Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3626–3650 of 14,168 Critical + High advisories · newest first

Show all severities

Exploited

Critical, CVSS 9.822 Apr 2026
NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access
Go github.com/orneryd/nornicdb · Upgrade to 1.0.42-hotfix (pre-release) or later · < 1.0.42-hotfix · CVE-2026-42072 · GHSA-2hp7-65r3-wv54
22 Apr 2026Evidence →
High, CVSS 7.222 Apr 2026
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.9.27, < 0.10.78 · CVE-2026-41676 · GHSA-pqf5-4pqq-29f5 · amended
22 Apr 2026Evidence →
High, CVSS 7.222 Apr 2026
rust-openssl has incorrect bounds assertion in aes key wrap
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.10.24, < 0.10.78 · CVE-2026-41678 · GHSA-8c75-8mhr-p7r9 · amended
22 Apr 2026Evidence →
High, CVSS 8.122 Apr 2026
rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.10.39, < 0.10.78 · CVE-2026-41681 · GHSA-ghm9-cr32-g9qj · amended
22 Apr 2026Evidence →
High, CVSS 8.322 Apr 2026
rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.9.24, < 0.10.78 · CVE-2026-41898 · GHSA-hppc-g8h3-xhp3 · amended
22 Apr 2026Evidence →
High, CVSS 7.122 Apr 2026
SiYuan: Path Traversal via Double URL Encoding in /export/ Endpoint (Incomplete Fix Bypass for CVE-2026-30869)
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.5 or later · < 3.6.5 · CVE-2026-41894 · GHSA-hjh7-r5w8-5872 · amended
22 Apr 2026Evidence →
High, CVSS 7.222 Apr 2026
MCPHub has Path Traversal via Malicious MCPB Manifest Name
npm @samanhappy/mcphub · Upgrade to 0.12.13 or later · < 0.12.13 · CVE-2026-79743 · GHSA-p3h2-2j4p-p83g · amended
22 Apr 2026Evidence →
High, CVSS 7.522 Apr 2026
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
npm locize · Upgrade to 4.0.21 or later · < 4.0.21 · CVE-2026-41886 · GHSA-w937-fg2h-xhq2 · amended
22 Apr 2026Evidence →
High, CVSS 8.622 Apr 2026
i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header
npm i18next-http-middleware · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-41683 · GHSA-c3h8-g69v-pjrg · amended
22 Apr 2026Evidence →
High, CVSS 7.522 Apr 2026
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
npm @nocobase/database · Upgrade to 2.0.39 or later · < 2.0.39 · CVE-2026-41640 · GHSA-4948-f92q-f432 · amended
22 Apr 2026Evidence →
High, CVSS 7.222 Apr 2026
@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing checkSQL Call
npm @nocobase/plugin-collection-sql · Upgrade to 2.0.39 or later · < 2.0.39 · CVE-2026-41641 · GHSA-wrwh-c28m-9jjh · amended
22 Apr 2026Evidence →
High, CVSS 8.322 Apr 2026
monetr: Server-side request forgery in Lunch Flow link creation and refresh
Go github.com/monetr/monetr · Upgrade to 1.12.5 or later · < 1.12.5 · CVE-2026-41644 · GHSA-29v9-frvh-c426
22 Apr 2026Evidence →
High, CVSS 7.522 Apr 2026
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
Go github.com/free5gc/pcf · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-41135 · GHSA-98cp-84m9-q3qp
22 Apr 2026Evidence →
Critical, CVSS 9.622 Apr 2026
nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
crates.io nimiq-block · Upgrade to 1.7.2 or later · < 1.7.2 · CVE-2026-33471 · GHSA-6973-8887-87ff · amended
22 Apr 2026Evidence →
High, CVSS 8.222 Apr 2026
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
npm i18next-fs-backend · Upgrade to 2.6.4 or later · < 2.6.4 · CVE-2026-41693 · GHSA-8847-338w-5hcj · amended
22 Apr 2026Evidence →
High, CVSS 8.622 Apr 2026
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
npm i18next-http-middleware · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-41690 · GHSA-5fgg-jcpf-8jjw · amended
22 Apr 2026Evidence →
High, CVSS 8.322 Apr 2026
Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API
Go github.com/daptin/daptin · Upgrade to 0.11.4 or later · < 0.11.4 · CVE-2026-41422 · GHSA-rw2c-8rfq-gwfv
22 Apr 2026Evidence →
Critical, CVSS 9.422 Apr 2026
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.5.0 or later · < 0.31.5.0 · CVE-2026-41203 · GHSA-xv3r-vr59-95rg
22 Apr 2026Evidence →
Critical, CVSS 9.422 Apr 2026
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.5.0 or later · < 0.31.5.0 · CVE-2026-41202 · GHSA-xp9f-pvvc-57p4
22 Apr 2026Evidence →
High, CVSS 7.522 Apr 2026
camel-infinispan Vulnerable to Deserialization of Untrusted Data
Maven org.apache.camel:camel-infinispan · Upgrade to 4.20.0 or later · < 4.20.0 · CVE-2026-6857 · GHSA-xfxp-ppx7-cqrp
22 Apr 2026Evidence →
High, CVSS 7.822 Apr 2026
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Packagist phpunit/phpunit · Upgrade to 13.1.6 or 12.5.22 by release line · >= 12.5.21, < 12.5.22; >= 13.1.5, < 13.1.6 · GHSA-mh6w-vxff-9wqp
22 Apr 2026Evidence →
High, CVSS 8.622 Apr 2026
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
npm engramx · Upgrade to 2.0.2 or later · < 2.0.2 · GHSA-2r2p-4cgf-hv7h · amended
22 Apr 2026Evidence →
Critical, CVSS 9.222 Apr 2026
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Go github.com/rclone/rclone · Upgrade to 1.73.5 or later · >= 1.45.0, < 1.73.5 · CVE-2026-41176 · GHSA-25qr-6mpr-f7qx
22 Apr 2026Evidence →
High, CVSS 7.022 Apr 2026
OpenRemote has Improper Access Control via updateUserRealmRoles function
Maven io.openremote:openremote-manager · Upgrade to 1.22.1 or later · < 1.22.1 · CVE-2026-41166 · GHSA-49vv-25qx-mg44
22 Apr 2026Evidence →
High, CVSS 8.722 Apr 2026
@saltcorn/data: Tenant user role is used for tenant creation role check
npm @saltcorn/data · Upgrade to 1.6.0-beta.2 (pre-release), 1.5.2 or 1.4.4 by release line · < 1.4.4; >= 1.5.0-beta.0, < 1.5.2; >= 1.6.0-alpha.0, < 1.6.0-beta.2 · GHSA-9237-rg5p-rhfw · amended
22 Apr 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

rust-openssl has incorrect bounds assertion in aes key wrap

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)

MCPHub has Path Traversal via Malicious MCPB Manifest Name

locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header

@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading

@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call

monetr: Server-side request forgery in Lunch Flow link creation and refresh

free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service

nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite

i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters

Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API

CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE

CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE

camel-infinispan Vulnerable to Deserialization of Untrusted Data

PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes

engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

OpenRemote has Improper Access Control via updateUserRealmRoles function

@saltcorn/data: Tenant user role is used for tenant creation role check

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence