Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 39 matching · newest first

Exploited 5 Aug 2026 ×Clear filters

High, CVSS 7.55 Aug 2026
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 · CVE-2026-71321 · GHSA-9pgf-384g-p7mv
5 Aug 2026Evidence →
High, CVSS 8.15 Aug 2026
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.4.0, < 3.21.10 · CVE-2026-71320 · GHSA-9473-5f9j-94wq
5 Aug 2026Evidence →
Critical, CVSS 9.65 Aug 2026
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
npm @nuxt/devtools · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2026-71319 · GHSA-279x-mwfv-vcqv · amended
5 Aug 2026Evidence →
Medium, CVSS 4.85 Aug 2026
Nuxt: Unauthorized Component Instantiation via Server Island Props
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 · CVE-2026-71318 · GHSA-48hr-524c-v5w3
5 Aug 2026Evidence →
High, CVSS 7.55 Aug 2026
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
npm nuxt · Upgrade to 4.5.1 or later · >= 4.4.0, <= 4.5.0 · CVE-2026-71316 · GHSA-wm8w-6qjm-cv43
5 Aug 2026Evidence →
High, CVSS 8.25 Aug 2026
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 · CVE-2026-71315 · GHSA-hxvh-4h3w-prp9
5 Aug 2026Evidence →
High, CVSS 7.55 Aug 2026
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
npm nuxt · Upgrade to 4.5.1 or 3.21.10 by release line · >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 · CVE-2026-71314 · GHSA-hxcr-hm88-mpq6
5 Aug 2026Evidence →
Medium, CVSS 6.95 Aug 2026
rclone: Local Encoding Path Traversal
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · >= 1.51.0, <= 1.74.4 · CVE-2026-71313 · GHSA-7p4m-qxvv-g567 · amended
5 Aug 2026Evidence →
Medium, CVSS 5.05 Aug 2026
rclone archive extract allows S3 destination prefix escape via crafted archive paths
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-59732 · GHSA-4vr5-p2gc-h23p · amended
5 Aug 2026Evidence →
Critical, CVSS 9.35 Aug 2026
rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79782 · GHSA-gx4c-2hqx-cw2r · amended
5 Aug 2026Evidence →
High, CVSS 8.85 Aug 2026
rclone serve restic --private-repos authorization bypass: .. in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-59733 · GHSA-fqj9-69pf-6pjg · amended
5 Aug 2026Evidence →
High, CVSS 8.05 Aug 2026
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.4 · CVE-2026-71312 · GHSA-2m8m-jhrm-w6j2 · amended
5 Aug 2026Evidence →
Medium, CVSS 6.05 Aug 2026
rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-79779 · GHSA-h4mf-4v27-hggj · amended
5 Aug 2026Evidence →
Medium, CVSS 6.45 Aug 2026
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · < 1.75.0 · CVE-2026-71311 · GHSA-8c48-q9wj-3w37 · amended
5 Aug 2026Evidence →
Medium, CVSS 6.05 Aug 2026
rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-79780 · GHSA-8mxv-9xhp-86h4 · amended
5 Aug 2026Evidence →
Medium, CVSS 6.95 Aug 2026
rclone: Path traversal in serve s3 allows reading and overwriting root-level files
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79781 · GHSA-8v25-v8p6-qf7v · amended
5 Aug 2026Evidence →
Medium, CVSS 6.05 Aug 2026
rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-79778 · GHSA-3x6r-wxxg-53vv · amended
5 Aug 2026Evidence →
Medium, CVSS 5.95 Aug 2026
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-71310 · GHSA-xhf4-832v-7xcr · amended
5 Aug 2026Evidence →
High, CVSS 7.55 Aug 2026
rclone: Unvalidated symlink target in local --links — arbitrary file write from an untrusted remote
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-54572 · GHSA-cf44-9pgv-m4xc · amended
5 Aug 2026Evidence →
High, CVSS 8.65 Aug 2026
rclone: Incomplete path validation allows backend root escape in serve restic
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · >= 1.40.0, < 1.75.0 · CVE-2026-71309 · GHSA-45pq-889g-fcgh · amended
5 Aug 2026Evidence →
Low, CVSS 2.05 Aug 2026
rclone local --metadata applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79783 · GHSA-945v-v9p3-v5xw · amended
5 Aug 2026Evidence →
Medium, CVSS 5.15 Aug 2026
rclone: Verbose Stack Trace Disclosure in RC API Error Responses
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.4 · CVE-2026-79777 · GHSA-gwfq-86j8-7qhv · amended
5 Aug 2026Evidence →
Medium, CVSS 5.45 Aug 2026
Electron: Sandboxed iframes can launch external protocol handlers
npm electron · Upgrade to 42.0.0-beta.3 (pre-release), 41.2.1, 40.9.0 or 39.8.8 by release line · < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3 · CVE-2026-70612 · GHSA-p2rr-rvmm-c5fp
5 Aug 2026Evidence →
Medium, CVSS 6.95 Aug 2026
Electron: DevTools embedder handler executes arbitrary files via shell open
npm electron · Upgrade to 42.0.0-beta.3 (pre-release), 41.2.1, 40.9.2 or 39.8.9 by release line · < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3 · CVE-2026-70611 · GHSA-f2r8-jv7c-xqmp
5 Aug 2026Evidence →
Medium, CVSS 5.45 Aug 2026
Electron: contextBridge object copy honors prototype setters
npm electron · Upgrade to 42.0.0-beta.4 (pre-release), 41.2.2, 40.9.2 or 39.8.9 by release line · < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.2; >= 42.0.0-alpha.1, < 42.0.0-beta.4 · CVE-2026-70610 · GHSA-ff2p-hmqr-hxm4
5 Aug 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Nuxt: Unauthorized Component Instantiation via Server Island Props

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

rclone: Local Encoding Path Traversal

rclone archive extract allows S3 destination prefix escape via crafted archive paths

rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

rclone: Incomplete path validation allows backend root escape in serve restic

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Electron: Sandboxed iframes can launch external protocol handlers

Electron: DevTools embedder handler executes arbitrary files via shell open

Electron: contextBridge object copy honors prototype setters

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence