Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 948 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3851–3875 of 30,924 matching · newest first

ExploitedClear filters

High, CVSS 8.014 Jul 2026
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
Packagist facturascripts/facturascripts · Upgrade to 2026.2 or later · < 2026.2 · CVE-2026-45263 · GHSA-2p5x-4jr6-x5jg · amended
14 Jul 2026Evidence →
Critical, CVSS 9.914 Jul 2026
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in Where::sqlColumn
Packagist facturascripts/facturascripts · Upgrade to 2026.2 or later · < 2026.2 · CVE-2026-45262 · GHSA-5qmh-x653-g8qj · amended
14 Jul 2026Evidence →
High, CVSS 8.814 Jul 2026
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
Go github.com/opencost/opencost · Upgrade to 1.119.1 or later · < 1.119.1 · CVE-2026-44300 · GHSA-wmj8-9953-vff5
14 Jul 2026Evidence →
High, CVSS 8.314 Jul 2026
Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities
PyPI snowflake-sqlalchemy · Upgrade to 1.11.0 or later · >= 1.1.6, < 1.11.0 · CVE-2026-15736 · GHSA-8g6f-qw9x-4q6q · amended
14 Jul 2026Evidence →
Low, CVSS 3.114 Jul 2026
Keras: tar extraction permits symlink-based path traversal
PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-12482 · GHSA-58hv-7753-xmfq · amended
14 Jul 2026Evidence →
Critical, CVSS 9.114 Jul 2026
SAP Approuter Vulnerable to HTTP Request Smuggling
npm @sap/approuter · Upgrade to 20.10.0 or later · < 20.10.0 · CVE-2026-27690 · GHSA-8m85-wqg7-c529 · amended
14 Jul 2026Evidence →
High, CVSS 8.114 Jul 2026
SAP Approuter has an Open Redirect vulnerability
npm @sap/approuter · Upgrade to 21.2.0 or later · < 21.2.0 · CVE-2026-44745 · GHSA-44p5-3m5g-vfhj · amended
14 Jul 2026Evidence →
Medium, CVSS 5.314 Jul 2026
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-52828 · GHSA-rw46-qg69-vg6h
14 Jul 2026Evidence →
High, CVSS 7.114 Jul 2026
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP
Packagist kimai/kimai · Upgrade to 2.59.0 or later · < 2.59.0 · CVE-2026-52827 · GHSA-v8hx-4vx8-wc96
14 Jul 2026Evidence →
High, CVSS 8.314 Jul 2026
crewai-tools SSRF redirect bypass exposes internal services
PyPI crewai-tools · Upgrade to 1.15.1 or later · < 1.15.1 · CVE-2026-62240 · GHSA-mr4r-hcgx-8p4h · amended
14 Jul 2026Evidence →
Medium, CVSS 5.314 Jul 2026
Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
Packagist kimai/kimai · Upgrade to 2.57.0 or later · <= 2.56.0 · CVE-2026-52826 · GHSA-2xgg-2x8h-8xw4
14 Jul 2026Evidence →
Medium, CVSS 5.314 Jul 2026
Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-52825 · GHSA-xv4r-4885-gwpg
14 Jul 2026Evidence →
Critical, CVSS 9.114 Jul 2026
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-52824 · GHSA-jr9p-4h4j-6c58
14 Jul 2026Evidence →
Medium, CVSS 5.314 Jul 2026
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-52823 · GHSA-r8vr-m544-qh4h
14 Jul 2026Evidence →
Medium, CVSS 5.314 Jul 2026
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-52822 · GHSA-c6w6-57jj-62vh
14 Jul 2026Evidence →
Medium, CVSS 5.314 Jul 2026
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
Packagist kimai/kimai · Upgrade to 2.57.0 or later · <= 2.56.0 · CVE-2026-52821 · GHSA-3q6q-26vg-v97x
14 Jul 2026Evidence →
Medium, CVSS 5.313 Jul 2026
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
Packagist kimai/kimai · Upgrade to 2.57.0 or later · <= 2.56.0 · CVE-2026-52820 · GHSA-vrr2-g9gh-c3jc
13 Jul 2026Evidence →
Medium, CVSS 6.313 Jul 2026
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
Packagist kimai/kimai · Upgrade to 2.57.0 or later · <= 2.56.0 · CVE-2026-52819 · GHSA-4m8q-55qv-9pwp
13 Jul 2026Evidence →
Medium, CVSS 6.313 Jul 2026
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
Packagist kimai/kimai · Upgrade to 2.58.0 or later · <= 2.57.0 · CVE-2026-49992 · GHSA-pgcc-vfmc-7cw5
13 Jul 2026Evidence →
Medium, CVSS 6.913 Jul 2026
Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks
PyPI app-store-server-library · Upgrade to 3.1.2 or later · >= 0.2.0, <= 3.1.1 · GHSA-8f6j-263m-g72x · amended
13 Jul 2026Evidence →
High, CVSS 7.513 Jul 2026
json_repair: Circular JSON Schema $ref causes unbounded CPU DoS
PyPI json-repair · Upgrade to 0.60.1 or later · < 0.60.1 · GHSA-xf7x-x43h-rpqh · amended
13 Jul 2026Evidence →
Critical, CVSS 9.313 Jul 2026
FacturaScripts: Account takeover of any 2FA-enabled user
Packagist facturascripts/facturascripts · Upgrade to 2026.3 or later · <= 2026.2 · CVE-2026-47677 · GHSA-c67f-gmxw-mj93
13 Jul 2026Evidence →
High, CVSS 8.713 Jul 2026
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
Packagist plank/laravel-mediable · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-49970 · GHSA-xv8g-76mx-2rxc
13 Jul 2026Evidence →
High, CVSS 8.513 Jul 2026
DIRAC: SQL injection and lack of access control in PilotManager service
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · GHSA-7xw9-549r-8jrc · amended
13 Jul 2026Evidence →
High, CVSS 8.113 Jul 2026
DIRAC: Pilot code downloaded over unverified HTTPS connection
PyPI dirac · Upgrade to 9.1.10, 9.0.22 or 8.0.79 by release line · >= 6.20.1, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10 · CVE-2026-61668 · GHSA-vg99-gr89-qhw9 · amended
13 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

Keras: tar extraction permits symlink-based path traversal

SAP Approuter Vulnerable to HTTP Request Smuggling

SAP Approuter has an Open Redirect vulnerability

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP

crewai-tools SSRF redirect bypass exposes internal services

Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

FacturaScripts: Account takeover of any 2FA-enabled user

Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()

DIRAC: SQL injection and lack of access control in PilotManager service

DIRAC: Pilot code downloaded over unverified HTTPS connection

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence