Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 25 matching · newest first

Exploited 28 Sep 2026 ×Clear filters

Medium, CVSS 5.928 Sep 2026
Nodemailer: Process-global DNS cache reuses TLS servername across transports, enabling cross-tenant SMTP credential disclosure
npm nodemailer · Upgrade to 10.0.2 or later · >= 5.0.0, < 10.0.2 · CVE-2026-100701 · GHSA-6vj9-mwq6-2f5v · amended
28 Sep 2026Evidence →
Medium, CVSS 5.928 Sep 2026
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
npm undici · Upgrade to 8.10.2, 7.29.1 or 6.28.1 by release line · >= 6.25.0, < 6.28.1; >= 7.28.0, < 7.29.1; >= 8.1.0, < 8.10.2 · CVE-2026-85024 · GHSA-3wwx-pv8p-q78v · amended
28 Sep 2026Evidence →
Medium, CVSS 5.328 Sep 2026
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
npm multer · Upgrade to 2.4.0 or later · >= 2.2.0, < 2.4.0 · CVE-2026-88932 · GHSA-3pph-fpjx-jg34 · amended
28 Sep 2026Evidence →
Medium, CVSS 5.328 Sep 2026
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
npm morgan · Upgrade to 1.12.1 or later · < 1.12.1 · CVE-2026-87859 · GHSA-9f6g-j8ch-79g4 · amended
28 Sep 2026Evidence →
High, CVSS 8.728 Sep 2026
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
npm @angular/platform-server · Upgrade to 22.1.6, 21.2.23 or 20.3.31 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.6; >= 21.0.0, < 21.2.23; >= 20.0.0, < 20.3.31; <= 19.2.25 · CVE-2026-101895 · GHSA-f67j-2jqw-jpq7 · amended
28 Sep 2026Evidence →
High, CVSS 7.528 Sep 2026
fast-uri vulnerable to authority injection via an unvalidated port in serialize
npm fast-uri · Upgrade to 4.1.4, 3.1.7 or 2.4.6 by release line · < 2.4.6; >= 3.0.0, < 3.1.7; >= 4.0.0, < 4.1.4 · CVE-2026-84292 · GHSA-qw65-cvwx-89v3 · amended
28 Sep 2026Evidence →
High, CVSS 7.528 Sep 2026
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
npm fast-uri · Upgrade to 4.1.4, 3.1.7 or 2.4.6 by release line · >= 2.4.5, <= 2.4.5; >= 3.1.6, <= 3.1.6; >= 4.1.3, <= 4.1.3 · CVE-2026-84394 · GHSA-58mr-gqgx-xq4g · amended
28 Sep 2026Evidence →
Medium, CVSS 5.628 Sep 2026
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.2 or 3.1.6 by release line · >= 3.0.0, < 3.1.6; >= 3.2.0, < 3.2.2 · +1 more package · CVE-2026-83557 · GHSA-gx83-3vf8-gh7j · amended
28 Sep 2026Evidence →
Medium, CVSS 6.328 Sep 2026
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
npm ip-address · Upgrade to 10.5.1 or later · <= 10.5.0 · CVE-2026-101913 · GHSA-rpw4-54j3-4h4q · amended
28 Sep 2026Evidence →
Medium, CVSS 6.928 Sep 2026
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
npm ip-address · Upgrade to 10.5.1 or later · >= 10.2.0, <= 10.5.0 · CVE-2026-101910 · GHSA-2vr4-cq9g-pvrc · amended
28 Sep 2026Evidence →
High, CVSS 8.628 Sep 2026
Angular SSR: XSS via Unescaped Processing Instruction ( ) Nodes in Fallback Raw-Content Elements
npm @angular/platform-server · Upgrade to 22.1.4, 21.2.22 or 20.3.30 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.1.4; >= 21.0.0, < 21.2.22; >= 20.0.0, < 20.3.30; <= 19.2.25 · CVE-2026-88058 · GHSA-j3r3-mxqp-r2p4 · amended
28 Sep 2026Evidence →
High, CVSS 7.528 Sep 2026
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.2 or 3.1.6 by release line · >= 3.2.0, < 3.2.2; >= 3.0.0, < 3.1.6 · +1 more package · CVE-2026-68497 · GHSA-q4xh-88c3-wmh7 · amended
28 Sep 2026Evidence →
Medium, CVSS 5.328 Sep 2026
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.2 or 3.1.6 by release line · >= 3.0.0, < 3.1.6; >= 3.2.0, < 3.2.2 · +1 more package · CVE-2026-19032 · GHSA-wjgm-6hv5-3cvf · amended
28 Sep 2026Evidence →
Medium, CVSS 5.328 Sep 2026
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.1 or 3.1.5 by release line · >= 3.0.0, < 3.1.5; >= 3.2.0, < 3.2.1 · +1 more package · CVE-2026-77310 · GHSA-vvgp-rfg2-7rr6 · amended
28 Sep 2026Evidence →
Medium, CVSS 6.528 Sep 2026
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
npm @grpc/grpc-js-xds · Upgrade to 1.14.1 or 1.13.1 by release line · < 1.13.1; >= 1.14.0, <= 1.14.0 · CVE-2026-101914 · GHSA-88h9-xgvx-hvf2 · amended
28 Sep 2026Evidence →
Medium, CVSS 6.428 Sep 2026
Mattermost doesn't validate channel ownership of an existing subscription before applying edits
Go github.com/mattermost/mattermost-server · Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line · >= 11.7.0, < 11.7.1; >= 11.6.0, < 11.6.3; >= 11.5.0, < 11.5.6; >= 10.11.0, < 10.11.18 · CVE-2026-6062 · GHSA-mxq2-5jpg-7474 · amended
28 Sep 2026Evidence →
High, CVSS 7.128 Sep 2026
Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.1 or later · < 0.91.1 · CVE-2026-61687 · GHSA-phg3-3g28-wq9v · amended
28 Sep 2026Evidence →
Medium, CVSS 4.328 Sep 2026
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation
Go github.com/mattermost/mattermost-server · Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line · >= 11.7.0, < 11.7.1; >= 11.6.0, < 11.6.3; >= 11.5.0, < 11.5.6; >= 10.11.0, < 10.11.18 · CVE-2026-9162 · GHSA-h998-hxxj-8q83 · amended
28 Sep 2026Evidence →
Medium, CVSS 5.428 Sep 2026
Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler
Go github.com/mattermost/mattermost-server · Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line · >= 11.7.0, < 11.7.1; >= 11.6.0, < 11.6.3; >= 11.5.0, < 11.5.6; >= 10.11.0, < 10.11.18 · CVE-2026-5139 · GHSA-2g8v-grq3-hq2g · amended
28 Sep 2026Evidence →
Critical, CVSS 9.028 Sep 2026
Canonical ADSys Uses a Less Trusted Source
Go github.com/ubuntu/adsys · Upgrade to 0.16.3-0.20250318112551-8b1939f96d38 (pre-release) or later · < 0.16.3-0.20250318112551-8b1939f96d38 · CVE-2026-12249 · GHSA-crm4-q7v4-c2r2 · amended
28 Sep 2026Evidence →
Low, CVSS 3.828 Sep 2026
Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint
Go github.com/mattermost/mattermost-server · Upgrade to 11.7.1 or 10.11.18 by release line · >= 11.7.0, < 11.7.1; >= 10.11.0, < 10.11.18 · CVE-2026-8074 · GHSA-g5vr-6pgg-74qv · amended
28 Sep 2026Evidence →
Medium, CVSS 6.428 Sep 2026
Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret
Go github.com/mattermost/mattermost-server · Upgrade to 11.7.1, 11.6.3, 11.5.6 or 10.11.18 by release line · >= 11.7.0, < 11.7.1; >= 11.6.0, < 11.6.3; >= 11.5.0, < 11.5.6; >= 10.11.0, < 10.11.18 · CVE-2026-6673 · GHSA-jqgv-39mg-7c2r · amended
28 Sep 2026Evidence →
Medium, CVSS 4.328 Sep 2026
scim-patch: Mutation of Inherited Built-in Method Objects
npm scim-patch · Upgrade to 0.9.2 or later · < 0.9.2 · CVE-2026-61834 · GHSA-2mhw-wcx5-v3xj · amended
28 Sep 2026Evidence →
High, CVSS 7.828 Sep 2026
code-ollama: grep_search Command Injection via Unescaped $() Shell Substitution (CWE-78)
npm code-ollama · Upgrade to 0.36.1 or later · <= 0.36.0 · GHSA-456v-xq2p-r4cj · amended
28 Sep 2026Evidence →
Medium, CVSS 5.628 Sep 2026
Hybrid Encapsulation from Seed Panics on Short Seed
crates.io libcrux-kem · Upgrade to 0.0.10 or later · >= 0.0.0-0, < 0.0.10 · amended
28 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

fast-uri vulnerable to authority injection via an unvalidated port in serialize

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Angular SSR: XSS via Unescaped Processing Instruction ( ) Nodes in Fallback Raw-Content Elements

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Mattermost doesn't validate channel ownership of an existing subscription before applying edits

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation

Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler

Canonical ADSys Uses a Less Trusted Source

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret

scim-patch: Mutation of Inherited Built-in Method Objects

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

Hybrid Encapsulation from Seed Panics on Short Seed

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence