Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 25 matching · newest first

Show all severities

Exploited 24 Sep 2026 ×Clear filters

High, CVSS 7.424 Sep 2026
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
PyPI social-auth-core · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2026-57178 · GHSA-3c93-f73f-qc9h · amended
24 Sep 2026Evidence →
High, CVSS 8.424 Sep 2026
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
PyPI compliance-trestle · Upgrade to 4.1.0 or 3.12.4 by release line · < 3.12.4; >= 4.0.0, < 4.1.0 · CVE-2026-57171 · GHSA-r4vp-3vw6-r2x5 · amended
24 Sep 2026Evidence →
High, CVSS 7.824 Sep 2026
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
PyPI compliance-trestle · Upgrade to 4.1.0 or 3.12.4 by release line · < 3.12.4; >= 4.0.0, < 4.1.0 · CVE-2026-57170 · GHSA-mr95-65j8-9mxp · amended
24 Sep 2026Evidence →
High, CVSS 8.824 Sep 2026
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (/browser endpoint)
npm cline · Upgrade to 3.0.30 or later · < 3.0.30 · CVE-2026-59723 · GHSA-3cj3-hqcr-g934 · amended
24 Sep 2026Evidence →
High, CVSS 7.224 Sep 2026
zbateson/mail-mime-parser has CRLF header injection via attachment filename
Packagist zbateson/mail-mime-parser · Upgrade to 4.0.2 or 3.0.6 by release line · < 3.0.6; >= 4.0.0, < 4.0.2 · CVE-2026-61815 · GHSA-36h5-qg4p-q2qf · amended
24 Sep 2026Evidence →
High, CVSS 7.524 Sep 2026
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
Packagist zbateson/mail-mime-parser · Upgrade to 4.0.2 or 3.0.6 by release line · >= 2.0.0, < 3.0.6; >= 4.0.0, < 4.0.2 · CVE-2026-61816 · GHSA-f6v3-2qmr-vfjx · amended
24 Sep 2026Evidence →
High, CVSS 7.524 Sep 2026
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
npm @rsdoctor/rspack-plugin · Upgrade to 1.5.16 or later · <= 1.5.15 · CVE-2026-61782 · GHSA-jmg2-rcxh-w8q3 · amended
24 Sep 2026Evidence →
High, CVSS 7.424 Sep 2026
@bytebase/dbhub's read-only mode does not prevent database writes
npm @bytebase/dbhub · Upgrade to 0.22.6 or later · < 0.22.6 · CVE-2026-61788 · GHSA-mwwr-p57h-56pf · amended
24 Sep 2026Evidence →
Critical, CVSS 9.324 Sep 2026
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
npm @bytebase/dbhub · Upgrade to 0.22.5 or later · <= 0.22.4 · CVE-2026-61742 · GHSA-fm8p-53ww-hf6w · amended
24 Sep 2026Evidence →
Critical, CVSS 9.324 Sep 2026
http4s-scala-xml has an XML External Entity (XXE) processing issue
Maven org.http4s:http4s-scala-xml_2.12 · Upgrade to 0.24.1 or later · <= 0.24.0 · +2 more packages · CVE-2026-61741 · GHSA-cjx3-73hr-rpw7 · amended
24 Sep 2026Evidence →
High, CVSS 8.724 Sep 2026
@bsv/wallet-toolbox / -client / -mobile don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
npm @bsv/wallet-toolbox +2 · Upgrade all 3 to 2.4.0 or later · >= 1.1.47, < 2.4.0 · CVE-2026-56744 · GHSA-36f9-7rg5-cpf8 · amended
24 Sep 2026Evidence →
High, CVSS 8.524 Sep 2026
phpMyFAQ has SQL Injection in StopWords::add() — Unescaped Stop Word Insertion
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.6 or later · <= 4.1.5 · CVE-2026-56738 · GHSA-rw77-vq4g-x3hp · amended
24 Sep 2026Evidence →
High, CVSS 8.124 Sep 2026
phpMyFAQ's two-factor authentication login bypasses the password factor
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.1.6 or later · >= 3.2.0, < 4.1.6 · CVE-2026-56737 · GHSA-8gpw-xvpf-hvx5 · amended
24 Sep 2026Evidence →
High, CVSS 8.224 Sep 2026
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
Packagist phpmyfaq/phpmyfaq +1 · Upgrade all 2 to 4.2.0-alpha (pre-release) or later · < 4.2.0-alpha · CVE-2026-56736 · GHSA-pgwp-vc7q-cvj3 · amended
24 Sep 2026Evidence →
High, CVSS 7.524 Sep 2026
langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
PyPI langchain-nvidia-ai-endpoints · Upgrade to 1.4.2 or later · <= 1.4.1 · GHSA-g28h-2cmm-rj9x · amended
24 Sep 2026Evidence →
Critical, CVSS 10.024 Sep 2026
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
PyPI decepticon +2 · Upgrade all 3 to 1.1.17 or later · <= 1.1.16 · CVE-2026-61732 · GHSA-g5f9-3xfg-p9mf · amended
24 Sep 2026Evidence →
High, CVSS 8.524 Sep 2026
Language Servers for AWS vulnerable to arbitrary file write
npm @aws/lsp-codewhisperer · Upgrade to 0.0.117 or later · < 0.0.117 · CVE-2026-12958 · GHSA-6v3r-4p5c-mrp5 · amended
24 Sep 2026Evidence →
High, CVSS 8.524 Sep 2026
Language Servers for AWS Vulnerable to Arbitrary Code Execution
npm @aws/lsp-codewhisperer · Upgrade to 0.0.113 or later · < 0.0.113 · CVE-2026-12957 · GHSA-xhcr-j4j9-3gh7 · amended
24 Sep 2026Evidence →
High, CVSS 8.724 Sep 2026
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-63498 · GHSA-396x-xmvh-p563
24 Sep 2026Evidence →
High, CVSS 8.224 Sep 2026
ZITADEL: MFA bypass via session reuse in Login V2
Go github.com/zitadel/zitadel · Upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f (pre-release) or later · < 1.80.0-v2.20.0.20260717062356-56f4798ed31f · CVE-2026-85056 · GHSA-9993-rfwp-rhwf · amended
24 Sep 2026Evidence →
High, CVSS 8.724 Sep 2026
ZITADEL: Actions V1 sandbox escape: host file read via require()
Go github.com/zitadel/zitadel · Upgrade to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 (pre-release) or later · < 1.80.0-v2.20.0.20260717062331-baf6ed501b68 · CVE-2026-85057 · GHSA-fgmf-7rf8-m6vf · amended
24 Sep 2026Evidence →
High, CVSS 8.124 Sep 2026
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-62368 · GHSA-p9h3-gvpq-5539
24 Sep 2026Evidence →
High, CVSS 8.624 Sep 2026
Snipe-IT: 2FA bypass via the API token flow
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-63493 · GHSA-hxcx-9h4f-42xx
24 Sep 2026Evidence →
Critical, CVSS 10.024 Sep 2026
SunEditor: Critical XSS vulnerability - sanitizer bypass
npm suneditor · Upgrade to 2.47.11 or later · <= 2.47.10 · CVE-2026-59167 · GHSA-6rf4-v2fh-m6p4 · amended
24 Sep 2026Evidence →
High, CVSS 7.424 Sep 2026
Excluded iPAddress name constraints with an all-zero mask are not applied
crates.io x509-validator · Upgrade to 0.3.1 or later · >= 0.0.0-0, < 0.3.1 · GHSA-39mm-4q6x-3vrx
24 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

@bytebase/dbhub's read-only mode does not prevent database writes

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

http4s-scala-xml has an XML External Entity (XXE) processing issue

`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Language Servers for AWS vulnerable to arbitrary file write

Language Servers for AWS Vulnerable to Arbitrary Code Execution

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL: Actions V1 sandbox escape: host file read via require()

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT: 2FA bypass via the API token flow

SunEditor: Critical XSS vulnerability - sanitizer bypass

Excluded iPAddress name constraints with an all-zero mask are not applied

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence