Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–50 of 54 matching · newest first

Exploited 30 Sep 2026 ×Clear filters

High, CVSS 8.230 Sep 2026
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
npm @angular/router · Upgrade to 22.2.0, 21.2.24 or 20.3.32 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.2.0; >= 21.0.0, < 21.2.24; >= 20.0.0, < 20.3.32; <= 19.2.25 · CVE-2026-101896 · GHSA-ff3f-86qr-9cv3 · amended
30 Sep 2026Evidence →
Low, CVSS 2.330 Sep 2026
Serialize JavaScript: Cross-site scripting (XSS) via unescaped in serialized function bodies
npm serialize-javascript · Upgrade to 7.1.2 or later · >= 7.1.1, < 7.1.2 · CVE-2026-97711 · GHSA-gfhx-hw2g-v5hg · amended
30 Sep 2026Evidence →
Low, CVSS 2.330 Sep 2026
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
npm dompurify · Upgrade to 3.4.16 or later · >= 3.4.13, <= 3.4.15 · CVE-2026-109344 · GHSA-p98j-92pf-mc4p · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
jackson-databind quadratic forward-reference completion
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.3 or 3.1.7 by release line · >= 3.0.0, <= 3.1.6; >= 3.2.0, <= 3.2.2 · +1 more package · CVE-2026-91777 · GHSA-cxp5-3px4-pw24 · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
jackson-databind retains every unknown raw type ID
Maven tools.jackson.core:jackson-databind · Upgrade to 3.2.3 or 3.1.7 by release line · >= 3.0.0, <= 3.1.6; >= 3.2.0, <= 3.2.2 · +1 more package · CVE-2026-91776 · GHSA-wv8q-qhhj-9h54 · amended
30 Sep 2026Evidence →
Medium, CVSS 6.130 Sep 2026
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
Packagist league/commonmark · Upgrade to 2.10.2 or later · >= 1.3.0, <= 2.10.1 · CVE-2026-105829 · GHSA-97jj-33gv-5xf9 · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Packagist league/commonmark · Upgrade to 2.10.2 or later · >= 2.0.0, <= 2.10.1 · CVE-2026-105830 · GHSA-3q6v-r5mr-hxv8 · amended
30 Sep 2026Evidence →
High, CVSS 7.430 Sep 2026
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
npm @grpc/grpc-js · Upgrade to 1.14.5 or 1.13.6 by release line · < 1.13.6; >= 1.14.0, < 1.14.5 · CVE-2026-101916 · GHSA-m9gg-hp2v-232j · amended
30 Sep 2026Evidence →
Low, CVSS 3.730 Sep 2026
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
npm @grpc/grpc-js · Upgrade to 1.14.5 or 1.13.6 by release line · < 1.13.6; >= 1.14.0, < 1.14.5 · CVE-2026-101915 · GHSA-f596-whhp-79r4 · amended
30 Sep 2026Evidence →
Medium, CVSS 6.930 Sep 2026
Axios: Header Injection via Inherited headers After Minimal Interceptor
npm axios · Upgrade to 1.20.0 or later · >= 1.0.0, < 1.20.0 · CVE-2026-101904 · GHSA-j8rh-479h-cp32 · amended
30 Sep 2026Evidence →
Medium, CVSS 6.930 Sep 2026
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
npm axios · Upgrade to 1.20.0 or later · >= 1.12.0, < 1.20.0 · CVE-2026-101900 · GHSA-4hqw-qxg8-jxx2 · amended
30 Sep 2026Evidence →
High, CVSS 7.630 Sep 2026
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
npm axios · Upgrade to 1.20.0 or later · >= 1.15.2, < 1.20.0 · CVE-2026-101905 · GHSA-m8m8-qj5v-23w3 · amended
30 Sep 2026Evidence →
Medium, CVSS 6.930 Sep 2026
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
npm axios · Upgrade to 1.20.0 or later · >= 1.15.0, < 1.20.0 · CVE-2026-101899 · GHSA-44g4-m2mj-wpvx · amended
30 Sep 2026Evidence →
High, CVSS 7.030 Sep 2026
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
npm axios · Upgrade to 1.20.0 or later · >= 1.17.0, < 1.20.0 · CVE-2026-101907 · GHSA-r4gj-5m52-g5wh · amended
30 Sep 2026Evidence →
Medium, CVSS 6.930 Sep 2026
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
npm axios · Upgrade to 1.20.0 or later · >= 1.7.0, < 1.20.0 · CVE-2026-101908 · GHSA-vh66-26gq-q6x8 · amended
30 Sep 2026Evidence →
Medium, CVSS 6.930 Sep 2026
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
npm axios · Upgrade to 1.20.0 or 0.34.0 by release line · >= 0.27.2, < 0.34.0; >= 1.0.0, < 1.20.0 · CVE-2026-101902 · GHSA-9fr6-4gfg-395g · amended
30 Sep 2026Evidence →
High, CVSS 8.230 Sep 2026
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
npm axios · Upgrade to 1.20.0 or later · >= 1.16.1, < 1.20.0 · CVE-2026-101903 · GHSA-c29m-xwm3-cm6r · amended
30 Sep 2026Evidence →
High, CVSS 8.230 Sep 2026
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
npm axios · Upgrade to 1.20.0 or later · >= 1.15.0, < 1.20.0 · CVE-2026-101906 · GHSA-mghh-pgcx-3jjj · amended
30 Sep 2026Evidence →
High, CVSS 8.330 Sep 2026
Axios: Prototype Pollution Gadget in axios toFormData Options
npm axios · Upgrade to 1.20.0 or 0.34.0 by release line · >= 0.28.0, < 0.34.0; >= 1.15.1, < 1.20.0 · CVE-2026-101909 · GHSA-x97p-jq2g-jp4f · amended
30 Sep 2026Evidence →
High, CVSS 7.030 Sep 2026
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
npm axios · Upgrade to 1.20.0 or later · >= 1.13.0, < 1.20.0 · CVE-2026-101898 · GHSA-3pq3-5fj3-cg6v · amended
30 Sep 2026Evidence →
High, CVSS 8.230 Sep 2026
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
npm axios · Upgrade to 1.20.0 or later · >= 1.13.0, < 1.20.0 · CVE-2026-101901 · GHSA-542g-h47m-68v8 · amended
30 Sep 2026Evidence →
Medium, CVSS 6.930 Sep 2026
urllib3: Chunked Deflate streaming can enter an infinite loop
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 2.6.2, < 2.8.0 · CVE-2026-97688 · GHSA-gh4c-6fx4-qh6g · amended
30 Sep 2026Evidence →
Critical, CVSS 9.530 Sep 2026
Next.js: Remote Code Execution in next/og ImageResponse
npm next · Upgrade to 16.3.6 or later · >= 16.2.0, < 16.3.6 · GHSA-vcvr-r3jv-pc5j · amended
30 Sep 2026Evidence →
High, CVSS 8.930 Sep 2026
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 1.10.3, < 2.8.0 · CVE-2026-97689 · GHSA-vxq7-64xx-v4gw · amended
30 Sep 2026Evidence →
High, CVSS 7.630 Sep 2026
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 1.26.0, < 2.8.0 · CVE-2026-97687 · GHSA-8988-9cw3-xx77 · amended
30 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence