Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

26–50 of 85 matching · newest first

Exploited 27 Oct 2026 ×Clear filters

Medium, CVSS 6.327 Oct 2026
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
npm qs · Upgrade to 6.16.1 or later · >= 6.7.0, <= 6.16.0 · CVE-2026-110816 · GHSA-6pq8-jhm2-2vcw · amended
27 Oct 2026Evidence →
High, CVSS 7.527 Oct 2026
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
npm undici · Upgrade to 8.11.2 or later · >= 8.11.0, < 8.11.2 · CVE-2026-109855 · GHSA-qq8j-7v2v-3rwp · amended
27 Oct 2026Evidence →
High, CVSS 7.427 Oct 2026
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
PyPI authlib · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg · amended
27 Oct 2026Evidence →
Medium, CVSS 5.427 Oct 2026
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
PyPI authlib · Upgrade to 1.9.0 or later · >= 1.6.0, < 1.9.0 · CVE-2026-114620 · GHSA-x4rv-c3wx-4cr8 · amended
27 Oct 2026Evidence →
Medium, CVSS 4.227 Oct 2026
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
PyPI authlib · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-114617 · GHSA-c5mf-xmp2-59rc · amended
27 Oct 2026Evidence →
Medium, CVSS 6.827 Oct 2026
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
PyPI authlib · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-114618 · GHSA-fch4-3c6x-j4gc · amended
27 Oct 2026Evidence →
Medium, CVSS 4.627 Oct 2026
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
PyPI authlib · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2026-114619 · GHSA-q686-2qmg-hqc7 · amended
27 Oct 2026Evidence →
High, CVSS 7.427 Oct 2026
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
PyPI authlib · Upgrade to 1.9.0 or later · >= 1.3.1, < 1.9.0 · CVE-2026-114615 · GHSA-7vr2-2fgp-9w7p · amended
27 Oct 2026Evidence →
Medium, CVSS 6.427 Oct 2026
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0, 3.10.8, 2.4.8 or 2 more by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8; >= 2.2.0, < 2.4.8; >= 2.0.0, < 2.1.19; < 1.30.7 · CVE-2026-108360 · GHSA-2phh-27fw-q4gc · amended
27 Oct 2026Evidence →
High, CVSS 8.727 Oct 2026
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0, 3.10.8, 2.4.8 or 2 more by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8; >= 2.2.0, < 2.4.8; >= 2.0.0, < 2.1.19; < 1.30.7 · CVE-2026-108359 · GHSA-j2w7-387v-m2rq · amended
27 Oct 2026Evidence →
High, CVSS 8.827 Oct 2026
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0, 3.10.8, 2.4.8 or 2 more by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8; >= 2.2.0, < 2.4.8; >= 2.0.0, < 2.1.19; < 1.30.7 · CVE-2026-108358 · GHSA-3x94-m842-937c · amended
27 Oct 2026Evidence →
High, CVSS 8.827 Oct 2026
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
Packagist phpoffice/phpspreadsheet · Upgrade to 5.10.0 or 3.10.8 by release line · >= 4.0.0, < 5.10.0; >= 3.3.0, < 3.10.8 · CVE-2026-108357 · GHSA-rxj4-h86g-25gc · amended
27 Oct 2026Evidence →
High, CVSS 8.727 Oct 2026
compress zstd: Panic on two-block frames
Go github.com/klauspost/compress +1 · Upgrade all 2 to 1.20.2 or later · < 1.20.2 · CVE-2026-116591 · GHSA-fpmh-frq8-7rj8 · amended
27 Oct 2026Evidence →
Low, CVSS 2.627 Oct 2026
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
PyPI authlib · Upgrade to 1.8.0 or later · < 1.8.0 · CVE-2026-114614 · GHSA-jj7h-c3hg-m23x · amended
27 Oct 2026Evidence →
High, CVSS 7.527 Oct 2026
dnspython dns.name.from_wire_parser() excessive CPU use
PyPI dnspython · Upgrade to 2.9.0 or later · < 2.9.0 · CVE-2026-114605 · GHSA-45c3-73f7-pv4m · amended
27 Oct 2026Evidence →
High, CVSS 8.727 Oct 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
PyPI ddtrace · Upgrade to 4.15.6 or 3.19.9 by release line · >= 1.5.0, < 3.19.9; >= 4.0.0, < 4.15.6 · CVE-2026-116588 · GHSA-3633-r77q-h3v3 · amended
27 Oct 2026Evidence →
High, CVSS 8.227 Oct 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
PyPI ddtrace · Upgrade to 4.15.5 or later · >= 3.13.0, < 4.15.5 · CVE-2026-116589 · GHSA-p3m5-h5v9-vqj6 · amended
27 Oct 2026Evidence →
High, CVSS 8.227 Oct 2026
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
PyPI pymongo · Upgrade to 4.18.3 or later · >= 3.9.0, < 4.18.3 · CVE-2026-106435 · GHSA-98qm-wvgf-w4cf · amended
27 Oct 2026Evidence →
High, CVSS 8.127 Oct 2026
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
PyPI vllm · Upgrade to 0.31.0 or later · >= 0.7.3, < 0.31.0 · CVE-2026-114053 · GHSA-h3rc-6mm3-gc2m · amended
27 Oct 2026Evidence →
High, CVSS 7.127 Oct 2026
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
PyPI strands-agents · Upgrade to 1.48.0 or later · < 1.48.0 · GHSA-3w55-933p-8pv5 · amended
27 Oct 2026Evidence →
Medium, CVSS 5.727 Oct 2026
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
PyPI strands-agents · Upgrade to 1.48.0 or later · < 1.48.0 · GHSA-763v-5pjm-fx36 · amended
27 Oct 2026Evidence →
High, CVSS 7.527 Oct 2026
snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
Maven org.xerial.snappy:snappy-java · Upgrade to 1.1.10.9 or later · < 1.1.10.9 · CVE-2026-93451 · GHSA-gwq9-9ffj-mvrv · amended
27 Oct 2026Evidence →
Medium, CVSS 5.927 Oct 2026
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
Maven org.xerial.snappy:snappy-java · Upgrade to 1.1.10.9 or later · < 1.1.10.9 · CVE-2026-116590 · GHSA-xqrx-qh46-34m7 · amended
27 Oct 2026Evidence →
High, CVSS 7.527 Oct 2026
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
Maven org.xerial.snappy:snappy-java · Upgrade to 1.1.10.9 or later · < 1.1.10.9 · CVE-2026-108106 · GHSA-q233-g92q-qxp6 · amended
27 Oct 2026Evidence →
High, CVSS 7.127 Oct 2026
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
PyPI flexible-graphrag · Upgrade to 0.8.2 or later · >= 0.6.0, < 0.8.2 · CVE-2026-114510 · GHSA-vqrg-773h-4wxc · amended
27 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence