Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 948 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

3951–3975 of 30,924 matching · newest first

ExploitedClear filters

High, CVSS 8.09 Jul 2026
laravel-backup-restore has an OS Command Injection during database restore
Packagist wnx/laravel-backup-restore · Upgrade to 1.9.4 or later · <= 1.9.3 · CVE-2026-53932 · GHSA-w9mx-xmg4-gc4r
9 Jul 2026Evidence →
Medium, CVSS 4.99 Jul 2026
nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate
Go github.com/forgekeep/nebula-mesh · Upgrade to 0.3.7 or later · < 0.3.7 · CVE-2026-53602 · GHSA-339v-266x-79xr
9 Jul 2026Evidence →
High, CVSS 8.69 Jul 2026
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
Packagist craftcms/cms · Upgrade to 5.9.14 or later · >= 5.5.0, <= 5.9.13 · CVE-2026-56382 · GHSA-86vw-x4ww-x467
9 Jul 2026Evidence →
Low, CVSS 2.09 Jul 2026
Craft CMS has authenticated path traversal in assets/icon, allowing local .svg file read
Packagist craftcms/cms · Upgrade to 5.9.13 or 4.17.7 by release line · >= 4.0.0-RC1, <= 4.17.6; >= 5.0.0-RC1, <= 5.9.12 · CVE-2026-56394 · GHSA-c43v-4cr8-6mvp
9 Jul 2026Evidence →
High, CVSS 8.99 Jul 2026
Ruby CSS Parser: SSRF and Local File Disclosure in CssParser::Parser#read_remote_file
RubyGems css_parser · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2026-53727 · GHSA-9pmc-p236-855h
9 Jul 2026Evidence →
High, CVSS 7.59 Jul 2026
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +7 · Upgrade all 8 to 6.9.9 or 6.9.4.2 by release line · >= 6.9.5, < 6.9.9; < 6.9.4.2 · CVE-2026-49485 · GHSA-7cmj-v6x8-frvv
9 Jul 2026Evidence →
Medium, CVSS 5.19 Jul 2026
pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
PyPI pymonocypher · Upgrade to 4.0.2.8 or later · < 4.0.2.8 · CVE-2026-53720 · GHSA-8f95-v3jq-cj86 · amended
9 Jul 2026Evidence →
High, CVSS 8.69 Jul 2026
Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260601210719-67b7de04308a (pre-release) or later · < 0.0.0-20260601210719-67b7de04308a · CVE-2026-50553 · GHSA-rqrh-8wpv-x7hh
9 Jul 2026Evidence →
Medium, CVSS 5.39 Jul 2026
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books
Go github.com/enchant97/note-mark/backend · Upgrade to 0.0.0-20260601210758-9c9b72740f22 (pre-release) or later · < 0.0.0-20260601210758-9c9b72740f22 · CVE-2026-50554 · GHSA-588f-fvcv-xhvf
9 Jul 2026Evidence →
High, CVSS 7.59 Jul 2026
Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
PyPI soupsieve · Upgrade to 2.8.4 or later · <= 2.8.3 · CVE-2026-49477 · GHSA-836r-79rf-4m37 · amended
9 Jul 2026Evidence →
High, CVSS 7.59 Jul 2026
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
PyPI soupsieve · Upgrade to 2.8.4 or later · <= 2.8.3 · CVE-2026-49476 · GHSA-2wc2-fm75-p42x · amended
9 Jul 2026Evidence →
High, CVSS 7.79 Jul 2026
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
PyPI phantom-audio · Upgrade to 1.3.1 or later · <= 1.3.0 · GHSA-52vm-mxx8-f227 · amended
9 Jul 2026Evidence →
Medium, CVSS 6.89 Jul 2026
Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers
Maven io.micronaut:micronaut-http-client · Upgrade to 5.0.1, 4.10.24 or 3.10.6 by release line · >= 1.2.8, < 3.10.6; >= 4.0.0-M1, < 4.10.24; >= 5.0.0-M1, < 5.0.1 · GHSA-q6gh-6v2r-hjv3
9 Jul 2026Evidence →
High, CVSS 7.59 Jul 2026
Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
Maven io.micronaut:micronaut-http-client · Upgrade to 5.0.1, 4.10.24 or 3.10.7 by release line · < 3.10.7; >= 4.0.0-M1, < 4.10.24; >= 5.0.0-M1, < 5.0.1 · GHSA-387m-935m-c4vw
9 Jul 2026Evidence →
Medium, CVSS 6.58 Jul 2026
PYSEC-2026-3446
PyPI pycti · Upgrade to 7.260401.0 or later · < 7.260401.0 · CVE-2026-35211 · GHSA-qpp6-p693-rmm4
8 Jul 2026Evidence →
High, CVSS 7.18 Jul 2026
PYSEC-2026-3445
PyPI pycti · Upgrade to 7.260326.0 or later · < 7.260326.0 · CVE-2026-35210 · GHSA-36fr-4m54-94mj
8 Jul 2026Evidence →
High, CVSS 8.38 Jul 2026
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
PyPI serena-agent · Upgrade to 1.5.2 or later · < 1.5.2 · CVE-2026-49471 · GHSA-37h2-6p4f-mp3q · amended
8 Jul 2026Evidence →
High, CVSS 8.18 Jul 2026
NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
Maven nl.nl-portal:taak · Upgrade to 3.0.1 or later · >= 1.5.0, <= 3.0.0 · CVE-2026-49464 · GHSA-6h3c-r723-7fx3
8 Jul 2026Evidence →
Medium, CVSS 6.58 Jul 2026
NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries
Maven nl.nl-portal:besluiten +1 · Upgrade all 2 to 3.0.1 or later · >= 1.5.0, <= 3.0.0 · CVE-2026-49463 · GHSA-qpm9-h556-mwxm
8 Jul 2026Evidence →
Low, CVSS 3.18 Jul 2026
Waku has an Open Redirect via unstable_redirect Helper
npm waku · Upgrade to 1.0.0-beta.1 (pre-release) or later · <= 1.0.0-beta.0 · CVE-2026-49456 · GHSA-43fc-v873-qw85 · amended
8 Jul 2026Evidence →
Medium, CVSS 6.58 Jul 2026
Waku: Cross-Origin CSRF on RSC Server Action Dispatch
npm waku · Upgrade to 1.0.0-beta.1 (pre-release) or later · <= 1.0.0-beta.0 · CVE-2026-49455 · GHSA-75w3-gmqx-993q · amended
8 Jul 2026Evidence →
Critical, CVSS 9.68 Jul 2026
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
Go github.com/BishopFox/joro · Upgrade to 0.0.0-20260601151442-5c0ca35db828 (pre-release) or later · < 0.0.0-20260601151442-5c0ca35db828 · CVE-2026-53649 · GHSA-xqhv-chqm-fhcc
8 Jul 2026Evidence →
Medium, CVSS 6.38 Jul 2026
OneRingBuf has a Use After Free Vulnerability
crates.io oneringbuf · Upgrade to 0.8.0 or later · < 0.8.0 · GHSA-q95x-7g78-rccv
8 Jul 2026Evidence →
Medium, CVSS 5.58 Jul 2026
DSpace: Path Traversal is possible through LDN message generation
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3 or 8.4 by release line · >= 8.0-rc1, <= 8.3; >= 9.0-rc1, <= 9.2; >= 10.0-rc1, <= 10.0-rc1 · CVE-2026-49833 · GHSA-9qm4-rh6w-pq5x
8 Jul 2026Evidence →
Medium, CVSS 4.48 Jul 2026
DSpace: ORE resource URI does not validate scheme for non-web resources
Maven org.dspace:dspace-api · Upgrade to 10.0, 9.3, 8.4 or 7.6.7 by release line · <= 7.6.6; >= 8.0-rc1, <= 8.3; >= 9.0-rc1, <= 9.2; >= 10-rc1, <= 10-rc1 · CVE-2026-49830 · GHSA-c827-pw3m-67w7
8 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

laravel-backup-restore has an OS Command Injection during database restore

nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS

PYSEC-2026-3446

PYSEC-2026-3445

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

Waku has an Open Redirect via `unstable_redirect` Helper

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

OneRingBuf has a Use After Free Vulnerability

DSpace: Path Traversal is possible through LDN message generation

DSpace: ORE resource URI does not validate scheme for non-web resources

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence