Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3326–3350 of 30,921 matching · newest first

ExploitedClear filters

High, CVSS 7.424 Jul 2026
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
Maven org.http4s:blaze-http_3 · Upgrade to 1.0.0-M42 (pre-release) or 0.23.18 by release line · <= 0.23.17; >= 1.0.0-M1, < 1.0.0-M42 · +2 more packages · CVE-2026-73495 · GHSA-46q4-43ph-c6fr
24 Jul 2026Evidence →
High, CVSS 7.424 Jul 2026
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Maven org.http4s:blaze-http_3 · Upgrade to 1.0.0-M42 (pre-release) or 0.23.18 by release line · <= 0.23.17; >= 1.0.0-M1, <= 1.0.0-M41 · +2 more packages · CVE-2026-73494 · GHSA-mhvj-jhpq-885v
24 Jul 2026Evidence →
High, CVSS 8.124 Jul 2026
Poweradmin: OIDC sub collation bypass in Poweradmin leading to account takeover
Packagist poweradmin/poweradmin · Upgrade to 4.3.4 or 4.2.5 by release line · >= 4.1.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-cmwh-g2h8-c222
24 Jul 2026Evidence →
High, CVSS 8.124 Jul 2026
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own
Packagist poweradmin/poweradmin · Upgrade to 4.3.4, 4.2.5 or 3.9.11 by release line · >= 3.0.0, < 3.9.11; >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-rm67-g9ch-vxff
24 Jul 2026Evidence →
High, CVSS 8.824 Jul 2026
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
Packagist poweradmin/poweradmin · Upgrade to 4.3.4 or 4.2.5 by release line · >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4 · GHSA-h4hf-v6w5-897x
24 Jul 2026Evidence →
Critical, CVSS 10.024 Jul 2026
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
Packagist pheditor/pheditor · Upgrade to 2.0.8 or later · < 2.0.8 · GHSA-f25v-x6vr-962g
24 Jul 2026Evidence →
High, CVSS 7.524 Jul 2026
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
npm brace-expansion · Upgrade to 5.0.8, 3.0.3, 2.1.3 or 1.1.17 by release line · >= 4.0.0, < 5.0.8; >= 3.0.0, < 3.0.3; >= 2.0.0, < 2.1.3; < 1.1.17 · CVE-2026-14257 · GHSA-mh99-v99m-4gvg · amended
24 Jul 2026Evidence →
Critical, CVSS 9.124 Jul 2026
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
npm sm-crypto · Upgrade to 0.5.0 or later · < 0.5.0 · CVE-2026-73567 · GHSA-vh45-f885-3848 · amended
24 Jul 2026Evidence →
Low, CVSS 2.324 Jul 2026
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics
crates.io hubuum_client · Upgrade to 0.6.1 or later · <= 0.6.0 · GHSA-2625-rw7m-5q5x
24 Jul 2026Evidence →
Medium, CVSS 6.324 Jul 2026
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
crates.io hubuum_client · Upgrade to 0.6.1 or later · >= 0.3.0, <= 0.6.0 · GHSA-qqc3-94qv-7fw3
24 Jul 2026Evidence →
Medium, CVSS 6.324 Jul 2026
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
crates.io hubuum_client · Upgrade to 0.6.1 or later · >= 0.0.1, < 0.6.1 · GHSA-f45q-w629-wr25
24 Jul 2026Evidence →
High, CVSS 7.524 Jul 2026
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
npm @anephenix/hub · Upgrade to 0.2.16 or later · < 0.2.16 · CVE-2026-73561 · GHSA-g5vv-q72c-7j78 · amended
24 Jul 2026Evidence →
Critical, CVSS 9.624 Jul 2026
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
Maven org.openidentityplatform.opendj:opendj-server-legacy · Upgrade to 5.1.2 or later · <= 5.1.1 · CVE-2026-73644 · GHSA-p279-2cqp-84jg
24 Jul 2026Evidence →
Critical, CVSS 9.424 Jul 2026
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
Maven org.openidentityplatform.opendj:opendj-dsml-servlet · Upgrade to 5.1.2 or later · <= 5.1.1 · GHSA-68r5-9hpg-7qw9
24 Jul 2026Evidence →
High, CVSS 8.824 Jul 2026
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
Packagist pheditor/pheditor · Upgrade to 2.0.7 or later · <= 2.0.6 · GHSA-g3hq-hphg-8fhh
24 Jul 2026Evidence →
High, CVSS 8.724 Jul 2026
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
PyPI gitpython · Upgrade to 3.1.55 or later · < 3.1.55 · CVE-2026-73622 · GHSA-94p4-4cq8-9g67 · amended
24 Jul 2026Evidence →
Medium, CVSS 4.924 Jul 2026
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
npm @budibase/server · Upgrade to 3.39.25 or later · < 3.39.25 · CVE-2026-73304 · GHSA-fcrw-f7gg-6g9f · amended
24 Jul 2026Evidence →
High, CVSS 7.524 Jul 2026
react-server-dom: Denial of Service in Server Functions
npm react-server-dom-turbopack · Upgrade to 19.2.8, 19.1.9 or 19.0.8 by release line · >= 19.0.0, < 19.0.8; >= 19.1.0, < 19.1.9; >= 19.2.0, < 19.2.8 · +2 more packages · CVE-2026-44907 · GHSA-wx67-qw84-cm4g · amended
24 Jul 2026Evidence →
Critical, CVSS 9.824 Jul 2026
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
Maven org.openidentityplatform.openam:openam-core · Upgrade to 16.1.2 or later · <= 16.1.1 · CVE-2026-62379 · GHSA-wg5r-wc3x-39vc
24 Jul 2026Evidence →
Medium, CVSS 6.124 Jul 2026
OpenAM Reflected XSS in the OAuth2/OIDC wap consent page
Maven org.openidentityplatform.openam:openam-oauth2 · Upgrade to 16.1.2 or later · >= 13.0.0, <= 16.1.1 · CVE-2026-62280 · GHSA-vqxv-6xrh-49cp
24 Jul 2026Evidence →
Critical, CVSS 9.224 Jul 2026
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Maven org.openidentityplatform.openam:openam-auth-webauthn · Upgrade to 16.1.2 or later · <= 16.1.1 · CVE-2026-62263 · GHSA-gf8h-gq53-288j
24 Jul 2026Evidence →
High, CVSS 7.724 Jul 2026
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
PyPI open-webui · Upgrade to 0.10.0 or later · >= 0.9.6, < 0.10.0 · CVE-2026-59221 · GHSA-frvj-c5qp-xj4w · amended
24 Jul 2026Evidence →
Medium, CVSS 5.424 Jul 2026
Open WebUI: Arena task endpoints can bypass underlying model access controls
PyPI open-webui · Upgrade to 0.10.0 or later · >= 0.8.12, < 0.10.0 · CVE-2026-59225 · GHSA-m3qf-58wf-w979 · amended
24 Jul 2026Evidence →
Medium, CVSS 5.424 Jul 2026
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
PyPI open-webui · Upgrade to 0.10.0 or later · >= 0.9.6, < 0.10.0 · CVE-2026-59212 · GHSA-2xwm-4h2q-ggfx · amended
24 Jul 2026Evidence →
High, CVSS 8.024 Jul 2026
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
PyPI open-webui · Upgrade to 0.10.0 or later · < 0.10.0 · CVE-2026-59224 · GHSA-j657-m4c4-24jq · amended
24 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

react-server-dom: Denial of Service in Server Functions

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence