Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–50 of 64 matching · newest first

Exploited 22 Oct 2026 ×Clear filters

High, CVSS 7.522 Oct 2026
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
PyPI graphql-core · Upgrade to 3.3.0rc1 (pre-release) or 3.2.12 by release line · >= 3.2.3, < 3.2.12; >= 3.3.0a3, < 3.3.0rc1 · CVE-2026-75508 · GHSA-r77w-qph3-7vf8 · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
PyPI graphql-core · Upgrade to 3.3.0rc1 (pre-release) or 3.2.12 by release line · >= 3.0.0, < 3.2.12; >= 3.3.0a1, < 3.3.0rc1 · CVE-2026-75507 · GHSA-vj8h-fx38-h3vc · amended
22 Oct 2026Evidence →
Critical, CVSS 9.222 Oct 2026
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
npm dompurify · Upgrade to 3.4.17 or later · >= 3.4.4, < 3.4.17 · CVE-2026-116804 · GHSA-cg2g-xh64-v4q7 · amended
22 Oct 2026Evidence →
High, CVSS 7.622 Oct 2026
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
npm dompurify · Upgrade to 3.4.17 or later · < 3.4.17 · CVE-2026-116803 · GHSA-mrv2-3pqr-j5jr · amended
22 Oct 2026Evidence →
Unrated22 Oct 2026
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
npm dompurify · Upgrade to 3.4.17 or later · < 3.4.17 · CVE-2026-116802 · GHSA-c6gr-qvv4-5v3f · amended
22 Oct 2026Evidence →
High, CVSS 8.822 Oct 2026
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
PyPI nbconvert · Upgrade to 7.17.2 or later · >= 5.4.0, <= 7.17.1 · CVE-2026-114140 · GHSA-pjvx-prjx-h659 · amended
22 Oct 2026Evidence →
Medium, CVSS 5.322 Oct 2026
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
PyPI opentelemetry-api · Upgrade to 1.45.1 or later · <= 1.45.0 · CVE-2026-114603 · GHSA-xcq7-p3pf-p88h · amended
22 Oct 2026Evidence →
Medium, CVSS 6.322 Oct 2026
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
npm ip-address · Upgrade to 10.7.4 or later · <= 10.7.3 · CVE-2026-111997 · GHSA-rxp7-6hxx-x8q5 · amended
22 Oct 2026Evidence →
High, CVSS 8.722 Oct 2026
Black: GitHub Action installs unvalidated required-version from pyproject.toml
PyPI black · Upgrade to 26.10.1 or later · < 26.10.1 · CVE-2026-114134 · GHSA-cg8m-r9f2-5wm2 · amended
22 Oct 2026Evidence →
High, CVSS 7.422 Oct 2026
Django REST framework: TokenProxy.delete() reports success and revokes nothing
PyPI djangorestframework · Upgrade to 3.18.2 or later · >= 3.12.0, < 3.18.2 · CVE-2026-114137 · GHSA-xw6w-gcfp-cf8m · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
PyPI djangorestframework · Upgrade to 3.18.2 or later · < 3.18.2 · CVE-2026-114138 · GHSA-33wh-fxxf-88vv · amended
22 Oct 2026Evidence →
High, CVSS 7.522 Oct 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream
PyPI djangorestframework · Upgrade to 3.18.2 or later · >= 3.6.4, < 3.18.2 · CVE-2026-114136 · GHSA-3547-9m27-7rxg · amended
22 Oct 2026Evidence →
Medium, CVSS 6.322 Oct 2026
next.js cache leak across root param values in nested 'use cache' functions
npm next · Upgrade to 16.3.8 or later · >= 16.3.0, < 16.3.8 · CVE-2026-103004 · GHSA-h694-7cp9-m8p3 · amended
22 Oct 2026Evidence →
Medium, CVSS 6.522 Oct 2026
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
npm nodemailer · Upgrade to 10.0.10 or later · >= 3.0.0, <= 10.0.9 · CVE-2026-110871 · GHSA-39m8-27wv-hr27 · amended
22 Oct 2026Evidence →
High, CVSS 7.722 Oct 2026
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 9.4.0, < 13.0.0 · CVE-2026-96778 · GHSA-g7cr-3p24-7wf7 · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96644 · GHSA-9v9v-9qvf-h2hj · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 11.0.0, < 13.0.0 · CVE-2026-96643 · GHSA-g4qv-2jxx-769h · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: TarIO negative size field causes infinite CPU-spin loop
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96642 · GHSA-3j72-p6qg-6xp7 · amended
22 Oct 2026Evidence →
Medium, CVSS 6.522 Oct 2026
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96641 · GHSA-4rm8-3hmm-39fg · amended
22 Oct 2026Evidence →
High, CVSS 8.222 Oct 2026
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 5.1.0, < 13.0.0 · CVE-2026-96640 · GHSA-mrfp-p49p-3hf2 · amended
22 Oct 2026Evidence →
Critical, CVSS 9.822 Oct 2026
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 11.0.0, < 13.0.0 · CVE-2026-96639 · GHSA-v9pv-5gc8-w2m6 · amended
22 Oct 2026Evidence →
Medium, CVSS 6.522 Oct 2026
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · >= 9.1.0, < 13.0.0 · CVE-2026-96638 · GHSA-24rc-8hj2-v98c · amended
22 Oct 2026Evidence →
High, CVSS 7.122 Oct 2026
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96637 · GHSA-g842-9rc4-69pw · amended
22 Oct 2026Evidence →
Medium, CVSS 6.522 Oct 2026
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Bitnami pillow +1 · Upgrade all 2 to 13.0.0 or later · < 13.0.0 · CVE-2026-96636 · GHSA-p8hx-v2p6-rp84 · amended
22 Oct 2026Evidence →
Critical, CVSS 9.122 Oct 2026
Sentry-Javascript: Middleware Bypass when using Tunnel route
npm @sentry/nextjs · Upgrade to 11.0.0-rc.1 (pre-release), 10.75.2 or 9.47.2 by release line · >= 9.36.0, < 9.47.2; >= 10.0.0-alpha.0, < 10.75.2; >= 11.0.0-alpha.0, < 11.0.0-rc.1 · CVE-2026-114139 · GHSA-mchm-gjx6-7h55 · amended
22 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence