Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–46 of 46 matching · newest first

Exploited 24 Sep 2026 ×Clear filters

High, CVSS 8.524 Sep 2026
Language Servers for AWS vulnerable to arbitrary file write
npm @aws/lsp-codewhisperer · Upgrade to 0.0.117 or later · < 0.0.117 · CVE-2026-12958 · GHSA-6v3r-4p5c-mrp5 · amended
24 Sep 2026Evidence →
High, CVSS 8.524 Sep 2026
Language Servers for AWS Vulnerable to Arbitrary Code Execution
npm @aws/lsp-codewhisperer · Upgrade to 0.0.113 or later · < 0.0.113 · CVE-2026-12957 · GHSA-xhcr-j4j9-3gh7 · amended
24 Sep 2026Evidence →
Medium, CVSS 4.824 Sep 2026
yara-x: Unvalidated deserialization in safe Rules::deserialize allows memory corruption and UB
crates.io yara-x · Upgrade to 1.19.0 or later · <= 1.18.0 · GHSA-2jx3-ff3v-j7jj · amended
24 Sep 2026Evidence →
High, CVSS 8.724 Sep 2026
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-63498 · GHSA-396x-xmvh-p563
24 Sep 2026Evidence →
High, CVSS 8.224 Sep 2026
ZITADEL: MFA bypass via session reuse in Login V2
Go github.com/zitadel/zitadel · Upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f (pre-release) or later · < 1.80.0-v2.20.0.20260717062356-56f4798ed31f · CVE-2026-85056 · GHSA-9993-rfwp-rhwf · amended
24 Sep 2026Evidence →
High, CVSS 8.724 Sep 2026
ZITADEL: Actions V1 sandbox escape: host file read via require()
Go github.com/zitadel/zitadel · Upgrade to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 (pre-release) or later · < 1.80.0-v2.20.0.20260717062331-baf6ed501b68 · CVE-2026-85057 · GHSA-fgmf-7rf8-m6vf · amended
24 Sep 2026Evidence →
High, CVSS 8.124 Sep 2026
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-62368 · GHSA-p9h3-gvpq-5539
24 Sep 2026Evidence →
Medium, CVSS 4.324 Sep 2026
Dozzle label filters do not restrict container event and statistics streams
Go github.com/amir20/dozzle · Upgrade to 1.29.1-0.20260622172006-19c01e0fb491 (pre-release) or later · < 1.29.1-0.20260622172006-19c01e0fb491 · CVE-2026-62286 · GHSA-xcw9-qmmf-vqxj · amended
24 Sep 2026Evidence →
High, CVSS 8.624 Sep 2026
Snipe-IT: 2FA bypass via the API token flow
Packagist snipe/snipe-it · Upgrade to 8.7.0 or later · < 8.7.0 · CVE-2026-63493 · GHSA-hxcx-9h4f-42xx
24 Sep 2026Evidence →
Medium, CVSS 6.524 Sep 2026
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
PyPI streamlink · Upgrade to 8.6.0 or later · <= 8.5.0 · CVE-2026-92164 · GHSA-vf2x-4v53-pm7v · amended
24 Sep 2026Evidence →
Critical, CVSS 10.024 Sep 2026
SunEditor: Critical XSS vulnerability - sanitizer bypass
npm suneditor · Upgrade to 2.47.11 or later · <= 2.47.10 · CVE-2026-59167 · GHSA-6rf4-v2fh-m6p4 · amended
24 Sep 2026Evidence →
Medium, CVSS 4.324 Sep 2026
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Packagist redaxo/source · Upgrade to 5.21.2 or later · <= 5.21.1 · CVE-2026-62998 · GHSA-4f5f-j737-pm58 · amended
24 Sep 2026Evidence →
Medium, CVSS 6.224 Sep 2026
Guest can panic host through filesystem datetime overflow
crates.io wasmtime-wasi · Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line · >= 0.0.0-0, < 36.0.16; >= 37.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115387 · GHSA-j2g9-4prp-pf6h
24 Sep 2026Evidence →
Medium, CVSS 5.724 Sep 2026
call_ref and exception catch can drop some fuel accounting, leading to exponential fuel amplification
crates.io wasmtime · Upgrade to 49.0.1 or 48.0.3 by release line · >= 47.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115390 · GHSA-m63x-6p34-q65x
24 Sep 2026Evidence →
Unrated24 Sep 2026
Use-after-free in interned values and cached function results
crates.io salsa · Upgrade to 0.28.5 or later · >= 0.23.0, < 0.28.5 · GHSA-xc3w-55vh-cw3w
24 Sep 2026Evidence →
Medium, CVSS 6.224 Sep 2026
Outgoing HTTP body write allows guest-driven host memory exhaustion
crates.io wasmtime-wasi-http · Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line · >= 0.0.0-0, < 36.0.16; >= 37.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115388 · GHSA-c9gc-w9vx-w86p
24 Sep 2026Evidence →
High, CVSS 7.424 Sep 2026
Excluded iPAddress name constraints with an all-zero mask are not applied
crates.io x509-validator · Upgrade to 0.3.1 or later · >= 0.0.0-0, < 0.3.1 · GHSA-39mm-4q6x-3vrx
24 Sep 2026Evidence →
Low, CVSS 1.024 Sep 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
crates.io wasmtime · Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line · >= 0.0.0-0, < 36.0.16; >= 37.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115389 · GHSA-jqpg-j7w6-42pr · amended
24 Sep 2026Evidence →
Unrated24 Sep 2026
PHP CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison
Bitnami php +3 · Upgrade all 4 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-91768 · GHSA-62xp-839h-2637 · amended
24 Sep 2026Evidence →
Unrated24 Sep 2026
PHP CVE-2026-92842: Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL
Bitnami php +3 · Upgrade all 4 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-92842 · GHSA-88hq-2827-7pg6 · amended
24 Sep 2026Evidence →
Unrated24 Sep 2026
PHP CVE-2026-91767: Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN
Bitnami php +3 · Upgrade all 4 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-91767 · GHSA-xr7j-rvgx-xq5p · amended
24 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Language Servers for AWS vulnerable to arbitrary file write

Language Servers for AWS Vulnerable to Arbitrary Code Execution

yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL: Actions V1 sandbox escape: host file read via require()

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Dozzle label filters do not restrict container event and statistics streams

Snipe-IT: 2FA bypass via the API token flow

Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

SunEditor: Critical XSS vulnerability - sanitizer bypass

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Guest can panic host through filesystem datetime overflow

`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification

Use-after-free in interned values and cached function results

Outgoing HTTP body write allows guest-driven host memory exhaustion

Excluded iPAddress name constraints with an all-zero mask are not applied

Dynamic record lifting can allocate beyond the hostcall fuel limit

PHP CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison

PHP CVE-2026-92842: Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL

PHP CVE-2026-91767: Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence