Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

376–400 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 4.128 Oct 2026
LangGraph CLI prints the registry push token in langgraph deploy --verbose output
PyPI langgraph-cli · Upgrade to 0.4.32 or later · >= 0.4.15, < 0.4.32 · CVE-2026-115885 · GHSA-8prr-f582-jqq3 · amended
28 Oct 2026Evidence →
High, CVSS 7.528 Oct 2026
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
npm graphql-scalars · Upgrade to 2.0.1 or later · >= 1.24.1, < 2.0.1 · CVE-2026-115887 · GHSA-x8rm-f576-gq67 · amended
28 Oct 2026Evidence →
Medium, CVSS 5.928 Oct 2026
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
PyPI autobahn · Upgrade to 26.10.1 or later · >= 26.7.1, < 26.10.1 · CVE-2026-116579 · GHSA-pjh6-c8mg-3x7m · amended
28 Oct 2026Evidence →
Low, CVSS 3.728 Oct 2026
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
npm i18next-http-backend · Upgrade to 4.0.4 or later · < 4.0.4 · CVE-2026-118258 · GHSA-3cmx-xjww-583x · amended
28 Oct 2026Evidence →
High, CVSS 7.528 Oct 2026
RE2JS: Quadratic-time denial of service in re2js lookbehind matching
npm re2js · Upgrade to 2.8.7 or later · >= 2.2.0, < 2.8.7 · CVE-2026-116795 · GHSA-gg6h-894w-4m9c · amended
28 Oct 2026Evidence →
Critical, CVSS 9.428 Oct 2026
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
crates.io zip · Upgrade to 9.0.5 or later · < 9.0.5 · CVE-2026-115905 · GHSA-m665-v7pm-7grj · amended
28 Oct 2026Evidence →
High, CVSS 8.628 Oct 2026
LangGraph JavaScript custom authentication may permit cross-user Store access
PyPI langgraph-api · Upgrade to 0.15.0 or later · >= 0.1.2, < 0.15.0 · CVE-2026-118668 · GHSA-4hm6-w6qq-w73v · amended
28 Oct 2026Evidence →
Low, CVSS 3.328 Oct 2026
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
PyPI filelock · Upgrade to 4.2.1 or later · >= 4.1.0, < 4.2.1 · CVE-2026-112941 · GHSA-wfhq-q4j2-c37m · amended
28 Oct 2026Evidence →
Medium, CVSS 5.328 Oct 2026
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.30.0, < 4.2.1 · CVE-2026-112908 · GHSA-6627-m3xw-93mp · amended
28 Oct 2026Evidence →
Medium, CVSS 6.328 Oct 2026
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.30.0, < 4.2.1 · CVE-2026-112911 · GHSA-9c4x-gm8v-wgc4 · amended
28 Oct 2026Evidence →
Medium, CVSS 5.328 Oct 2026
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.10.0, < 4.2.1 · CVE-2026-112910 · GHSA-8mx5-7m5m-r77g · amended
28 Oct 2026Evidence →
Medium, CVSS 5.528 Oct 2026
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.20.4, < 4.2.1 · CVE-2026-112915 · GHSA-cwqr-hh33-gh44 · amended
28 Oct 2026Evidence →
Medium, CVSS 4.728 Oct 2026
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.22.0, < 4.2.1 · CVE-2026-112939 · GHSA-rfpc-qcw5-3pc4 · amended
28 Oct 2026Evidence →
Low, CVSS 2.528 Oct 2026
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.32.6, < 4.2.1 · CVE-2026-112912 · GHSA-9j6q-wvj5-jgjg · amended
28 Oct 2026Evidence →
Medium, CVSS 6.128 Oct 2026
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
PyPI filelock · Upgrade to 4.2.1 or later · < 4.2.1 · CVE-2026-112909 · GHSA-69hj-f68j-2879 · amended
28 Oct 2026Evidence →
Medium, CVSS 6.128 Oct 2026
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
PyPI filelock · Upgrade to 4.0.9 or later · >= 3.20.4, < 4.0.9 · CVE-2026-112936 · GHSA-j8f7-rjxc-mr56 · amended
28 Oct 2026Evidence →
Medium, CVSS 5.828 Oct 2026
filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.30.0, < 4.2.1 · CVE-2026-112938 · GHSA-m462-7rxw-wvpg · amended
28 Oct 2026Evidence →
Medium, CVSS 6.128 Oct 2026
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
PyPI filelock · Upgrade to 4.2.1 or later · >= 4.0.0, < 4.2.1 · CVE-2026-112934 · GHSA-fj95-fr6c-h845 · amended
28 Oct 2026Evidence →
Medium, CVSS 4.728 Oct 2026
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
PyPI filelock · Upgrade to 4.2.1 or later · >= 3.22.0, < 4.2.1 · CVE-2026-112935 · GHSA-fq56-3cx3-fjxp · amended
28 Oct 2026Evidence →
Low, CVSS 3.128 Oct 2026
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)
npm i18next-http-backend · Upgrade to 4.0.3 or later · < 4.0.3 · CVE-2026-115730 · GHSA-9jhj-wvmw-cfx5 · amended
28 Oct 2026Evidence →
Medium, CVSS 5.328 Oct 2026
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
Maven io.opentelemetry:opentelemetry-api · Upgrade to 1.67.0 or later · < 1.67.0 · CVE-2026-118259 · GHSA-ccrj-gw8r-854m · amended
28 Oct 2026Evidence →
High, CVSS 8.628 Oct 2026
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
npm happy-dom · Upgrade to 21.0.0 or later · < 21.0.0 · CVE-2026-118660 · GHSA-c8p4-j97h-3vg8 · amended
28 Oct 2026Evidence →
Low, CVSS 2.128 Oct 2026
Vue I18n: escapeParameter does not escape named values when the same call also passes a list
npm @intlify/vue-i18n-core +4 · Upgrade all 5 to 12.0.0-alpha.5 (pre-release) or 11.4.14 by release line · >= 9.2.0-alpha.7, < 11.4.14; >= 12.0.0-alpha.1, < 12.0.0-alpha.5 · CVE-2026-118256 · GHSA-8rc2-428q-7ww3 · amended
28 Oct 2026Evidence →
High, CVSS 7.228 Oct 2026
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
npm @intlify/shared +5 · Upgrade all 6 to 12.0.0-alpha.5 (pre-release) or 11.4.14 by release line; some affected versions have no fix yet · >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5 · CVE-2026-118257 · GHSA-83rm-6c8r-g728 · amended
28 Oct 2026Evidence →
Medium, CVSS 6.528 Oct 2026
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
npm happy-dom · Upgrade to 20.14.6 or later · < 20.14.6 · CVE-2026-118661 · GHSA-5fpq-26gf-qwcr · amended
28 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

LangGraph JavaScript custom authentication may permit cross-user Store access

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence