Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3426–3450 of 30,921 matching · newest first

ExploitedClear filters

Low, CVSS 3.724 Jul 2026
ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-qvxh-prvr-85w2
24 Jul 2026Evidence →
Low, CVSS 3.724 Jul 2026
ImageMagick: Use-After-Free when freetype initialization fails
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-6jwg-7q3p-5fqm
24 Jul 2026Evidence →
Low, CVSS 3.324 Jul 2026
ImageMagick: Policy Bypass in script operation due to missing checks
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-vghg-5jrg-2398
24 Jul 2026Evidence →
Low, CVSS 3.324 Jul 2026
ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-v3j6-27vc-7pw2
24 Jul 2026Evidence →
Low, CVSS 3.724 Jul 2026
ImageMagick: Heap-use-after-free via XMP profile could result in a crash
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-qh5g-q395-cx4j
24 Jul 2026Evidence →
Medium, CVSS 5.724 Jul 2026
ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.10.3 or later · < 14.10.3 · GHSA-hc76-7mpc-qjqh
24 Jul 2026Evidence →
Medium, CVSS 4.724 Jul 2026
ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-56m6-8q75-f2rw
24 Jul 2026Evidence →
Low, CVSS 3.324 Jul 2026
ImageMagick: Policy Bypass possible with matrix-backed operations
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-rvhp-75f6-9jqh
24 Jul 2026Evidence →
High, CVSS 7.524 Jul 2026
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
crates.io quinn-proto · Upgrade to 0.11.15 or later · >= 0.1.0, < 0.11.15 · GHSA-4w2j-m93h-cj5j
24 Jul 2026Evidence →
High, CVSS 8.724 Jul 2026
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
npm react-router · Upgrade to 7.18.0 or later · >= 7.0.0, < 7.18.0 · CVE-2026-55685 · GHSA-chx6-hx7r-mcp5 · amended
24 Jul 2026Evidence →
Medium, CVSS 6.124 Jul 2026
ImageMagick: Policy Bypass in concatenate operation due to missing checks
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-55628 · GHSA-82mp-vp5c-9pf7
24 Jul 2026Evidence →
Medium, CVSS 5.524 Jul 2026
ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-55597 · GHSA-c4v7-w88g-m6c4
24 Jul 2026Evidence →
Medium, CVSS 4.724 Jul 2026
ImageMagick: Infinite Loop in connected-components when providing invalid arguments
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-55595 · GHSA-qhmf-7fc4-8q3h
24 Jul 2026Evidence →
Medium, CVSS 5.324 Jul 2026
ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-55594 · GHSA-mx48-2qq3-23hf
24 Jul 2026Evidence →
High, CVSS 8.224 Jul 2026
LiquidJS: pop filter bypasses memoryLimit accounting that its array-filter siblings enforce
npm liquidjs · Upgrade to 10.27.1 or later · <= 10.27.0 · CVE-2026-55575 · GHSA-g357-x5c3-c72p · amended
24 Jul 2026Evidence →
Medium, CVSS 5.524 Jul 2026
ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-55510 · GHSA-ff5c-8x9r-8qcw
24 Jul 2026Evidence →
High, CVSS 8.224 Jul 2026
electron-updater: Cross-origin redirect leaks PRIVATE-TOKEN and mixed-case Authorization credentials in builder-util-runtime
npm builder-util-runtime · Upgrade to 9.7.0 or later · < 9.7.0 · CVE-2026-54673 · GHSA-p2f4-r6v6-j797 · amended
24 Jul 2026Evidence →
High, CVSS 7.824 Jul 2026
electron-updater: Uncontrolled search path elements within AppImage built by app-builder-lib
npm app-builder-lib · Upgrade to 26.15.0 or later · < 26.15.0 · CVE-2026-54672 · GHSA-7g7r-gx96-252g · amended
24 Jul 2026Evidence →
Low, CVSS 3.723 Jul 2026
Ruby json: JSON generator heap buffer overflow when streaming to an IO
RubyGems json · Upgrade to 2.19.9 or later · >= 2.9.0, < 2.19.9 · CVE-2026-54696 · GHSA-x2f5-4prf-w687
23 Jul 2026Evidence →
Medium, CVSS 6.323 Jul 2026
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
Maven com.mchange:c3p0 · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2026-55223 · GHSA-w6w4-rjh9-9r58
23 Jul 2026Evidence →
Medium, CVSS 5.123 Jul 2026
React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
npm react-router · Upgrade to 7.18.0 or later · >= 6.0.0, < 7.18.0 · CVE-2026-53669 · GHSA-wrjc-x8rr-h8h6 · amended
23 Jul 2026Evidence →
Medium, CVSS 6.923 Jul 2026
React Router: Open redirect leading to XSS
npm react-router · Upgrade to 7.13.0 or later · >= 7.9.6, <= 7.12.0 · +1 more package · CVE-2026-53668 · GHSA-jjmj-jmhj-qwj2 · amended
23 Jul 2026Evidence →
Medium, CVSS 6.923 Jul 2026
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
npm react-router · Upgrade to 7.18.0 or later · >= 7.11.0, < 7.18.0 · CVE-2026-53667 · GHSA-h8fp-f39c-q6mh · amended
23 Jul 2026Evidence →
Medium, CVSS 6.123 Jul 2026
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
npm react-router · Upgrade to 7.18.0 or later · >= 6.4.0, < 7.18.0 · CVE-2026-53666 · GHSA-337j-9hxr-rhxg · amended
23 Jul 2026Evidence →
Medium, CVSS 5.323 Jul 2026
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-53467 · GHSA-8g53-9m3c-69xg
23 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails

ImageMagick: Use-After-Free when freetype initialization fails

ImageMagick: Policy Bypass in script operation due to missing checks

ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

ImageMagick: Heap-use-after-free via XMP profile could result in a crash

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219

ImageMagick: Policy Bypass possible with matrix-backed operations

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

ImageMagick: Policy Bypass in concatenate operation due to missing checks

ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

ImageMagick: Infinite Loop in connected-components when providing invalid arguments

ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

Ruby json: JSON generator heap buffer overflow when streaming to an IO

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)

React Router: Open redirect leading to XSS

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence