Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3576–3600 of 14,168 Critical + High advisories · newest first

Show all severities

Exploited

Critical, CVSS 9.827 Apr 2026
Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)
Maven org.apache.mina:mina-core · Upgrade to 2.2.6, 2.1.11 or 2.0.28 by release line · >= 2.0.0, < 2.0.28; >= 2.1.0, < 2.1.11; >= 2.2.0, < 2.2.6 · CVE-2026-41409 · GHSA-f2wh-grmh-r6jm
27 Apr 2026Evidence →
High, CVSS 8.827 Apr 2026
Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data
Maven org.apache.camel:camel-infinispan · Upgrade to 4.20.0, 4.18.2 or 4.14.7 by release line · >= 4.0.0, < 4.14.7; >= 4.15.0, < 4.18.2; >= 4.19.0, < 4.20.0 · CVE-2026-40858 · GHSA-4xwx-hvv7-7prj
27 Apr 2026Evidence →
Critical, CVSS 9.927 Apr 2026
Apache Camel has an incomplete fix for CVE-2025-27636
Maven org.apache.camel:camel-jms +3 · Upgrade all 4 to 4.20.0, 4.18.2 or 4.14.6 by release line · >= 3.0.0, < 4.14.6; >= 4.15.0, < 4.18.2; >= 4.19.0, < 4.20.0 · CVE-2026-40453 · GHSA-jg2m-9x48-3gvj
27 Apr 2026Evidence →
Critical, CVSS 9.827 Apr 2026
Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage
Maven org.apache.camel:camel-jms +5 · Upgrade all 6 to 4.20.0, 4.18.2 or 4.14.7 by release line · >= 3.0.0, < 4.14.7; >= 4.15.0, < 4.18.2; >= 4.19.0, < 4.20.0 · CVE-2026-40860 · GHSA-m5vh-3fw5-5wgh
27 Apr 2026Evidence →
Critical, CVSS 9.827 Apr 2026
Apache MINA vulnerable to Deserialization of Untrusted Data
Maven org.apache.mina:mina-core · Upgrade to 2.2.6, 2.1.11 or 2.0.28 by release line · >= 2.0.0, < 2.0.28; >= 2.1.0, < 2.1.11; >= 2.2.0, < 2.2.6 · CVE-2026-41635 · GHSA-8297-v2rf-2p32
27 Apr 2026Evidence →
High, CVSS 8.827 Apr 2026
Camel-MINA Vulnerable to Deserialization of Untrusted Data
Maven org.apache.camel:camel-mina · Upgrade to 4.20.0, 4.18.2 or 4.14.6 by release line · >= 3.0.0, < 4.14.6; >= 4.15.0, < 4.18.2; >= 4.19.0, < 4.20.0 · CVE-2026-40473 · GHSA-vpr3-2659-rw55
27 Apr 2026Evidence →
High, CVSS 7.827 Apr 2026
Camel-PQC Vulnerable to Deserialization of Untrusted Data
Maven org.apache.camel:camel-pqc · Upgrade to 4.20.0 or 4.18.2 by release line · < 4.18.2; >= 4.19.0, < 4.20.0 · CVE-2026-40048 · GHSA-v3vg-332r-mw99 · amended
27 Apr 2026Evidence →
High, CVSS 8.525 Apr 2026
OpenClaw: Workspace dotenv could override runtime-control environment variables
npm openclaw · Upgrade to 2026.4.20 or later · < 2026.4.20 · CVE-2026-44114 · GHSA-hxvm-xjvf-93f3 · amended
25 Apr 2026Evidence →
High, CVSS 8.825 Apr 2026
GitPython has Command Injection via Git options bypass
PyPI gitpython · Upgrade to 3.1.47 or later · >= 3.1.30, < 3.1.47 · CVE-2026-42215 · GHSA-rpm5-65cw-6hj4 · amended
25 Apr 2026Evidence →
High, CVSS 8.125 Apr 2026
GitPython: Unsafe option check validates multi_options before shlex.split transformation
PyPI gitpython · Upgrade to 3.1.47 or later · < 3.1.47 · CVE-2026-42284 · GHSA-x2qx-6953-8485 · amended
25 Apr 2026Evidence →
Critical, CVSS 9.425 Apr 2026
Note Mark: OIDC-registered users authenticated by submitting password "null"
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260417132909-dea5530cc989 (pre-release) or later · < 0.0.0-20260417132909-dea5530cc989 · CVE-2026-41571 · GHSA-pxf8-6wqm-r6hh
25 Apr 2026Evidence →
High, CVSS 7.925 Apr 2026
Cillium exposes sensitive information included in the cilium-bugtool debug archive
Go github.com/cilium/cilium · Upgrade to 1.19.3, 1.18.9 or 1.17.15 by release line · < 1.17.15; >= 1.18.0, < 1.18.9; >= 1.19.0, < 1.19.3 · CVE-2026-41520 · GHSA-gj49-89wh-h4gj
25 Apr 2026Evidence →
High, CVSS 7.825 Apr 2026
Heimdall has an authorization bypass via path normalization mismatch
Go github.com/dadrus/heimdall · Upgrade to 0.17.14 or later · < 0.17.14 · CVE-2026-42274 · GHSA-3q34-rx83-r6mq
25 Apr 2026Evidence →
High, CVSS 7.825 Apr 2026
Heimdall: Case-sensitive host matching may lead to policy bypass
Go github.com/dadrus/heimdall · Upgrade to 0.17.14 or later · < 0.17.14 · CVE-2026-42273 · GHSA-72h4-mxfc-jx37
25 Apr 2026Evidence →
High, CVSS 7.825 Apr 2026
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
Go github.com/dadrus/heimdall · Upgrade to 0.17.14 or later · < 0.17.14 · CVE-2026-42272 · GHSA-43jv-5j4x-qv67
25 Apr 2026Evidence →
High, CVSS 8.7Exploited · CISA KEV25 Apr 2026
LiteLLM: Authenticated command execution via MCP stdio test endpoints
PyPI litellm · Upgrade to 1.83.7 or later · >= 1.74.2, < 1.83.7 · CVE-2026-42271 · GHSA-v4p8-mg3p-g94g · amended
25 Apr 2026Evidence →
High, CVSS 8.225 Apr 2026
simple-git is vulnerable to Remote Code Execution
npm simple-git · Upgrade to 3.36.0 or later · < 3.36.0 · CVE-2026-6951 · GHSA-hffm-xvc3-vprc · amended
25 Apr 2026Evidence →
Critical, CVSS 9.824 Apr 2026
electerm has Command Injection via runLinux funtion
npm electerm · Upgrade to 3.3.8 or later · < 3.3.8 · CVE-2026-41501 · GHSA-8x35-hph8-37hq · amended
24 Apr 2026Evidence →
High, CVSS 7.724 Apr 2026
Kyverno Controller Denial of Service via forEach Mutation Panic
Go github.com/kyverno/kyverno · Upgrade to 1.17.2 or 1.16.4 by release line · >= 1.13.0, < 1.16.4; >= 1.17.0-rc.1, < 1.17.2 · CVE-2026-41485 · GHSA-fpjq-c37h-cqcv
24 Apr 2026Evidence →
High, CVSS 7.124 Apr 2026
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
Packagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · < 4.9.0; >= 5.0.0, < 5.4.0 · CVE-2026-41325 · GHSA-6gqr-mx34-wh8r
24 Apr 2026Evidence →
Critical, CVSS 10.024 Apr 2026
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
GitHub Actions google-github-actions/run-gemini-cli · Upgrade to 0.1.22 or later · < 0.1.22 · +1 more package · CVE-2026-12537 · GHSA-wpqr-6v78-jr5g · amended
24 Apr 2026Evidence →
High, CVSS 7.324 Apr 2026
TYPO3 CMS Stores Cleartext Password in User Settings Module
Packagist typo3/cms-backend · Upgrade to 14.3.0 or later · >= 14.2.0, <= 14.2.0 · CVE-2026-6553 · GHSA-xvv6-p4wf-mvx7
24 Apr 2026Evidence →
High, CVSS 8.724 Apr 2026
k8sGPT has Prompt Injection through its k8sGPT-Operator
Go github.com/k8sgpt-ai/k8sgpt · Upgrade to 0.4.32 or later · < 0.4.32 · GHSA-rp7v-4384-hfrp
24 Apr 2026Evidence →
High, CVSS 7.724 Apr 2026
Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution
npm @anthropic-ai/claude-code · Upgrade to 2.1.84 or later · >= 2.1.63, < 2.1.84 · CVE-2026-40068 · GHSA-q5hj-mxqh-vv77 · amended
24 Apr 2026Evidence →
Critical, CVSS 9.824 Apr 2026
go-zserio has Unbounded Memory Allocation for All Platforms
Go github.com/woven-planet/go-zserio · Upgrade to 0.9.1 or later · < 0.9.1 · GHSA-xhj4-g6w8-2xjw
24 Apr 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence