Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 41 matching · newest first

Show all severities

Exploited 5 Oct 2026 ×Clear filters

Critical, CVSS 9.25 Oct 2026
simple-git: VISUAL editor environment variable is omitted from unsafe editor detection
npm @simple-git/argv-parser · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2026-102829 · GHSA-v5rq-49vh-5v5c · amended
5 Oct 2026Evidence →
Critical, CVSS 9.25 Oct 2026
simple-git unsafe-operation guard does not block trailer command configuration
npm simple-git · Upgrade to 4.0.1 or later · >= 3.15.0, < 4.0.1 · CVE-2026-102828 · GHSA-x6jw-m9v5-85vh · amended
5 Oct 2026Evidence →
High, CVSS 8.15 Oct 2026
simple-git allows command execution through unblocked Git configuration includes
npm simple-git · Upgrade to 4.0.0 or later · <= 3.36.0 · CVE-2026-102826 · GHSA-g4wm-2vf7-vfgr · amended
5 Oct 2026Evidence →
High, CVSS 8.15 Oct 2026
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
npm simple-git · Upgrade to 4.0.0 or later · <= 3.36.0 · CVE-2026-102827 · GHSA-858h-whjf-mvg5 · amended
5 Oct 2026Evidence →
High, CVSS 7.55 Oct 2026
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
PyPI pymongo · Upgrade to 4.18.2 or later · < 4.18.2 · CVE-2026-96749 · GHSA-v4x9-3549-crwv · amended
5 Oct 2026Evidence →
High, CVSS 8.35 Oct 2026
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
PyPI pymongo · Upgrade to 4.18.2 or later · >= 3.5.0, <= 4.18.1 · CVE-2026-96748 · GHSA-vp6j-j7w5-5xjj · amended
5 Oct 2026Evidence →
High, CVSS 7.55 Oct 2026
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
npm @socket.io/cluster-engine · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-102600 · GHSA-wfpm-5gcm-94cg · amended
5 Oct 2026Evidence →
Critical, CVSS 9.85 Oct 2026
Seroval: fromJSON() Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
npm seroval · Upgrade to 1.6.2 or later · >= 0.12.0, <= 1.6.0 · CVE-2026-104846 · GHSA-p6vx-979v-rg4c · amended
5 Oct 2026Evidence →
High, CVSS 7.55 Oct 2026
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
npm seroval · Upgrade to 1.6.3 or later · <= 1.6.2 · CVE-2026-104845 · GHSA-jp82-f5mq-hwhp · amended
5 Oct 2026Evidence →
Critical, CVSS 9.15 Oct 2026
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
npm proxy-addr · Upgrade to 2.0.8 or later · >= 1.1.0, < 2.0.8 · CVE-2026-90711 · GHSA-jqcg-44mw-7w3h · amended
5 Oct 2026Evidence →
High, CVSS 7.35 Oct 2026
@nx/docker: OS command injection in the @nx/docker release pipeline
npm @nx/docker · Upgrade to 23.1.1 or 22.7.8 by release line · >= 21.4.0, < 22.7.8; >= 23.0.0, < 23.1.1 · CVE-2026-104859 · GHSA-6vc5-vf29-ffr2 · amended
5 Oct 2026Evidence →
High, CVSS 8.55 Oct 2026
Nx: OS command injection via git revisions and remote refs
npm nx · Upgrade to 23.1.1 or 22.7.8 by release line · >= 14.0.0, < 22.7.8; >= 23.0.0, < 23.1.1 · GHSA-w2vw-w76x-qr89 · amended
5 Oct 2026Evidence →
High, CVSS 8.55 Oct 2026
Nx daemon and plugin worker sockets are accessible to other local users
npm nx · Upgrade to 23.1.2 or 22.7.9 by release line · >= 14.6.0, < 22.7.9; >= 23.0.0, < 23.1.2 · CVE-2026-104854 · GHSA-w3vv-58gj-gw77 · amended
5 Oct 2026Evidence →
High, CVSS 7.55 Oct 2026
compression vulnerable to Denial of Service via memory leak on premature response close
npm compression · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2026-87776 · GHSA-vc2v-76pw-4v95 · amended
5 Oct 2026Evidence →
Critical, CVSS 9.55 Oct 2026
vm2: NodeVM custom resolution bypasses external path boundaries
npm vm2 · Upgrade to 3.12.2 or later · <= 3.12.1 · CVE-2026-100721 · GHSA-5h3f-q97h-ccvc · amended
5 Oct 2026Evidence →
High, CVSS 8.95 Oct 2026
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
npm vm2 · Upgrade to 3.12.2 or later · <= 3.12.1 · CVE-2026-100722 · GHSA-2v2p-6j97-cjg9 · amended
5 Oct 2026Evidence →
High, CVSS 7.45 Oct 2026
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
npm @graphql-tools/executor-legacy-ws · Upgrade to 1.1.35 or later · <= 1.1.34 · CVE-2026-103921 · GHSA-6fw5-9hq8-w87g · amended
5 Oct 2026Evidence →
High, CVSS 8.25 Oct 2026
GraphQL Tools has prototype pollution in well-established utility function mergeDeep
npm @graphql-tools/utils · Upgrade to 12.0.1 or later · <= 12.0.0 · CVE-2026-104852 · GHSA-7mx3-vvmw-hjmv · amended
5 Oct 2026Evidence →
High, CVSS 8.75 Oct 2026
hickory-resolver: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)
crates.io hickory-resolver · Upgrade to 0.26.2 or later · >= 0.26.0-beta.1, < 0.26.2 · CVE-2026-123604 · GHSA-6w6g-hm98-mhgm · amended
5 Oct 2026Evidence →
High, CVSS 7.55 Oct 2026
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
crates.io hickory-resolver · Upgrade to 0.26.2 or later · < 0.26.2 · CVE-2026-93657 · GHSA-5j98-2g5x-46v6 · amended
5 Oct 2026Evidence →
High, CVSS 8.85 Oct 2026
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
PyPI fsspec · Upgrade to 2026.6.0 or later · >= 0.9.0, < 2026.6.0 · CVE-2026-104851 · GHSA-27vj-qcqg-25rc · amended
5 Oct 2026Evidence →
Critical, CVSS 9.35 Oct 2026
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
npm @capacitor/android +2 · Upgrade all 3 to 8.5.1, 8.4.3, 7.6.9 or 6.2.2 by release line; some affected versions have no fix yet · >= 6.0.0, < 6.2.2; >= 7.0.0, < 7.6.9; >= 8.5.0, < 8.5.1; >= 8.3.5, < 8.4.3; >= 8.0.0, <= 8.3.4 · CVE-2026-103922 · GHSA-rvm3-566m-v7fv · amended
5 Oct 2026Evidence →
High, CVSS 7.25 Oct 2026
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
npm @vue/server-renderer · Upgrade to 3.6.0-rc.6 (pre-release) or 3.5.42 by release line · < 3.5.42; >= 3.6.0-rc.0, < 3.6.0-rc.6 · GHSA-g2v6-rqmx-r4w6 · amended
5 Oct 2026Evidence →
Critical, CVSS 9.55 Oct 2026
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
npm tinypool · Upgrade to 2.1.1 or later · <= 2.1.0 · CVE-2026-104848 · GHSA-5gmw-xhrv-c9v3 · amended
5 Oct 2026Evidence →
Critical, CVSS 9.55 Oct 2026
Tinypool: Prototype Pollution Gadget to RCE in run() options
npm tinypool · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-104849 · GHSA-85c8-ppgw-ccpr · amended
5 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git unsafe-operation guard does not block trailer command configuration

simple-git allows command execution through unblocked Git configuration includes

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@nx/docker: OS command injection in the @nx/docker release pipeline

Nx: OS command injection via git revisions and remote refs

Nx daemon and plugin worker sockets are accessible to other local users

compression vulnerable to Denial of Service via memory leak on premature response close

vm2: NodeVM custom resolution bypasses external path boundaries

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool: Prototype Pollution Gadget to RCE in run() options

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence