Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

2901–2925 of 30,921 matching · newest first

ExploitedClear filters

High, CVSS 7.811 Aug 2026
Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62886 · GHSA-jqhp-238x-qhgf · amended
11 Aug 2026Evidence →
High, CVSS 7.511 Aug 2026
Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +10 · Upgrade all 11 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62901 · GHSA-m93f-wj8c-rp8p · amended
11 Aug 2026Evidence →
Medium, CVSS 5.911 Aug 2026
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62899 · GHSA-r6mh-95jw-g7qg · amended
11 Aug 2026Evidence →
High, CVSS 7.511 Aug 2026
Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +2 · Upgrade all 3 to 10.0.11, 9.0.19 or 8.0.30 by release line · >= 10.0.0, <= 10.0.10; >= 9.0.0, <= 9.0.18; >= 8.0.0, <= 8.0.29 · CVE-2026-62898 · GHSA-c494-m2fq-59mx · amended
11 Aug 2026Evidence →
Critical, CVSS 9.311 Aug 2026
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171120-69da20bdaec9 (pre-release) or later · < 0.0.0-20260512171120-69da20bdaec9 · CVE-2026-73080 · GHSA-87fv-vqqr-m4jr · amended
11 Aug 2026Evidence →
Unrated11 Aug 2026
Panic-safety unsoundness in truncate_back, truncate_front, clear, and extend_from_slice (use-after-free / double-free)
crates.io circular-buffer · Upgrade to 2.0.1 or later · >= 0.0.0-0, < 2.0.1
11 Aug 2026Evidence →
Medium, CVSS 4.611 Aug 2026
Inverted bitmap validation in invalidate_l2_cached_ept
crates.io tdx-guest · Upgrade to 0.3.1 or later · >= 0.1.8, < 0.3.1 · CVE-2026-20765 · GHSA-56j3-r4r2-x3x6
11 Aug 2026Evidence →
Medium, CVSS 4.611 Aug 2026
enter_l2_vcpu passes the wrong RCX operand to TDG.VP.ENTER
crates.io tdx-guest · Upgrade to 0.3.1 or later · >= 0.1.8, < 0.3.1 · CVE-2026-20763 · GHSA-wgvc-hf5h-m5h7
11 Aug 2026Evidence →
High, CVSS 7.011 Aug 2026
SAP Approuter has an Information Disclosure vulnerability
npm @sap/approuter · Upgrade to 23.0.0 or later · < 23.0.0 · CVE-2026-58230 · GHSA-vhh6-v828-x62f
11 Aug 2026Evidence →
Critical, CVSS 9.910 Aug 2026
Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs
PyPI feast · Upgrade to 0.67.0 or later · < 0.67.0 · CVE-2026-18948 · GHSA-gg2p-37pv-v7fq · amended
10 Aug 2026Evidence →
Medium, CVSS 6.510 Aug 2026
Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure
PyPI apache-airflow-providers-yandex · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2026-68871 · GHSA-qmrf-jrpr-rjx6
10 Aug 2026Evidence →
Medium, CVSS 5.510 Aug 2026
Keras model loading is vulnerable to denial of service through HDF5 shape bombs
PyPI keras · Upgrade to 3.15.0 or later · < 3.15.0 · CVE-2026-12570 · GHSA-74m6-m3xx-3vmj
10 Aug 2026Evidence →
Low, CVSS 3.710 Aug 2026
NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts
PyPI nltk · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-12372 · GHSA-2jhm-w3mp-jcwr
10 Aug 2026Evidence →
Unrated9 Aug 2026
Ed25519 identity public keys permit universal signature forgery
crates.io dcrypt-sign · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-7j32-2mpw-c784
9 Aug 2026Evidence →
Unrated9 Aug 2026
Safe ErrorRegistry APIs can cause undefined behavior
crates.io dcrypt-api · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-7hc7-h3f2-r4j6
9 Aug 2026Evidence →
Unrated9 Aug 2026
Low-level GCM ignores the operation nonce
crates.io dcrypt-algorithms · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-h9f2-fgp8-vc4h
9 Aug 2026Evidence →
Unrated9 Aug 2026
Streaming AEAD does not authenticate stream structure
crates.io dcrypt-symmetric · Upgrade to 2.0.0 or later · >= 0.0.0-0, < 2.0.0 · GHSA-8cwp-4826-jg9f
9 Aug 2026Evidence →
High, CVSS 8.78 Aug 2026
Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3 or later · >= 2.1.0, < 2.1.3 · CVE-2026-8798 · GHSA-v6w3-qrh8-qccc · amended
8 Aug 2026Evidence →
High, CVSS 8.78 Aug 2026
Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · CVE-2026-13505 · GHSA-98j2-6v39-78w8 · amended
8 Aug 2026Evidence →
Medium, CVSS 4.87 Aug 2026
pypdf: Possible large memory usage for large /ToUnicode streams
PyPI pypdf · Upgrade to 6.15.0 or later · < 6.15.0 · CVE-2026-71870 · GHSA-fp3f-mc75-235c
7 Aug 2026Evidence →
Medium, CVSS 4.87 Aug 2026
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
PyPI pypdf · Upgrade to 6.15.0 or later · < 6.15.0 · CVE-2026-71852 · GHSA-fwg2-594c-jp42
7 Aug 2026Evidence →
Critical, CVSS 9.07 Aug 2026
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
npm crypto-js · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2026-71851 · GHSA-rg76-677x-56q9 · amended
7 Aug 2026Evidence →
Medium, CVSS 4.87 Aug 2026
Hono: memo() retains SSR output across requests, leading to cross-user data disclosure
npm hono · Upgrade to 4.12.34 or later · >= 3.8.0, < 4.12.34 · CVE-2026-71850 · GHSA-f23p-vx2j-j53r
7 Aug 2026Evidence →
Low, CVSS 3.77 Aug 2026
Hono: Proxy Helper does not remove response headers listed in the Connection header
npm hono · Upgrade to 4.12.34 or later · >= 4.7.0, < 4.12.34 · CVE-2026-71849 · GHSA-79qm-7rj5-m7r9
7 Aug 2026Evidence →
Medium, CVSS 5.37 Aug 2026
Hono: Algorithmic Complexity DoS in Language Middleware
npm hono · Upgrade to 4.12.34 or later · >= 4.12.0, < 4.12.34 · CVE-2026-71848 · GHSA-54fx-42gc-7vw4
7 Aug 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)

Inverted bitmap validation in `invalidate_l2_cached_ept`

`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`

SAP Approuter has an Information Disclosure vulnerability

Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs

Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure

Keras model loading is vulnerable to denial of service through HDF5 shape bombs

NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts

Ed25519 identity public keys permit universal signature forgery

Safe ErrorRegistry APIs can cause undefined behavior

Low-level GCM ignores the operation nonce

Streaming AEAD does not authenticate stream structure

Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound

Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.

pypdf: Possible large memory usage for large /ToUnicode streams

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono: Algorithmic Complexity DoS in Language Middleware

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence