Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

2901–2925 of 14,168 Critical + High advisories · newest first

Show all severities

Exploited

Critical, CVSS 9.127 May 2026
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in JavaExprAlgorithmExecutionFactory
Maven org.yamcs:yamcs-core · Upgrade to 5.12.7 or later · < 5.12.7 · CVE-2026-44632 · GHSA-524g-x36v-9wm6
27 May 2026Evidence →
High, CVSS 8.826 May 2026
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
Packagist getkirby/cms · Upgrade to 5.4.1 or later · >= 5.3.0, <= 5.4.0 · CVE-2026-44177 · GHSA-9hx7-c53c-v6x8
26 May 2026Evidence →
High, CVSS 8.526 May 2026
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-44175 · GHSA-5fhx-9q32-q257
26 May 2026Evidence →
High, CVSS 8.726 May 2026
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-44174 · GHSA-86rh-h242-j8xp
26 May 2026Evidence →
High, CVSS 8.926 May 2026
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0, <= 1.3.0 · CVE-2026-43947 · GHSA-rg3m-cfq7-g6h6 · amended
26 May 2026Evidence →
High, CVSS 7.726 May 2026
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0, <= 1.3.0 · CVE-2026-43946 · GHSA-fwcm-rqvw-j3p7 · amended
26 May 2026Evidence →
High, CVSS 8.926 May 2026
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
npm @frangoteam/fuxa · Upgrade to 1.3.1 or later · >= 1.2.11, < 1.3.1 · CVE-2026-43945 · GHSA-p69w-mmfv-xrfj · amended
26 May 2026Evidence →
High, CVSS 7.026 May 2026
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
npm @fedify/fedify · Upgrade to 2.2.3, 2.1.14, 2.0.18 or 2 more by release line · >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.14; >= 2.0.0, < 2.0.18; >= 1.10.0, < 1.10.10; < 1.9.11 · CVE-2026-42462 · GHSA-9rfg-v8g9-9367 · amended
26 May 2026Evidence →
High, CVSS 8.626 May 2026
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
npm yeoman-environment · Upgrade to 6.0.1 or later · >= 2.9.0, < 6.0.1 · CVE-2026-42089 · GHSA-vv9j-gjw2-j8wp · amended
26 May 2026Evidence →
High, CVSS 7.526 May 2026
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
Maven org.xwiki.platform:xwiki-platform-livetable-ui · Upgrade to 17.10.3, 17.4.9 or 16.10.17 by release line · >= 6.2.1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 · CVE-2026-48048 · GHSA-rh28-mqj4-8x59
26 May 2026Evidence →
Critical, CVSS 9.326 May 2026
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.3, 17.4.9 or 16.10.17 by release line · >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-33137 · GHSA-qrvh-r3f2-9h4r
26 May 2026Evidence →
High, CVSS 8.726 May 2026
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
npm @typebot.io/js · Upgrade to 0.10.1 or later · < 0.10.1 · CVE-2026-28445 · GHSA-6m7c-xfhp-p9fh · amended
26 May 2026Evidence →
Critical, CVSS 9.326 May 2026
XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash
Maven org.xwiki.commons:xwiki-commons-classloader-api · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.3, 17.4.9 or 16.10.17 by release line · >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-23734 · GHSA-xq3r-2qv5-vqqm
26 May 2026Evidence →
Critical, CVSS 9.926 May 2026
KubeVirt has a Link Following vulnerability
Go kubevirt.io/kubevirt · Upgrade to 1.8.3, 1.7.4 or 1.6.6 by release line · >= 1.8.0-alpha.0, < 1.8.3; >= 1.7.0-alpha.0, < 1.7.4; < 1.6.6 · CVE-2026-7374 · GHSA-7jcp-v9w4-wjmg
26 May 2026Evidence →
High, CVSS 7.726 May 2026
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
npm pacote · Upgrade to 21.5.1 or later · >= 11.2.7, < 21.5.1 · CVE-2026-9496 · GHSA-w4pp-8pjf-rmxw · amended
26 May 2026Evidence →
High, CVSS 7.226 May 2026
Apache Syncope has an Improper Isolation or Compartmentalization vulnerability
Maven org.apache.syncope.core:syncope-core-spring · Upgrade to 4.1.1 or 4.0.6 by release line; some affected versions have no fix yet · >= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, < 4.0.6; >= 4.1.0-M0, < 4.1.1 · CVE-2026-42782 · GHSA-gq7g-vg2q-jvq3
26 May 2026Evidence →
High, CVSS 8.126 May 2026
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default
PyPI apache-airflow-providers-google · Upgrade to 22.0.0 or later · < 22.0.0 · CVE-2026-45361 · GHSA-g9v5-gjwf-9rwx · amended
26 May 2026Evidence →
Critical, CVSS 9.026 May 2026
MLflow allows unauthorized access to multipart upload endpoints when the --serve-artifacts mode is enabled
PyPI mlflow · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-2651 · GHSA-8c7q-86fq-vvmh · amended
26 May 2026Evidence →
High, CVSS 7.826 May 2026
HuggingFace transformers vulnerable to remote code execution
PyPI transformers · Upgrade to 5.3.0 or later · < 5.3.0 · CVE-2026-4372 · GHSA-29pf-2h5f-8g72 · amended
26 May 2026Evidence →
Critical, CVSS 9.326 May 2026
Dolibarr ERP CRM contains a remote code evaluation vulnerability
Packagist dolibarr/dolibarr · Upgrade to 7.0.4 or 6.0.8 by release line · >= 7.0.0, <= 7.0.3; < 6.0.8 · CVE-2018-25357 · GHSA-hxmh-2xc4-c894
26 May 2026Evidence →
Critical, CVSS 9.826 May 2026
Apache CXF has an LDAP injection vulnerability
Maven org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap · Upgrade to 4.2.1, 4.1.6 or 3.6.11 by release line · >= 4.2.0, <= 4.2.0; >= 4.1.0, < 4.1.6; < 3.6.11 · CVE-2026-44930 · GHSA-pg32-686q-qh6x
26 May 2026Evidence →
High, CVSS 7.126 May 2026
Mattermost doesn't validate file ownership and access control
Go github.com/mattermost/mattermost-server · Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line · >= 11.6.0, <= 11.6.0; >= 11.5.0, < 11.5.4; >= 11.4.0, < 11.4.5; >= 10.11.0, < 10.11.15 · CVE-2026-3473 · GHSA-7pf2-9c95-w332
26 May 2026Evidence →
High, CVSS 7.526 May 2026
Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20260410202636-17939826efa2 (pre-release) or later · < 8.0.0-20260410202636-17939826efa2 · +1 more package · CVE-2026-5740 · GHSA-w9m8-p4cc-4qj9
26 May 2026Evidence →
High, CVSS 7.526 May 2026
Mattermost doesn't enforce request body size limits on plugin HTTP endpoints
Go github.com/mattermost/mattermost-plugin-github · Upgrade to 1.0.1-0.20260410143745-9b41b1fd43c4 (pre-release) or later · < 1.0.1-0.20260410143745-9b41b1fd43c4 · +1 more package · CVE-2026-5308 · GHSA-jmvr-r5hm-fxfr
26 May 2026Evidence →
High, CVSS 7.526 May 2026
Apache CXF: Untrusted JMS configuration can lead to RCE
Maven org.apache.cxf:cxf-rt-transports-jms · Upgrade to 4.2.1, 4.1.6 or 3.6.11 by release line · >= 4.2.0, <= 4.2.0; >= 4.1.0, < 4.1.6; < 3.6.11 · CVE-2026-44417 · GHSA-2hvc-5c6v-f533
26 May 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup

Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend

Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash

KubeVirt has a Link Following vulnerability

pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

Apache Syncope has an Improper Isolation or Compartmentalization vulnerability

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

HuggingFace transformers vulnerable to remote code execution

Dolibarr ERP CRM contains a remote code evaluation vulnerability

Apache CXF has an LDAP injection vulnerability

Mattermost doesn't validate file ownership and access control

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Mattermost doesn't enforce request body size limits on plugin HTTP endpoints

Apache CXF: Untrusted JMS configuration can lead to RCE

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence