Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

51–75 of 138 matching · newest first

Exploited 7 Oct 2026 ×Clear filters

Medium, CVSS 6.57 Oct 2026
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
npm @backstage/plugin-catalog-backend-module-bitbucket-server · Upgrade to 0.5.15 or later · >= 0.4.0, < 0.5.15 · CVE-2026-106458 · GHSA-c36c-cf6r-ghgj · amended
7 Oct 2026Evidence →
High, CVSS 8.57 Oct 2026
Backstage: Improper input validation in Sentry scaffolder actions
npm @backstage/plugin-scaffolder-backend-module-sentry · Upgrade to 0.3.8 or later · >= 0.3.0, < 0.3.8 · CVE-2026-106459 · GHSA-g734-fhp4-7mfp · amended
7 Oct 2026Evidence →
High, CVSS 7.57 Oct 2026
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 2.1.0, < 3.2.0; >= 4.0.0, < 4.1.2 · CVE-2026-106115 · GHSA-jjfr-hcj7-qf5w · amended
7 Oct 2026Evidence →
Medium, CVSS 5.97 Oct 2026
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or later · >= 4.0.0, <= 4.1.1 · CVE-2026-106111 · GHSA-4q3p-rj5x-xv7p · amended
7 Oct 2026Evidence →
High, CVSS 7.57 Oct 2026
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or later · >= 4.0.0, <= 4.1.1 · CVE-2026-106112 · GHSA-ffp7-56pq-64mr · amended
7 Oct 2026Evidence →
Medium, CVSS 5.37 Oct 2026
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 2.0.0, < 3.2.0; >= 4.0.0, < 4.1.2 · CVE-2026-106116 · GHSA-wmxv-xphr-5c9g · amended
7 Oct 2026Evidence →
High, CVSS 7.57 Oct 2026
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 2.0.0, < 3.2.0; >= 4.0.0, < 4.1.2 · CVE-2026-106110 · GHSA-j9gm-c75j-xc9q · amended
7 Oct 2026Evidence →
High, CVSS 7.57 Oct 2026
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 2.0.0, < 3.2.0; >= 4.0.0, < 4.1.2 · CVE-2026-106113 · GHSA-j3p4-wp97-rph4 · amended
7 Oct 2026Evidence →
Medium, CVSS 5.37 Oct 2026
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
NuGet sixlabors.imagesharp · Upgrade to 4.1.2 or 3.2.0 by release line · >= 4.0.0, < 4.1.2; >= 1.0.0-beta0001, < 3.2.0 · CVE-2026-106114 · GHSA-gwg2-r3hj-4w44 · amended
7 Oct 2026Evidence →
High, CVSS 7.87 Oct 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
PyPI hydra-optuna-sweeper · Upgrade to 1.4.0.dev10 (pre-release) or 1.3.0 by release line · >= 1.2.0, < 1.3.0; >= 1.4.0.dev4, < 1.4.0.dev10 · CVE-2026-106440 · GHSA-5jjj-9xc3-rm56
7 Oct 2026Evidence →
High, CVSS 8.57 Oct 2026
Hydra: Mutable instantiate policy sets allow target blocklist bypass
PyPI hydra-core · Upgrade to 1.4.0.dev10 (pre-release) or 1.3.7 by release line · >= 1.3.4, < 1.3.7; >= 1.4.0.dev4, < 1.4.0.dev10 · CVE-2026-106439 · GHSA-mwj6-rfh8-7qf4
7 Oct 2026Evidence →
Medium, CVSS 6.87 Oct 2026
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
npm @backstage/plugin-auth-node · Upgrade to 0.7.5 or 0.6.15 by release line · >= 0.3.0, < 0.6.15; >= 0.7.0, < 0.7.5 · CVE-2026-106460 · GHSA-xm5q-p7w3-x6cp · amended
7 Oct 2026Evidence →
Low, CVSS 3.17 Oct 2026
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
npm quasar · Upgrade to 2.32.2 or later · <= 2.32.1 · CVE-2026-106101 · GHSA-89vp-x45c-52cq · amended
7 Oct 2026Evidence →
Medium, CVSS 5.37 Oct 2026
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20260908032718-ecd99d761fe0 (pre-release) or later · >= 2.10.1, < 2.11.1-0.20260908032718-ecd99d761fe0 · CVE-2026-107218 · GHSA-8jjq-8j9w-m2v6 · amended
7 Oct 2026Evidence →
Medium, CVSS 6.57 Oct 2026
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20260820023833-99903a3240e5 (pre-release) or later · >= 2.7.1, < 2.11.1-0.20260820023833-99903a3240e5 · CVE-2026-107220 · GHSA-g27h-8qhm-6pff · amended
7 Oct 2026Evidence →
Medium, CVSS 6.57 Oct 2026
Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20260816084418-46a5eb289448 (pre-release) or later · >= 2.0.0, < 2.11.1-0.20260816084418-46a5eb289448 · CVE-2026-107221 · GHSA-8mcq-6wmr-jrjv · amended
7 Oct 2026Evidence →
Medium, CVSS 6.57 Oct 2026
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20260812075026-be7a16390fa6 (pre-release) or later · >= 2.7.0, < 2.11.1-0.20260812075026-be7a16390fa6 · CVE-2026-107222 · GHSA-rxcj-4pj5-74gr · amended
7 Oct 2026Evidence →
Medium, CVSS 6.57 Oct 2026
Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
Go github.com/xuri/excelize/v2 · Upgrade to 2.11.1-0.20260731010303-ae2113b410e5 (pre-release) or later · >= 2.8.0, < 2.11.1-0.20260731010303-ae2113b410e5 · CVE-2026-107225 · GHSA-5h23-36rv-pm65 · amended
7 Oct 2026Evidence →
High, CVSS 8.57 Oct 2026
PraisonAI: Crawl4AI/Chromium backend is also affected by the web_crawl SSRF validation bypass
PyPI praisonaiagents · Upgrade to 1.6.78 or later · <= 1.6.77 · CVE-2026-61429 · GHSA-6g59-gm2v-qhvq · amended
7 Oct 2026Evidence →
High, CVSS 8.87 Oct 2026
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
PyPI weasyprint · Upgrade to 70.0 or later · <= 69.0 · CVE-2026-106443 · GHSA-r543-q48m-4c9j · amended
7 Oct 2026Evidence →
High, CVSS 7.27 Oct 2026
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
Packagist kunstmaan/bundles-cms +1 · Upgrade all 2 to 7.3.2 or later · < 7.3.2 · CVE-2026-104890 · GHSA-p279-5wcv-45vq · amended
7 Oct 2026Evidence →
Medium, CVSS 6.57 Oct 2026
Ghost: Authorization Issue Allowed Author Role to Delete any Post
npm ghost · Upgrade to 6.60.0 or later · >= 5.81.0, < 6.60.0 · CVE-2026-105680 · GHSA-x3mg-q38v-m562 · amended
7 Oct 2026Evidence →
Critical, CVSS 10.07 Oct 2026
vm2 contains a sandbox escape vulnerability
npm vm2 · Upgrade to 3.12.1 or later · <= 3.12.0 · CVE-2026-93605 · GHSA-pq68-rvw4-xp4r · amended
7 Oct 2026Evidence →
High, CVSS 7.87 Oct 2026
Hydra logging configuration permits unsafe callable resolution
PyPI hydra-core · Upgrade to 1.4.0.dev9 (pre-release) or 1.3.6 by release line · < 1.3.6; >= 1.4.0.dev0, < 1.4.0.dev9 · CVE-2026-106441 · GHSA-c3wx-c55w-pxjq
7 Oct 2026Evidence →
High, CVSS 7.87 Oct 2026
Hydra instantiate target blacklist bypasses permit code execution
PyPI hydra-core · Upgrade to 1.4.0.dev9 (pre-release) or 1.3.6 by release line · >= 1.3.4, < 1.3.6; >= 1.4.0.dev0, < 1.4.0.dev9 · CVE-2026-106442 · GHSA-rqx7-p7vv-w7hr
7 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence