Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

2726–2750 of 14,168 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 7.58 Jun 2026
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44250 · GHSA-3244-j874-rhc2
8 Jun 2026Evidence →
High, CVSS 8.18 Jun 2026
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44249 · GHSA-3qp7-7mw8-wx86
8 Jun 2026Evidence →
High, CVSS 8.28 Jun 2026
Routinator crashes when sending a maliciously crafted select-asn query parameter
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49234 · GHSA-gc6q-cwcj-3vh9
8 Jun 2026Evidence →
High, CVSS 8.78 Jun 2026
Routinator crashes when encountering maliciously crafted RRDP XML files
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49235 · GHSA-5qf9-cf9c-hjc6
8 Jun 2026Evidence →
High, CVSS 8.38 Jun 2026
Routinator has cache path traversal when processing the module component of rsync URIs
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49233 · GHSA-33mj-99mg-8g73
8 Jun 2026Evidence →
Critical, CVSS 9.58 Jun 2026
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
npm cordova-plugin-inappbrowser · Upgrade to 6.0.1 or later · < 6.0.1 · CVE-2026-47430 · GHSA-q42j-x8rq-pjg6 · amended
8 Jun 2026Evidence →
High, CVSS 8.75 Jun 2026
Twig: Possible sandbox bypass when using a source policy
Packagist twig/twig · Upgrade to 3.26.0; some affected versions have no fix yet · >= 2.16.0, <= 2.16.1; >= 3.9.0, < 3.26.0 · CVE-2026-24425 · GHSA-2q52-x2ff-qgfr
5 Jun 2026Evidence →
Critical, CVSS 9.95 Jun 2026
Shopper: Authorization bypass and RBAC privilege escalation in team settings
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47744 · GHSA-c3qp-2ggw-xjg7
5 Jun 2026Evidence →
High, CVSS 8.75 Jun 2026
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47743 · GHSA-hr9v-r8r2-hg7j
5 Jun 2026Evidence →
High, CVSS 8.75 Jun 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin data-mce-object injection
NuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · <= 5.10.9; >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1 · CVE-2026-47761 · GHSA-vg35-5wq7-3x7w
5 Jun 2026Evidence →
High, CVSS 8.75 Jun 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through mce:protected comments
NuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1; <= 5.10.9 · CVE-2026-47762 · GHSA-v98h-vmpc-fpqv · amended
5 Jun 2026Evidence →
High, CVSS 8.75 Jun 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
NuGet tinymce +2 · Upgrade all 3 to 8.5.1 or 7.9.3 by release line; some affected versions have no fix yet · >= 6.0.0, < 7.9.3; >= 8.0.0, < 8.5.1; <= 5.10.9 · CVE-2026-47759 · GHSA-q742-qvgc-gc2f · amended
5 Jun 2026Evidence →
High, CVSS 8.75 Jun 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
NuGet tinymce +2 · Upgrade all 3 to 7.1.0 or later · >= 6.8.0, < 7.1.0 · CVE-2026-47760 · GHSA-mh5m-5hw4-5c69 · amended
5 Jun 2026Evidence →
High, CVSS 7.15 Jun 2026
skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion
crates.io skillctl · Upgrade to 0.1.2 or later · < 0.1.2 · GHSA-wx3m-whqv-xv47
5 Jun 2026Evidence →
Critical, CVSS 9.15 Jun 2026
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
PyPI ait-core · Upgrade to 3.1.1 or 2.6.1 by release line · >= 3.1.0, <= 3.1.0; < 2.6.1 · CVE-2026-47731 · GHSA-p462-prxw-mjx4 · amended
5 Jun 2026Evidence →
High, CVSS 7.55 Jun 2026
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52878 · GHSA-rm5c-5x2p-48wr
5 Jun 2026Evidence →
High, CVSS 7.55 Jun 2026
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52880 · GHSA-w4c6-7r69-w7j9
5 Jun 2026Evidence →
High, CVSS 7.55 Jun 2026
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
Go github.com/klever-io/klever-go · Upgrade to 1.7.18 or later · >= 1.7.14, <= 1.7.17 · CVE-2026-52879 · GHSA-hf2g-6j7h-98wg
5 Jun 2026Evidence →
High, CVSS 8.85 Jun 2026
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
npm dbgate-api · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-48017 · GHSA-hv83-ggc4-v385 · amended
5 Jun 2026Evidence →
High, CVSS 7.75 Jun 2026
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
npm @sync-in/server · Upgrade to 2.3.0 or later · <= 2.2.1 · CVE-2026-47684 · GHSA-q4x5-8cj6-52wg · amended
5 Jun 2026Evidence →
Critical, CVSS 9.45 Jun 2026
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
npm dbgate-api · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47670 · GHSA-wm5r-5qp3-5vxf · amended
5 Jun 2026Evidence →
High, CVSS 8.35 Jun 2026
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
PyPI praisonai-platform · Upgrade to 0.1.4 or later · < 0.1.4 · CVE-2026-47419 · GHSA-7p8g-6c6g-h9w7 · amended
5 Jun 2026Evidence →
Critical, CVSS 9.35 Jun 2026
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
npm dbgate · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47669 · GHSA-h535-j5hr-mv56 · amended
5 Jun 2026Evidence →
Critical, CVSS 10.05 Jun 2026
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
npm dbgate-serve · Upgrade to 7.1.9 or later · <= 7.1.8 · CVE-2026-47668 · GHSA-8v3q-9vmx-36vc · amended
5 Jun 2026Evidence →
High, CVSS 7.55 Jun 2026
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses FilePerms::WRITE host restriction
crates.io wasmtime-wasi · Upgrade to 44.0.2, 36.0.10 or 24.0.9 by release line · >= 37.0.0, < 44.0.2; >= 25.0.0, < 36.0.10; < 24.0.9 · CVE-2026-47261 · GHSA-2r75-cxrj-cmph
5 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Routinator crashes when sending a maliciously crafted select-asn query parameter

Routinator crashes when encountering maliciously crafted RRDP XML files

Routinator has cache path traversal when processing the module component of rsync URIs

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

Twig: Possible sandbox bypass when using a source policy

Shopper: Authorization bypass and RBAC privilege escalation in team settings

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion

NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt

klever-go: REST API slow-header connection exhaustion via Gin Engine.Run

klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence