Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3276–3300 of 30,921 matching · newest first

ExploitedClear filters

High, CVSS 8.828 Jul 2026
Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities
Maven com.cedarpolicy:cedar-java · Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line · < 2.3.6; >= 3.1.2, < 3.4.1; >= 4.0.0, < 4.9.0 · CVE-2026-55771 · GHSA-4r9r-4425-74p7 · amended
28 Jul 2026Evidence →
High, CVSS 7.128 Jul 2026
@wakaru/cli arbitrary file write during bundle unpack
npm @wakaru/cli · Upgrade to 1.4.0 or later · >= 1.0.0, < 1.4.0 · CVE-2026-54545 · GHSA-7wpj-vvmv-pgm8
28 Jul 2026Evidence →
High, CVSS 7.528 Jul 2026
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
Go github.com/github/github-mcp-server · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2026-47427 · GHSA-w4q6-qw23-4rg7 · amended
28 Jul 2026Evidence →
Critical, CVSS 9.128 Jul 2026
lettre has TLS hostname verification disabled when using Boring TLS backend
crates.io lettre · Upgrade to 0.11.22 or later · >= 0.10.1, < 0.11.22 · CVE-2026-46428 · GHSA-4pj9-g833-qx53 · amended
28 Jul 2026Evidence →
High, CVSS 8.628 Jul 2026
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
Packagist wp-coding-standards/wpcs · Upgrade to 3.4.1 or later · >= 0.14.1, < 3.4.1 · CVE-2026-45293 · GHSA-3pwp-g2mj-5p3v · amended
28 Jul 2026Evidence →
High, CVSS 8.228 Jul 2026
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Maven io.appium:java-client · Upgrade to 10.1.1 or later · >= 8.2.1, <= 10.1.0 · CVE-2026-43910 · GHSA-28f5-38xr-jh2w · amended
28 Jul 2026Evidence →
Medium, CVSS 6.028 Jul 2026
Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260419162744-978ac87deffe (pre-release) or later · < 0.0.0-20260419162744-978ac87deffe · GHSA-hp74-gm6m-2qm5 · amended
28 Jul 2026Evidence →
High, CVSS 8.528 Jul 2026
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260419162744-978ac87deffe (pre-release) or later · < 0.0.0-20260419162744-978ac87deffe · CVE-2026-43983 · GHSA-w6p7-2fxx-4f44 · amended
28 Jul 2026Evidence →
Unrated28 Jul 2026
HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
runtime node · Upgrade to 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1 · CVE-2026-56846
28 Jul 2026Evidence →
Unrated28 Jul 2026
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58045
28 Jul 2026Evidence →
Unrated28 Jul 2026
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58043
28 Jul 2026Evidence →
Unrated28 Jul 2026
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58042
28 Jul 2026Evidence →
Unrated28 Jul 2026
Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58039
28 Jul 2026Evidence →
Unrated28 Jul 2026
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58044
28 Jul 2026Evidence →
Unrated28 Jul 2026
Permission Model Bypass: trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-56847
28 Jul 2026Evidence →
Unrated28 Jul 2026
HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-56850
28 Jul 2026Evidence →
Unrated28 Jul 2026
Re-entrant nghttp2_session_mem_send() during nghttp2_session_mem_recv() causes heap-use-after-free in Node.js HTTP/2
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-56848
28 Jul 2026Evidence →
Unrated28 Jul 2026
node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely
runtime node · Upgrade to 26.5.1 or 24.18.1 by release line · >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58041
28 Jul 2026Evidence →
Unrated28 Jul 2026
HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58040
28 Jul 2026Evidence →
Medium, CVSS 6.527 Jul 2026
org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
Maven org.xwiki.contrib:discussions-server · Upgrade to 2.0-rc-1 (pre-release) or later · < 2.0-rc-1 · CVE-2023-37465 · GHSA-4j38-rw27-97gx · amended
27 Jul 2026Evidence →
High, CVSS 7.527 Jul 2026
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-24451 · GHSA-wrf9-r3h7-7x5v · amended
27 Jul 2026Evidence →
High, CVSS 8.127 Jul 2026
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58439 · GHSA-w5pg-649r-p6gg · amended
27 Jul 2026Evidence →
Critical, CVSS 9.627 Jul 2026
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Go code.gitea.io/gitea · Upgrade to 1.26.2 or later · >= 1.22.0, < 1.26.2 · CVE-2026-58426 · GHSA-hg5r-vq93-9fv6 · amended
27 Jul 2026Evidence →
High, CVSS 7.527 Jul 2026
Gitea: Unauthorized Access to Labels of Private Organizations
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-25038 · GHSA-v73x-hx65-6pf4 · amended
27 Jul 2026Evidence →
Medium, CVSS 5.327 Jul 2026
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
Go code.gitea.io/gitea · Upgrade to 1.26.0 or later · < 1.26.0 · GHSA-rjvx-x5h2-6px5 · amended
27 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

@wakaru/cli arbitrary file write during bundle unpack

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

lettre has TLS hostname verification disabled when using Boring TLS backend

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant

dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records

Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths

HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser

Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`

HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates

Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely

HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)

org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea: Unauthorized Access to Labels of Private Organizations

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence