Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 29 matching · newest first

Show all severities

Exploited 20 Oct 2026 ×Clear filters

High, CVSS 7.520 Oct 2026
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
Maven org.a2aproject.sdk:a2a-java-sdk-http-client-android · Upgrade to 1.3.2.Final or later · >= 1.3.0.Final, <= 1.3.1.Final · CVE-2026-111765 · GHSA-4fpj-g9jf-9rgg · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
A2A Java SDK has a fail-open default task authorization
Maven org.a2aproject.sdk:a2a-java-sdk-server-common · Upgrade to 1.3.0.Final or later · < 1.3.0.Final · CVE-2026-111764 · GHSA-qw47-mcm5-934w · amended
20 Oct 2026Evidence →
High, CVSS 8.720 Oct 2026
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112397 · GHSA-58r4-6rv3-gfh8 · amended
20 Oct 2026Evidence →
High, CVSS 8.720 Oct 2026
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 9.2.0, < 13.0.0 · CVE-2026-112400 · GHSA-65qm-jvmh-6pqg · amended
20 Oct 2026Evidence →
High, CVSS 8.720 Oct 2026
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.3.0, < 13.0.0 · CVE-2026-112897 · GHSA-q45j-58j2-45rg · amended
20 Oct 2026Evidence →
High, CVSS 8.820 Oct 2026
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112896 · GHSA-pchr-8j38-3x4p · amended
20 Oct 2026Evidence →
High, CVSS 8.720 Oct 2026
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-112895 · GHSA-p4wg-p73j-c528 · amended
20 Oct 2026Evidence →
High, CVSS 8.820 Oct 2026
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 8.1.0, < 13.0.0 · CVE-2026-112404 · GHSA-c6hw-5grf-ff96 · amended
20 Oct 2026Evidence →
Critical, CVSS 9.220 Oct 2026
Pillow: Heap buffer overflow in ImagingJpegDecode
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-112403 · GHSA-8g5g-8vmr-9782 · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
npm markdown-it · Upgrade to 15.0.3 or 14.3.3 by release line · >= 14.1.0, < 14.3.3; >= 15.0.0, < 15.0.3 · CVE-2026-111758 · GHSA-gfr2-rv44-r23c · amended
20 Oct 2026Evidence →
High, CVSS 7.720 Oct 2026
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
npm @modelcontextprotocol/server · Upgrade to 2.3.0 or later · >= 2.0.0, < 2.3.0 · CVE-2026-111770 · GHSA-jm63-cq47-j5jp · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
npm @modelcontextprotocol/sdk · Upgrade to 1.32.0 or later · >= 1.3.0, < 1.32.0 · +1 more package · CVE-2026-111768 · GHSA-46jr-4wx8-v453 · amended
20 Oct 2026Evidence →
High, CVSS 8.220 Oct 2026
AIOHTTP: File descriptor exhaustion in multipart requests
PyPI aiohttp · Upgrade to 3.14.4 or later · >= 2.0.0, < 3.14.4 · CVE-2026-111066 · GHSA-9xw5-w5jj-pvcg · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
launch-editor: fs.existsSync() existence check can be bypassed on Windows
npm launch-editor · Upgrade to 2.14.2 or later · <= 2.14.1 · +2 more packages · CVE-2026-112942 · GHSA-587h-7wmj-h5pm · amended
20 Oct 2026Evidence →
Critical, CVSS 9.120 Oct 2026
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
PyPI uv · Upgrade to 0.13.4 or later · < 0.13.4 · GHSA-hq85-5cpj-mr62 · amended
20 Oct 2026Evidence →
Critical, CVSS 9.120 Oct 2026
certifi bundles emSign root CAs with compromised intermediate CA keys
PyPI certifi · Upgrade to 2026.10.18 or later · >= 2019.3.9, < 2026.10.18 · GHSA-6q48-6c7w-9gw2 · amended
20 Oct 2026Evidence →
High, CVSS 8.620 Oct 2026
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
npm @modelcontextprotocol/sdk · Upgrade to 1.32.0 or later · >= 1.24.0, < 1.32.0 · CVE-2026-111767 · GHSA-22jm-h49p-29qw · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
npm apostrophe · Upgrade to 4.33.0 or later · < 4.33.0 · CVE-2026-113658 · GHSA-qhcq-9pm2-c9w9 · amended
20 Oct 2026Evidence →
High, CVSS 7.120 Oct 2026
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
npm @apostrophecms/db-connect · Upgrade to 1.1.0 or later · < 1.1.0 · +1 more package · CVE-2026-113666 · GHSA-j5rq-xfvr-p969 · amended
20 Oct 2026Evidence →
High, CVSS 8.220 Oct 2026
follow-redirects array-form headers bypass cross-origin credential stripping
npm follow-redirects · Upgrade to 1.16.1 or later · >= 1.16.0, < 1.16.1 · CVE-2026-111756 · GHSA-q3jh-wrc6-jgq8 · amended
20 Oct 2026Evidence →
High, CVSS 8.220 Oct 2026
follow-redirects sensitiveHeaders regex escaping can expose credential headers
npm follow-redirects · Upgrade to 1.16.1 or later · >= 1.16.0, < 1.16.1 · CVE-2026-111755 · GHSA-8r9p-f939-6h3c · amended
20 Oct 2026Evidence →
High, CVSS 8.220 Oct 2026
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
npm @angular/router · Upgrade to 22.2.1 or 21.2.25 by release line · >= 22.0.0, < 22.2.1; >= 21.2.0, < 21.2.25 · CVE-2026-111751 · GHSA-57xq-rjx2-v5xh · amended
20 Oct 2026Evidence →
High, CVSS 8.220 Oct 2026
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
npm @angular/router · Upgrade to 22.2.1, 21.2.25 or 20.3.33 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.2.1; >= 21.0.0, < 21.2.25; >= 20.0.0, < 20.3.33; <= 19.2.25 · CVE-2026-111752 · GHSA-62vg-58rm-qff7 · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
npm markdown-it · Upgrade to 15.0.2 or 14.3.2 by release line · >= 15.0.0, < 15.0.2; < 14.3.2 · CVE-2026-111759 · GHSA-r7fv-28h4-cvq7 · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
Go github.com/klauspost/compress · Upgrade to 1.18.7 or later · <= 1.18.6 · CVE-2026-63209 · GHSA-259r-337f-4rfw · amended
20 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence