Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 29 matching · newest first

Exploited 16 Oct 2026 ×Clear filters

Critical, CVSS 9.816 Oct 2026
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
PyPI lmcache · Upgrade to 0.5.6 or later · >= 0.3.9, < 0.5.6 · CVE-2026-105192 · GHSA-w5f2-9q9c-ff4h · amended
16 Oct 2026Evidence →
High, CVSS 8.216 Oct 2026
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
Go github.com/getkin/kin-openapi · Upgrade to 0.146.0 or later · < 0.146.0 · CVE-2026-100349 · GHSA-74vm-87hj-r66f · amended
16 Oct 2026Evidence →
Medium, CVSS 6.516 Oct 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
crates.io wasmtime-wasi · Upgrade to 46.0.1, 45.0.3, 36.0.12 or 24.0.11 by release line · < 24.0.11; >= 25.0.0, < 36.0.12; >= 37.0.0, < 45.0.3; >= 46.0.0, < 46.0.1 · CVE-2026-58494 · GHSA-4ch3-9j33-3pmj · amended
16 Oct 2026Evidence →
High, CVSS 7.516 Oct 2026
lopdf has a stack overflow via deeply nested PDF objects
crates.io lopdf · Upgrade to 0.42.0 or later · < 0.42.0 · GHSA-6fj4-rcr3-r7rr · amended
16 Oct 2026Evidence →
High, CVSS 7.516 Oct 2026
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
Maven org.bytedeco:javacv · Upgrade to 1.5.14 or later · < 1.5.14 · CVE-2026-102834 · GHSA-rxjv-24xq-76wc · amended
16 Oct 2026Evidence →
Critical, CVSS 9.216 Oct 2026
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
PyPI claude-agent-sdk · Upgrade to 0.2.121 or later · < 0.2.121 · CVE-2026-96620 · GHSA-h4mw-j7qp-8mwm · amended
16 Oct 2026Evidence →
Low, CVSS 3.716 Oct 2026
CoreDNS k8s_external headless AXFR can emit an empty transfer batch that panics the transfer plugin
Go github.com/coredns/coredns · Upgrade to 1.14.5 or later · >= 1.9.4, <= 1.14.4 · CVE-2026-62994 · GHSA-74w3-63xv-x9mv · amended
16 Oct 2026Evidence →
Low, CVSS 3.116 Oct 2026
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
npm @aborruso/ckan-mcp-server · Upgrade to 0.4.112 or later · < 0.4.112 · CVE-2026-76894 · GHSA-vqff-r82h-9crc · amended
16 Oct 2026Evidence →
Low, CVSS 3.316 Oct 2026
ClickMigrate has Path Traversal in "revision -m" argument
PyPI clickmigrate · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2026-68549 · GHSA-vgf9-9mxx-hq54 · amended
16 Oct 2026Evidence →
High, CVSS 7.516 Oct 2026
gomarkdown/markdown IsSafeURL panics on short URLs
Go github.com/gomarkdown/markdown · Upgrade to 0.0.0-20260724235538-61af6e1e6971 (pre-release) or later · < 0.0.0-20260724235538-61af6e1e6971 · CVE-2026-102941 · GHSA-cv23-7vc5-jfh7 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Out-of-bounds read with an out-of-range InBuffer::pos
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 7.2.2, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Seekable reads a NULL or out-of-bounds seek table
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 7.2.2, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Out-of-bounds read when training a dictionary from inconsistent sample sizes
crates.io zstd · Upgrade to 0.4.10 or later · >= 0.1.1, < 0.4.10
16 Oct 2026Evidence →
Unrated16 Oct 2026
OutBuffer::around_pos exposes uninitialized memory
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 4.0.0, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Low, CVSS 3.316 Oct 2026
Stack overflow when parsing deeply nested input in pest_grammars
crates.io pest_grammars · Upgrade to 2.9.3 or later · >= 0.0.0-0, < 2.9.3 · GHSA-7632-4q2x-hvjw
16 Oct 2026Evidence →
Unrated16 Oct 2026
Use-after-free with CParameter::StableInBuffer
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 4.1.0, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Heap buffer overflow in CCtx::try_clone on a multithreaded context
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 4.1.4, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Use-after-free through init_using_cdict and init_using_ddict
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 3.0.0, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Use-after-free when changing a multithreaded context with an unfinished frame
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 0.0.0-0, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Data from an abandoned stream leaks into the next stream on a reused context
crates.io zstd · Upgrade to 0.14.3 or 0.13.4 by release line · >= 0.13.2, < 0.13.4; >= 0.14.0-0, < 0.14.3 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Uninitialized memory exposed when streaming decompression of a legacy frame fails
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 4.0.0, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Use-after-free of a dictionary after a one-shot call on a context with an open stream
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 3.0.1, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Uninitialized memory exposed by write::Decoder on a corrupt legacy frame
crates.io zstd · Upgrade to 0.8.0 or later · >= 0.4.22, < 0.8.0
16 Oct 2026Evidence →
Unrated16 Oct 2026
Seekable::decompress sets a Vec length beyond its capacity for offsets past the end
crates.io zstd-safe · Upgrade to 8.2.0 or 7.4.0 by release line · >= 7.2.2, < 7.4.0; >= 8.0.0-0, < 8.2.0 · amended
16 Oct 2026Evidence →
Unrated16 Oct 2026
Missing case-insensitive matching for CSS url function
crates.io ammonia · Upgrade to 4.2.4 or 4.1.8 by release line · >= 0.0.0-0, < 4.1.8; >= 4.2.0, < 4.2.4 · GHSA-x43w-36pp-96g3
16 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

lopdf has a stack overflow via deeply nested PDF objects

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

ClickMigrate has Path Traversal in "revision -m" argument

gomarkdown/markdown IsSafeURL panics on short URLs

Out-of-bounds read with an out-of-range `InBuffer::pos`

`Seekable` reads a NULL or out-of-bounds seek table

Out-of-bounds read when training a dictionary from inconsistent sample sizes

`OutBuffer::around_pos` exposes uninitialized memory

Stack overflow when parsing deeply nested input in pest_grammars

Use-after-free with `CParameter::StableInBuffer`

Heap buffer overflow in `CCtx::try_clone` on a multithreaded context

Use-after-free through `init_using_cdict` and `init_using_ddict`

Use-after-free when changing a multithreaded context with an unfinished frame

Data from an abandoned stream leaks into the next stream on a reused context

Uninitialized memory exposed when streaming decompression of a legacy frame fails

Use-after-free of a dictionary after a one-shot call on a context with an open stream

Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame

`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

Missing case-insensitive matching for CSS url function

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence