Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 951 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

4051–4075 of 30,927 matching · newest first

ExploitedClear filters

Medium, CVSS 5.46 Jul 2026
Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55437 · GHSA-7qw2-f75v-62f7
6 Jul 2026Evidence →
High, CVSS 7.46 Jul 2026
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8 or 2.32.7 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7 · CVE-2026-55436 · GHSA-84rm-42xw-mx52
6 Jul 2026Evidence →
Medium, CVSS 5.46 Jul 2026
Suspended Coder users retain access to AI Bridge LLM proxy endpoints
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8 or 2.32.7 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7 · CVE-2026-55435 · GHSA-wqxv-w64v-5wh6
6 Jul 2026Evidence →
Medium, CVSS 6.56 Jul 2026
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
Go github.com/coder/coder/v2 · Upgrade to 2.34.2 or 2.33.8 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8 · CVE-2026-55434 · GHSA-f5vp-w269-392g
6 Jul 2026Evidence →
Medium, CVSS 5.46 Jul 2026
Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55433 · GHSA-jqj2-x4c5-jfxm
6 Jul 2026Evidence →
Medium, CVSS 5.46 Jul 2026
Coder's sub-agent app registration bypasses template port-sharing policy enforcement
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55432 · GHSA-x9qq-2qh5-8rxf
6 Jul 2026Evidence →
High, CVSS 7.76 Jul 2026
Coder's session token leaked to arbitrary hosts via coder open app for external workspace apps
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55431 · GHSA-v54h-cp2w-9x4g
6 Jul 2026Evidence →
Medium, CVSS 6.56 Jul 2026
Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; >= 2.17.0, < 2.29.17 · CVE-2026-55078 · GHSA-2mg2-p7r7-g27f
6 Jul 2026Evidence →
Medium, CVSS 5.86 Jul 2026
Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55430 · GHSA-5g4w-3vw9-478w
6 Jul 2026Evidence →
High, CVSS 8.26 Jul 2026
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55428 · GHSA-wrq8-fcv5-8hvp
6 Jul 2026Evidence →
High, CVSS 8.76 Jul 2026
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55429 · GHSA-9rjw-3gwp-f59v
6 Jul 2026Evidence →
Medium, CVSS 4.96 Jul 2026
Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; >= 2.24.0, < 2.29.17 · CVE-2026-55079 · GHSA-f962-qm93-mj4c
6 Jul 2026Evidence →
High, CVSS 8.36 Jul 2026
Coder vulnerable to SSH config injection via unsanitized server-supplied values in coder config-ssh
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55427 · GHSA-mcqq-fqgf-rxwm
6 Jul 2026Evidence →
High, CVSS 7.26 Jul 2026
Coder: User-admin role can reset owner account password
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55077 · GHSA-29xf-69gq-m9jx
6 Jul 2026Evidence →
High, CVSS 7.46 Jul 2026
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55075 · GHSA-9r87-mvcw-x35f
6 Jul 2026Evidence →
High, CVSS 7.46 Jul 2026
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Go github.com/coder/coder/v2 · Upgrade to 2.34.2, 2.33.8, 2.32.7 or 2.29.17 by release line · >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 · CVE-2026-55076 · GHSA-75vm-6w67-gwvp
6 Jul 2026Evidence →
High, CVSS 7.66 Jul 2026
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Maven io.openremote:openremote-agent · Upgrade to 1.24.2 or later · <= 1.24.1 · CVE-2026-54640 · GHSA-7v6w-c3f4-9wpq
6 Jul 2026Evidence →
High, CVSS 7.76 Jul 2026
OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
Maven io.openremote:openremote-manager · Upgrade to 1.24.2 or later · < 1.24.2 · CVE-2026-54641 · GHSA-xqr9-4wvv-gvch
6 Jul 2026Evidence →
Medium, CVSS 6.96 Jul 2026
CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
Go github.com/cilium/cilium · Upgrade to 1.19.4, 1.18.10 or 1.17.16 by release line · >= 1.19.0, < 1.19.4; >= 1.18.2, < 1.18.10; < 1.17.16 · CVE-2026-53935 · GHSA-q6h5-q3q6-f87x
6 Jul 2026Evidence →
Medium, CVSS 4.86 Jul 2026
GoFiber never set HSTS header in helmet middleware due to incorrect protocol check
Go github.com/gofiber/fiber · Upgrade to 3.4.0 or later · <= 3.3.0 · CVE-2026-53624 · GHSA-gv83-gqw6-9j2c
6 Jul 2026Evidence →
High, CVSS 8.16 Jul 2026
Langroid: handle_message() executes user-supplied tool JSON without sender verification
PyPI langroid · Upgrade to 0.65.3 or later · <= 0.65.2 · CVE-2026-54771 · GHSA-gjgq-w2m6-wr5q · amended
6 Jul 2026Evidence →
Critical, CVSS 10.06 Jul 2026
Langroid: Sandbox Escape to Remote Code Execution via Incomplete eval() Mitigation in TableChatAgent
PyPI langroid · Upgrade to 0.65.2 or later · <= 0.65.1 · CVE-2026-54769 · GHSA-q9p7-wqxg-mrhc · amended
6 Jul 2026Evidence →
Critical, CVSS 9.36 Jul 2026
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
PyPI langroid · Upgrade to 0.65.1 or later · <= 0.65.0 · CVE-2026-54760 · GHSA-6xc5-4r68-67fc · amended
6 Jul 2026Evidence →
Medium, CVSS 5.56 Jul 2026
Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
Go d7y.io/dragonfly/v2 · Upgrade to 2.4.4-rc.3 (pre-release) or later · <= 2.4.4-rc.2 · CVE-2026-54637 · GHSA-chwm-m7g7-685g
6 Jul 2026Evidence →
Low, CVSS 2.06 Jul 2026
Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases
PyPI linuxfabrik-lib · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-53759 · GHSA-r35r-fpx2-jgr4 · amended
6 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder: User-admin role can reset owner account password

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

Langroid: handle_message() executes user-supplied tool JSON without sender verification

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence