2vh
22 Jul 2026Evidence →
Medium, CVSS 6.922 Jul 2026
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
Maven org.eclipse.jetty:jetty-server · Upgrade to 12.1.10 or 12.0.36 by release line · >= 12.0.0, <= 12.0.35; >= 12.1.0, <= 12.1.9 · CVE-2026-10051 · GHSA-f4v5-65jj-pcr2
22 Jul 2026Evidence →
High, CVSS 8.722 Jul 2026
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
Maven org.eclipse.jetty.ee9:jetty-ee9-security · Upgrade to 12.1.10 or 12.0.36 by release line · >= 12.0.0, <= 12.0.35; >= 12.1.0, <= 12.1.9 · +2 more packages · CVE-2026-10050 · GHSA-2fvj-hgj9-j2gr
22 Jul 2026Evidence →
Medium, CVSS 5.122 Jul 2026
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65589 · GHSA-89gh-3pgc-v5h2 · amended
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-59943 · GHSA-j8qw-6jw8-r297
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-59942 · GHSA-f5gf-2cj8-52g2
22 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Next.js: Cache confusion of response bodies for requests with bodies

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Next.js: Unbounded Server Action payload in Edge runtime

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js: Denial of Service in the Image Optimization API using SVGs

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js: Denial of Service in App Router using Server Actions

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Eclipse Jetty: Path parameter traversal

Eclipse Jetty: HTTP Authority/Host mismatch

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence