Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3776–3800 of 14,168 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 7.514 Apr 2026
Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
NuGet system.security.cryptography.xml · Upgrade to 10.0.6, 9.0.15 or 8.0.3 by release line · >= 10.0.0, <= 10.0.5; >= 9.0.0, <= 9.0.14; >= 8.0.0, <= 8.0.2 · CVE-2026-33116 · GHSA-37gx-xxp4-5rgx
14 Apr 2026Evidence →
High, CVSS 8.014 Apr 2026
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40944 · GHSA-7jrq-q4pq-rhm6
14 Apr 2026Evidence →
High, CVSS 8.714 Apr 2026
Oxia affected by server crash via race condition in session heartbeat handling
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40943 · GHSA-5gqc-qhrj-9xw8
14 Apr 2026Evidence →
Critical, CVSS 9.314 Apr 2026
Oxia has an OIDC token audience validation bypass via SkipClientIDCheck
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40946 · GHSA-fhvp-9hcj-6m33
14 Apr 2026Evidence →
High, CVSS 8.714 Apr 2026
Oxia exposes bearer token in debug log messages on authentication failure
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40945 · GHSA-pm7q-rjjx-979p
14 Apr 2026Evidence →
High, CVSS 7.514 Apr 2026
Go Markdown has an Out-of-bounds Read in SmartypantsRenderer
Go github.com/gomarkdown/markdown · Upgrade to 0.0.0-20260411013819-759bbc3e3207 (pre-release) or later · < 0.0.0-20260411013819-759bbc3e3207 · CVE-2026-40890 · GHSA-77fj-vx54-gvh7
14 Apr 2026Evidence →
Critical, CVSS 9.114 Apr 2026
@vendure/core has a SQL Injection vulnerability
npm @vendure/core · Upgrade to 3.6.2, 3.5.7 or 2.3.4 by release line · >= 3.0.0, < 3.5.7; >= 3.6.0, < 3.6.2; >= 1.7.4, < 2.3.4 · CVE-2026-40887 · GHSA-9pp3-53p2-ww9v · amended
14 Apr 2026Evidence →
High, CVSS 8.514 Apr 2026
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
Go github.com/kyverno/kyverno · Upgrade to 1.17.0 or later · >= 1.16.0, < 1.17.0 · CVE-2026-4789 · GHSA-rggm-jjmc-3394
14 Apr 2026Evidence →
High, CVSS 7.114 Apr 2026
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
Go github.com/zarf-dev/zarf · Upgrade to 0.74.2 or later · >= 0.23.0, < 0.74.2 · CVE-2026-40090 · GHSA-pj97-4p9w-gx3q
14 Apr 2026Evidence →
High, CVSS 7.214 Apr 2026
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
Packagist s9y/serendipity · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2026-39971 · GHSA-458g-q4fh-mj6r
14 Apr 2026Evidence →
High, CVSS 8.314 Apr 2026
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
npm mcp-server-kubernetes · Upgrade to 3.5.0 or later · <= 3.4.0 · CVE-2026-39884 · GHSA-4xqg-gf5c-ghwq · amended
14 Apr 2026Evidence →
Critical, CVSS 9.914 Apr 2026
Expression Injection in OpenRemote
Maven io.openremote:openremote-manager · Upgrade to 1.22.0 or later · <= 1.21.0 · CVE-2026-39842 · GHSA-7mqr-33rv-p3mp
14 Apr 2026Evidence →
High, CVSS 7.714 Apr 2026
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
Go github.com/patrickhener/goshs/v2 · Upgrade to 2.0.0-beta.6 (pre-release) or later · >= 2.0.0-beta.4, <= 2.0.0-beta.5 · CVE-2026-40885 · GHSA-7h3j-592v-jcrp
14 Apr 2026Evidence →
High, CVSS 7.514 Apr 2026
Decidim amendments can be accepted or rejected by anyone
RubyGems decidim-core · Upgrade to 0.31.1 or 0.30.5 by release line · >= 0.31.0.rc1, < 0.31.1; >= 0.19.0, < 0.30.5 · CVE-2026-40869 · GHSA-w5xj-99cg-rccm
14 Apr 2026Evidence →
High, CVSS 7.714 Apr 2026
OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean
PyPI keystone · Upgrade to 28.0.1 or later · < 28.0.1 · CVE-2026-40683 · GHSA-pfx2-9x9m-7ghx · amended
14 Apr 2026Evidence →
High, CVSS 8.114 Apr 2026
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
Go github.com/kyverno/kyverno · Upgrade to 1.17.0 or later · < 1.17.0 · CVE-2026-40868 · GHSA-q93q-v844-jrqp
14 Apr 2026Evidence →
High, CVSS 7.714 Apr 2026
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach
Go github.com/kyverno/kyverno · Upgrade to 1.16.2 or later · < 1.16.2 · GHSA-fmqp-4wfc-w3v7
14 Apr 2026Evidence →
High, CVSS 7.814 Apr 2026
Composer has a command injection via malicious perforce repository
Packagist composer/composer · Upgrade to 2.9.6 or 2.2.27 by release line · >= 2.3.0, < 2.9.6; >= 1.0.0, < 2.2.27 · CVE-2026-40176 · GHSA-wg36-wvj6-r67p · amended
14 Apr 2026Evidence →
High, CVSS 8.814 Apr 2026
Composer has a command injection via malicious perforce reference
Packagist composer/composer · Upgrade to 2.9.6 or 2.2.27 by release line · >= 2.3.0, < 2.9.6; >= 1.0.0, < 2.2.27 · CVE-2026-40261 · GHSA-gqw4-4w2p-838q
14 Apr 2026Evidence →
High, CVSS 7.514 Apr 2026
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
npm @nestjs/microservices · Upgrade to 11.1.19 or later · <= 11.1.18 · CVE-2026-40879 · GHSA-hpwf-8g29-85qm · amended
14 Apr 2026Evidence →
High, CVSS 7.514 Apr 2026
ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · CVE-2026-33901 · GHSA-x9h5-r9v2-vcww
14 Apr 2026Evidence →
High, CVSS 8.714 Apr 2026
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
Packagist craftcms/commerce · Upgrade to 5.5.5 or 4.10.3 by release line · >= 4.0.0, <= 4.10.2; >= 5.0.0, <= 5.5.4 · CVE-2026-32271 · GHSA-875v-7m49-8x88
14 Apr 2026Evidence →
High, CVSS 8.714 Apr 2026
Craft Commerce hasVariant/hasProduct Blind SQL Injection
Packagist craftcms/commerce · Upgrade to 5.6.0 or later · >= 5.0.0, < 5.6.0 · CVE-2026-32272 · GHSA-r54v-qq87-px5r
14 Apr 2026Evidence →
High, CVSS 7.514 Apr 2026
ImageMagick has a Stack Overflow in DestroyXMLTree()
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.12.0 or later · < 14.12.0 · CVE-2026-33908 · GHSA-fwvm-ggf6-2p4x
14 Apr 2026Evidence →
High, CVSS 7.414 Apr 2026
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Maven org.eclipse.jetty.ee9:jetty-ee9-jaspi · Upgrade to 12.1.8 or 12.0.34 by release line · >= 12.1.0, <= 12.1.7; >= 12.0.0, <= 12.0.33 · +4 more packages · CVE-2026-5795 · GHSA-r7p8-xq5m-436c
14 Apr 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence