Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 42 matching · newest first

Exploited 6 Aug 2026 ×Clear filters

Medium, CVSS 6.96 Aug 2026
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Packagist craftcms/cms · Upgrade to 5.10.6 or 4.18.2 by release line · >= 5.0.0-RC1, < 5.10.6; >= 4.0.0-RC1, < 4.18.2 · CVE-2026-72779 · GHSA-957r-qf9p-67xw · amended
6 Aug 2026Evidence →
Medium, CVSS 5.36 Aug 2026
h2: Duplicate Host header could facilitate request smuggling
PyPI h2 · Upgrade to 4.4.1 or later · <= 4.4.0 · CVE-2026-71554 · GHSA-6hr6-w5qg-qmwg
6 Aug 2026Evidence →
Medium, CVSS 5.16 Aug 2026
Craft CMS: Authenticated leak of secret environment variables
Packagist craftcms/cms · Upgrade to 5.10.6 or 4.18.2 by release line · >= 5.0.0-RC1, < 5.10.6; >= 4.0.0-RC1, < 4.18.2 · CVE-2026-72782 · GHSA-596p-6jv8-775v · amended
6 Aug 2026Evidence →
Medium, CVSS 5.36 Aug 2026
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
Packagist craftcms/cms · Upgrade to 5.10.6 or later · >= 5.0.0-RC1, < 5.10.6 · CVE-2026-72785 · GHSA-xxpx-f366-4xpq · amended
6 Aug 2026Evidence →
Medium, CVSS 5.36 Aug 2026
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
Packagist craftcms/cms · Upgrade to 5.10.3 or 4.18.1 by release line · >= 4.0.0-RC1, < 4.18.1; >= 5.0.0-RC1, < 5.10.3 · CVE-2026-14794 · GHSA-rvmm-v933-jgxq · amended
6 Aug 2026Evidence →
Low, CVSS 2.16 Aug 2026
Craft CMS: Incorrect path validation could potentially lead to path traversal
Packagist craftcms/cms · Upgrade to 5.10.6 or 4.18.2 by release line · >= 5.0.0-RC1, < 5.10.6; >= 4.0.0-RC1, < 4.18.2 · CVE-2026-72783 · GHSA-7hxc-f267-h5q7 · amended
6 Aug 2026Evidence →
Medium, CVSS 5.16 Aug 2026
Craft CMS: Stored XSS in the control panel via unescaped draft name
Packagist craftcms/cms · Upgrade to 5.10.8 or later · >= 5.0.0-RC1, < 5.10.8 · CVE-2026-72787 · GHSA-2rp4-x2j7-qmcc · amended
6 Aug 2026Evidence →
High, CVSS 7.36 Aug 2026
PHP_CodeSniffer gitblame report command injection via crafted filename
Packagist squizlabs/php_codesniffer · Upgrade to 4.0.2 or 3.13.6 by release line · < 3.13.6; >= 4.0.0, < 4.0.2 · CVE-2026-67434 · GHSA-hmqg-cxww-wqhq · amended
6 Aug 2026Evidence →
Medium, CVSS 5.16 Aug 2026
node-re2: Out-of-bounds heap read in replace/split via a Buffer ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
npm re2 · Upgrade to 1.26.1 or later · <= 1.26.0 · CVE-2026-71498 · GHSA-j4r3-hg7j-8chg
6 Aug 2026Evidence →
Medium, CVSS 6.26 Aug 2026
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
npm re2 · Upgrade to 1.25.1 or later · <= 1.25.0 · CVE-2026-71430 · GHSA-8hcv-x26h-mcgp
6 Aug 2026Evidence →
High, CVSS 8.66 Aug 2026
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
npm ngx-extended-pdf-viewer · Upgrade to 29.0.0-rc.3 (pre-release) or later · >= 27.0.0-rc.0, < 29.0.0-rc.3 · GHSA-w9hm-4m3m-fxmm
6 Aug 2026Evidence →
High, CVSS 8.66 Aug 2026
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
npm pdfjs-dist · Upgrade to 6.2.108 or later · >= 5.6.83, < 6.2.108 · CVE-2026-16633 · GHSA-hq66-cqwq-w95j
6 Aug 2026Evidence →
Medium, CVSS 4.76 Aug 2026
jsoup: Cleaner may expose markup with custom raw-text elements
Maven org.jsoup:jsoup · Upgrade to 1.23.1 or later · >= 1.14.3, < 1.23.1 · CVE-2026-71497 · GHSA-pmhh-3w7g-xqp8 · amended
6 Aug 2026Evidence →
Unrated6 Aug 2026
Craft CMS: Arbitrary user password reset leading to administrator account takeover
Packagist craftcms/cms · Upgrade to 5.10.8 or later · >= 5.0.0-RC1, < 5.10.8 · CVE-2026-72786 · GHSA-p8x7-9vfw-p7vc · amended
6 Aug 2026Evidence →
High, CVSS 8.76 Aug 2026
Craft CMS: Authenticated RCE through Twig sandbox escape
Packagist craftcms/cms · Upgrade to 5.10.7 or 4.18.3 by release line · >= 5.0.0-RC1, < 5.10.7; >= 4.0.0-RC1, < 4.18.3 · CVE-2026-72781 · GHSA-f5wm-88jv-g5hx · amended
6 Aug 2026Evidence →
Medium, CVSS 5.36 Aug 2026
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
Packagist craftcms/cms · Upgrade to 5.10.3 or 4.18.1 by release line · >= 4.0.0-RC1, < 4.18.1; >= 5.0.0-RC1, < 5.10.3 · CVE-2026-14793 · GHSA-9p7c-v5x3-rfx8 · amended
6 Aug 2026Evidence →
High, CVSS 8.76 Aug 2026
Craft CMS: Authenticated RCE via condition.config JSON cleanse bypass
Packagist craftcms/cms · Upgrade to 5.10.6 or 4.18.2 by release line · >= 5.0.0-RC1, < 5.10.6; >= 4.0.0-RC1, < 4.18.2 · CVE-2026-72778 · GHSA-265m-7826-wjqm · amended
6 Aug 2026Evidence →
Medium, CVSS 5.36 Aug 2026
league/commonmark: Denial of service via deeply nested XML output
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 2.0.0, < 2.9.0 · GHSA-mj63-m3rc-8ppr · amended
6 Aug 2026Evidence →
High, CVSS 7.56 Aug 2026
league/commonmark: Denial of service via colliding heading slugs
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 2.0.0, < 2.9.0 · CVE-2026-86434 · GHSA-mh25-x5hq-wrqp · amended
6 Aug 2026Evidence →
High, CVSS 7.56 Aug 2026
league/commonmark: Denial of service via duplicate footnote definitions
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 1.5.0, < 2.9.0 · GHSA-jfm3-95jq-q3rf · amended
6 Aug 2026Evidence →
High, CVSS 7.56 Aug 2026
league/commonmark: Denial of service via adjacent inline attribute blocks
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 1.5.0, < 2.9.0 · GHSA-g2gp-3wwq-f4ph · amended
6 Aug 2026Evidence →
High, CVSS 7.56 Aug 2026
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 0.6.0, < 2.9.0 · CVE-2026-71488 · GHSA-2q4p-g7hv-5rgv · amended
6 Aug 2026Evidence →
Medium, CVSS 6.16 Aug 2026
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
Packagist league/commonmark · Upgrade to 2.9.0 or later · >= 1.5.0, <= 2.8.3 · CVE-2026-71478 · GHSA-29pj-957v-52mc · amended
6 Aug 2026Evidence →
High, CVSS 7.56 Aug 2026
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
npm js-yaml · Upgrade to 4.3.1 or 3.15.1 by release line · >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.15.1 · GHSA-5p4m-2wfm-xmqj
6 Aug 2026Evidence →
Medium, CVSS 5.46 Aug 2026
Silverstripe: XSS in breadcrumbs in page list view
Packagist silverstripe/cms · Upgrade to 6.2.1 or later · < 6.2.1 · CVE-2026-54717 · GHSA-w3cp-g2pf-65wh · amended
6 Aug 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

h2: Duplicate Host header could facilitate request smuggling

Craft CMS: Authenticated leak of secret environment variables

Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

Craft CMS: Incorrect path validation could potentially lead to path traversal

Craft CMS: Stored XSS in the control panel via unescaped draft name

PHP_CodeSniffer gitblame report command injection via crafted filename

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

jsoup: Cleaner may expose markup with custom raw-text elements

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

league/commonmark: Denial of service via deeply nested XML output

league/commonmark: Denial of service via colliding heading slugs

league/commonmark: Denial of service via duplicate footnote definitions

league/commonmark: Denial of service via adjacent inline attribute blocks

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Silverstripe: XSS in breadcrumbs in page list view

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence