Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3526–3550 of 30,921 matching · newest first

ExploitedClear filters

Medium, CVSS 6.522 Jul 2026
Netty: STOMP CONNECT Frame Header Injection in Netty
Maven io.netty:netty-codec-stomp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-59920 · GHSA-3g8r-4pfx-jmfh
22 Jul 2026Evidence →
Medium, CVSS 5.522 Jul 2026
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-59919 · GHSA-wh89-7897-x99h
22 Jul 2026Evidence →
High, CVSS 8.722 Jul 2026
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
Maven io.netty:netty-codec-compression · Upgrade to 4.2.16.Final or later · >= 4.2.0.Final, < 4.2.16.Final · +1 more package · CVE-2026-59901 · GHSA-558v-64gr-wgg4
22 Jul 2026Evidence →
Medium, CVSS 6.922 Jul 2026
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; < 4.1.136.Final · CVE-2026-59900 · GHSA-c69g-56f8-xwqj
22 Jul 2026Evidence →
Medium, CVSS 6.922 Jul 2026
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; < 4.1.136.Final · CVE-2026-59899 · GHSA-q4f6-jm68-57ww
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; < 4.1.136.Final · CVE-2026-59898 · GHSA-4mp9-239f-g9hg
22 Jul 2026Evidence →
High, CVSS 7.422 Jul 2026
Netty: TOCTOU in OcspServerCertificateValidator
Maven io.netty:netty-handler-ssl-ocsp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56822 · GHSA-wc96-39fc-566f
22 Jul 2026Evidence →
High, CVSS 7.422 Jul 2026
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
Maven io.netty:netty-handler-ssl-ocsp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56821 · GHSA-g7hg-vrcf-mvmr
22 Jul 2026Evidence →
High, CVSS 7.422 Jul 2026
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Maven io.netty:netty-handler-ssl-ocsp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56820 · GHSA-272m-gcwp-mpwg
22 Jul 2026Evidence →
High, CVSS 8.322 Jul 2026
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
Maven io.netty:netty-codec-xml · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-56817 · GHSA-4qhr-g3c6-fcfx
22 Jul 2026Evidence →
High, CVSS 7.522 Jul 2026
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.16.Final or later · < 4.2.16.Final · CVE-2026-56816 · GHSA-hpcc-26xq-25fv
22 Jul 2026Evidence →
Medium, CVSS 6.522 Jul 2026
Netty: Security Control Bypass via CORS Short-Circuit Failure
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56746 · GHSA-6cqp-g7gg-8hr5
22 Jul 2026Evidence →
High, CVSS 8.722 Jul 2026
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-56745 · GHSA-jppx-w49h-x2qq
22 Jul 2026Evidence →
Medium, CVSS 6.322 Jul 2026
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-56722 · GHSA-cx96-42px-69fm
22 Jul 2026Evidence →
High, CVSS 8.722 Jul 2026
Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-55851 · GHSA-q6cq-mhr2-jmr5
22 Jul 2026Evidence →
High, CVSS 7.522 Jul 2026
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-55833 · GHSA-mvh2-crg5-v77c
22 Jul 2026Evidence →
High, CVSS 7.522 Jul 2026
Netty SPDY SETTINGS frame count materializes unbounded settings map
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-55831 · GHSA-6jqx-86gh-f27w
22 Jul 2026Evidence →
Low, CVSS 2.322 Jul 2026
Dompdf: File existence oracle via font-face stylesheet declaration
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-55555 · GHSA-7x2p-4jvh-6384
22 Jul 2026Evidence →
Low, CVSS 2.322 Jul 2026
Dompdf: Chroot Validation Bypass
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-55554 · GHSA-wvh6-f5jh-8gw4
22 Jul 2026Evidence →
Medium, CVSS 5.122 Jul 2026
n8n: Google Service Account Private Key Exposed in JWT Header
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65599 · GHSA-9r8p-h6cc-6qhm · amended
22 Jul 2026Evidence →
High, CVSS 8.422 Jul 2026
n8n: Stored DOM XSS via Resource Locator cachedResultUrl
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65592 · GHSA-9wcp-9r3j-383q · amended
22 Jul 2026Evidence →
High, CVSS 8.222 Jul 2026
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65597 · GHSA-p3rg-hrf9-w9gj · amended
22 Jul 2026Evidence →
High, CVSS 8.922 Jul 2026
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65598 · GHSA-g3r5-9h93-4j2c · amended
22 Jul 2026Evidence →
High, CVSS 7.222 Jul 2026
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
npm n8n · Upgrade to 2.30.1 or 2.29.8 by release line · >= 2.30.0, < 2.30.1; < 2.29.8 · CVE-2026-65015 · GHSA-x5vx-c2c8-m3w9 · amended
22 Jul 2026Evidence →
Medium, CVSS 6.622 Jul 2026
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
npm fflate · Upgrade to 0.8.3, 0.7.5, 0.6.11 or 2 more by release line · >= 0.4.5, < 0.4.9; >= 0.5.0, < 0.5.4; >= 0.6.0, < 0.6.11; >= 0.7.0, < 0.7.5; >= 0.8.0, < 0.8.3 · CVE-2026-45820 · GHSA-px8p-9vwx-vf98 · amended
22 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence