Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1–25 of 36 matching · newest first

Show all severities

Exploited 22 Oct 2026 ×Clear filters

High, CVSS 8.122 Oct 2026
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
PyPI pillow · Upgrade to 13.0.0 or later · >= 11.1.0, < 13.0.0 · GHSA-78g4-xqwv-q3g8 · amended
22 Oct 2026Evidence →
Critical, CVSS 9.522 Oct 2026
Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays
npm next · Upgrade to 16.4.1 or later · >= 16.0.0, <= 16.4.0 · GHSA-673q-mjm6-r5xr · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
PyPI gitpython · Upgrade to 3.2.1 or later · <= 3.2.0 · CVE-2026-114145 · GHSA-83vg-56qc-22m7 · amended
22 Oct 2026Evidence →
High, CVSS 8.822 Oct 2026
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
npm toml +1 · Upgrade all 2 to 5.0.1 or later · <= 5.0.0 · CVE-2026-114142 · GHSA-h895-cgqg-jf52 · amended
22 Oct 2026Evidence →
High, CVSS 8.722 Oct 2026
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114141 · GHSA-4qx8-w7c3-pj3p · amended
22 Oct 2026Evidence →
High, CVSS 8.722 Oct 2026
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114143 · GHSA-9j65-hcg3-gc64 · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
npm toml · Upgrade to 5.0.1 or later · <= 5.0.0 · CVE-2026-114144 · GHSA-9qmh-m7c6-f92p · amended
22 Oct 2026Evidence →
High, CVSS 8.722 Oct 2026
Storybook dev server vulnerable to code injection from the local network
npm storybook · Upgrade to 11.0.0-alpha.6 (pre-release), 10.6.2, 9.1.21 or 8.6.19 by release line · >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · +5 more packages · CVE-2026-114126 · GHSA-px85-f4q5-jh77 · amended
22 Oct 2026Evidence →
High, CVSS 8.422 Oct 2026
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
npm @graphql-tools/utils · Upgrade to 12.0.2 or later · >= 10.10.1, <= 12.0.1 · CVE-2026-114604 · GHSA-c4qx-w738-7hr3 · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
PyPI graphql-core · Upgrade to 3.3.0rc1 (pre-release) or 3.2.12 by release line · >= 3.2.3, < 3.2.12; >= 3.3.0a3, < 3.3.0rc1 · CVE-2026-75508 · GHSA-r77w-qph3-7vf8 · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
PyPI graphql-core · Upgrade to 3.3.0rc1 (pre-release) or 3.2.12 by release line · >= 3.0.0, < 3.2.12; >= 3.3.0a1, < 3.3.0rc1 · CVE-2026-75507 · GHSA-vj8h-fx38-h3vc · amended
22 Oct 2026Evidence →
Critical, CVSS 9.222 Oct 2026
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
npm dompurify · Upgrade to 3.4.17 or later · >= 3.4.4, < 3.4.17 · CVE-2026-116804 · GHSA-cg2g-xh64-v4q7 · amended
22 Oct 2026Evidence →
High, CVSS 7.622 Oct 2026
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
npm dompurify · Upgrade to 3.4.17 or later · < 3.4.17 · CVE-2026-116803 · GHSA-mrv2-3pqr-j5jr · amended
22 Oct 2026Evidence →
High, CVSS 8.822 Oct 2026
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
PyPI nbconvert · Upgrade to 7.17.2 or later · >= 5.4.0, <= 7.17.1 · CVE-2026-114140 · GHSA-pjvx-prjx-h659 · amended
22 Oct 2026Evidence →
High, CVSS 8.722 Oct 2026
Black: GitHub Action installs unvalidated required-version from pyproject.toml
PyPI black · Upgrade to 26.10.1 or later · < 26.10.1 · CVE-2026-114134 · GHSA-cg8m-r9f2-5wm2 · amended
22 Oct 2026Evidence →
High, CVSS 7.422 Oct 2026
Django REST framework: TokenProxy.delete() reports success and revokes nothing
PyPI djangorestframework · Upgrade to 3.18.2 or later · >= 3.12.0, < 3.18.2 · CVE-2026-114137 · GHSA-xw6w-gcfp-cf8m · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
PyPI djangorestframework · Upgrade to 3.18.2 or later · < 3.18.2 · CVE-2026-114138 · GHSA-33wh-fxxf-88vv · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream
PyPI djangorestframework · Upgrade to 3.18.2 or later · >= 3.6.4, < 3.18.2 · CVE-2026-114136 · GHSA-3547-9m27-7rxg · amended
22 Oct 2026Evidence →
High, CVSS 7.722 Oct 2026
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 9.4.0, < 13.0.0 · CVE-2026-96778 · GHSA-g7cr-3p24-7wf7 · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96644 · GHSA-9v9v-9qvf-h2hj · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 11.0.0, < 13.0.0 · CVE-2026-96643 · GHSA-g4qv-2jxx-769h · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: TarIO negative size field causes infinite CPU-spin loop
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96642 · GHSA-3j72-p6qg-6xp7 · amended
22 Oct 2026Evidence →
High, CVSS 8.222 Oct 2026
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-96640 · GHSA-mrfp-p49p-3hf2 · amended
22 Oct 2026Evidence →
Critical, CVSS 9.822 Oct 2026
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 11.0.0, < 13.0.0 · CVE-2026-96639 · GHSA-v9pv-5gc8-w2m6 · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96637 · GHSA-g842-9rc4-69pw · amended
22 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence