Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–50 of 52 matching · newest first

Exploited 3 Sep 2026 ×Clear filters

Critical, CVSS 10.03 Sep 2026
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721002947-23a17d44b5f3 (pre-release) or later · < 0.0.0-20260721002947-23a17d44b5f3 · CVE-2026-69084 · GHSA-vh22-h7hf-www7 · amended
3 Sep 2026Evidence →
High, CVSS 8.93 Sep 2026
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
Go github.com/rabbitmq/amqp091-go · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2026-79921 · GHSA-6c5v-hqjr-5xxp · amended
3 Sep 2026Evidence →
Medium, CVSS 6.13 Sep 2026
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close
npm sanitize-html · Upgrade to 2.17.6 or later · <= 2.17.5 · CVE-2026-63670 · GHSA-jxwj-j7wr-gfrw
3 Sep 2026Evidence →
Medium, CVSS 6.53 Sep 2026
ApostropheCMS: Missing destination-parent authorization in page move() allows a low-privileged editor to move and re-rank pages inside a restricted subtree
npm apostrophe · Upgrade to 4.32.0 or later · <= 4.31.0 · CVE-2026-63669 · GHSA-wr5r-wqp2-x4fh
3 Sep 2026Evidence →
Medium, CVSS 5.43 Sep 2026
Material for MkDocs: DOM XSS in search suggestions via query parameter
PyPI mkdocs-material · Upgrade to 9.7.7 or later · >= 7.2.0, < 9.7.7 · CVE-2026-73295 · GHSA-xvg9-69gf-fjrf
3 Sep 2026Evidence →
High, CVSS 8.33 Sep 2026
TOON: Prototype pollution when decoding untrusted TOON input
npm @toon-format/toon · Upgrade to 2.3.1 or later · < 2.3.1 · CVE-2026-82404 · GHSA-p95v-992w-h6c3
3 Sep 2026Evidence →
High, CVSS 8.83 Sep 2026
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
npm claude-code-templates · Upgrade to 1.29.4 or later · <= 1.29.2 · CVE-2026-73222 · GHSA-79wm-x847-7cvg
3 Sep 2026Evidence →
High, CVSS 8.83 Sep 2026
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 (pre-release) or later · < 0.0.0-20260705182501-bb2a4e1f08c8 · CVE-2026-73293 · GHSA-cxvf-gvfq-36w2 · amended
3 Sep 2026Evidence →
High, CVSS 7.63 Sep 2026
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260707190631-c59c3dc9035b (pre-release) or later · < 0.0.0-20260707190631-c59c3dc9035b · CVE-2026-73292 · GHSA-8cj9-r88m-8945 · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62681 · GHSA-fg9p-mrxr-hvq7 · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62682 · GHSA-88f2-fpv8-89q2 · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: Import-time RCE via schema default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72717 · GHSA-w727-8j6c-2rj4 · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: Import-time RCE via array-items default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71869 · GHSA-2h9g-j24r-h63g · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71871 · GHSA-8j6p-r8jg-mxqh · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71867 · GHSA-2w86-xfrc-g85r · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71868 · GHSA-3575-w9fc-c2j6 · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71865 · GHSA-653q-5476-x79g · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71864 · GHSA-6437-gxhq-pqv8 · amended
3 Sep 2026Evidence →
Medium, CVSS 6.83 Sep 2026
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root
Go github.com/VictoriaMetrics/VictoriaMetrics · Upgrade to 1.146.0, 1.136.12 or 1.122.25 by release line · >= 1.137.0, < 1.146.0; >= 1.123.0, < 1.136.12; < 1.122.25 · CVE-2026-61625 · GHSA-8q3c-rjr9-xxrp · amended
3 Sep 2026Evidence →
High, CVSS 8.73 Sep 2026
LiquidJS has an infinite loop vulnerability in its strip_html filter
npm liquidjs · Upgrade to 10.27.1 or later · >= 10.26.0, < 10.27.1 · CVE-2026-61556 · GHSA-m7fp-h3p4-hr49
3 Sep 2026Evidence →
High, CVSS 8.13 Sep 2026
OpenClaw Feishu tools could ignore per-account disablement
npm @openclaw/feishu · Upgrade to 2026.6.9 or later · < 2026.6.9 · CVE-2026-62187 · GHSA-2q7j-2vhx-56g8
3 Sep 2026Evidence →
Medium, CVSS 5.43 Sep 2026
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
Go github.com/cilium/cilium · Upgrade to 1.19.5 or later · >= 1.19.0, < 1.19.5 · CVE-2026-56743 · GHSA-fm8w-2m5w-9j7r · amended
3 Sep 2026Evidence →
Critical, CVSS 9.33 Sep 2026
unstructured: Server-Side Request Forgery in the URL-based partitioning
PyPI unstructured · Upgrade to 0.24.0 or later · >= 0.4.7, < 0.24.0 · CVE-2026-71428 · GHSA-4mvj-m6j5-pmf7 · amended
3 Sep 2026Evidence →
Medium, CVSS 6.53 Sep 2026
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260510110132-b763d787d1f2 (pre-release) or later · < 0.0.0-20260510110132-b763d787d1f2 · CVE-2026-65607 · GHSA-gw25-m53r-qh88 · amended
3 Sep 2026Evidence →
High, CVSS 8.73 Sep 2026
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260714095344-f08dee71ba8e (pre-release) or later · < 0.0.0-20260714095344-f08dee71ba8e · CVE-2026-66394 · GHSA-99rq-75j6-5j9f · amended
3 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

Material for MkDocs: DOM XSS in search suggestions via query parameter

TOON: Prototype pollution when decoding untrusted TOON input

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Orval: Import-time RCE via schema default -> zod module-level template literal

Orval: Import-time RCE via array-items default -> zod module-level template literal

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

LiquidJS has an infinite loop vulnerability in its `strip_html` filter

OpenClaw Feishu tools could ignore per-account disablement

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

unstructured: Server-Side Request Forgery in the URL-based partitioning

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence