Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 951 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

4076–4100 of 30,927 matching · newest first

ExploitedClear filters

Medium, CVSS 5.36 Jul 2026
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
Packagist craftcms/cms · Upgrade to 5.9.14 or 4.17.8 by release line · >= 4.0.0-RC1, <= 4.17.7; >= 5.0.0-RC1, <= 5.9.13 · CVE-2026-56384 · GHSA-x76w-8c62-48mg
6 Jul 2026Evidence →
Medium, CVSS 4.46 Jul 2026
printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)
crates.io uu_printenv · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35366 · GHSA-p7h3-7q52-72w8
6 Jul 2026Evidence →
Low, CVSS 3.66 Jul 2026
uucore: safe_traversal TOCTOU protection only enabled on Linux
crates.io uucore · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35362 · GHSA-w6xc-g9qj-vp32
6 Jul 2026Evidence →
Medium, CVSS 6.66 Jul 2026
mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)
crates.io uu_mv · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-35365 · GHSA-h444-6j9x-p8vh
6 Jul 2026Evidence →
Medium, CVSS 4.46 Jul 2026
cp: -R reads device nodes as streams, destroying device semantics
crates.io uu_cp · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-35358 · GHSA-8vrf-r662-2w2v
6 Jul 2026Evidence →
Medium, CVSS 5.66 Jul 2026
rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection
crates.io uu_rm · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35363 · GHSA-89p7-7cq3-hhr2
6 Jul 2026Evidence →
Medium, CVSS 4.46 Jul 2026
comm: FIFO/pipe inputs are drained before comparison (data loss / hang)
crates.io uu_comm · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35347 · GHSA-3wfc-mgpm-9rq6
6 Jul 2026Evidence →
Medium, CVSS 4.46 Jul 2026
id: groups= computed from real GID instead of effective GID
crates.io uu_id · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35370 · GHSA-47c7-qrm7-mqw7
6 Jul 2026Evidence →
Low, CVSS 3.36 Jul 2026
mkdir: -m exposes directory with umask perms before chmod (race window)
crates.io uu_mkdir · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35353 · GHSA-mj6p-44ch-cq69
6 Jul 2026Evidence →
Medium, CVSS 6.76 Jul 2026
rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)
crates.io uu_rm · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-35349 · GHSA-7cr3-h577-g38j
6 Jul 2026Evidence →
Low, CVSS 3.36 Jul 2026
id: pretty-print uses effective GID instead of effective UID for name lookup
crates.io uu_id · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35371 · GHSA-xv5w-cw7x-72gj
6 Jul 2026Evidence →
Medium, CVSS 5.56 Jul 2026
kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)
crates.io uu_kill · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35369 · GHSA-p6rv-2qpm-fwvg
6 Jul 2026Evidence →
Medium, CVSS 6.36 Jul 2026
install -D: symlink race in directory creation allows arbitrary file overwrite
crates.io uu_install · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-35356 · GHSA-gwm6-q8ch-hcfr
6 Jul 2026Evidence →
Low, CVSS 3.36 Jul 2026
cut: -s (only-delimited) ignored when delimiter is a newline
crates.io uu_cut · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2026-35343 · GHSA-wv33-5pxh-r7j7
6 Jul 2026Evidence →
Medium, CVSS 6.36 Jul 2026
install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite
crates.io uu_install · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35355 · GHSA-239g-2685-54x3
6 Jul 2026Evidence →
Low, CVSS 3.36 Jul 2026
ln: rejects non-UTF-8 source filenames in target-directory mode
crates.io uu_ln · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35373 · GHSA-jcjr-rh8q-7xqf
6 Jul 2026Evidence →
Low, CVSS 3.36 Jul 2026
comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output
crates.io uu_comm · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35346 · GHSA-6gcw-w7cp-94g9
6 Jul 2026Evidence →
Low, CVSS 3.36 Jul 2026
mktemp: empty TMPDIR creates temp files in CWD instead of /tmp
crates.io uu_mktemp · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35342 · GHSA-2w8r-9xj7-69j5
6 Jul 2026Evidence →
Medium, CVSS 5.56 Jul 2026
chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)
crates.io uu_chmod · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35339 · GHSA-4x34-chg5-mwjj
6 Jul 2026Evidence →
High, CVSS 7.36 Jul 2026
chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
crates.io uu_chmod · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2026-35338 · GHSA-4c7q-4928-8445
6 Jul 2026Evidence →
High, CVSS 8.46 Jul 2026
flyto-core has Unauthenticated Command Execution via HTTP MCP execute_module
PyPI flyto-core · Upgrade to 2.26.4 or later · >= 2.26.2, < 2.26.4 · CVE-2026-55786 · GHSA-h9f9-h6gm-wc85 · amended
6 Jul 2026Evidence →
High, CVSS 7.16 Jul 2026
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
PyPI flyto-core · Upgrade to 2.26.3 or later · <= 2.26.2 · CVE-2026-55787 · GHSA-794r-5rp2-fpg8 · amended
6 Jul 2026Evidence →
High, CVSS 7.76 Jul 2026
Scriban: Template Writes to Arbitrary CLR Properties via TypedObjectAccessor (Mass Assignment + private / init / internal Setter Bypass)
NuGet scriban · Upgrade to 7.2.2 or later · <= 7.2.1 · GHSA-7jvp-hj45-2f2m
6 Jul 2026Evidence →
Critical, CVSS 9.26 Jul 2026
Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access
Go github.com/cilium/cilium · Upgrade to 1.19.2, 1.18.8 or 1.17.14 by release line · >= 1.19.0, < 1.19.2; >= 1.18.0, < 1.18.8; < 1.17.14 · CVE-2026-49445 · GHSA-3fcv-jvfp-m4q9
6 Jul 2026Evidence →
Medium, CVSS 4.36 Jul 2026
OpenRemote read-only asset users can write predicted datapoints
Maven io.openremote:openremote-manager · Upgrade to 1.24.1 or later · < 1.24.1 · CVE-2026-49439 · GHSA-xj53-j257-hxvg
6 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

uucore: safe_traversal TOCTOU protection only enabled on Linux

mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

cp: -R reads device nodes as streams, destroying device semantics

rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

comm: FIFO/pipe inputs are drained before comparison (data loss / hang)

id: groups= computed from real GID instead of effective GID

mkdir: -m exposes directory with umask perms before chmod (race window)

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

id: pretty-print uses effective GID instead of effective UID for name lookup

kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)

install -D: symlink race in directory creation allows arbitrary file overwrite

cut: -s (only-delimited) ignored when delimiter is a newline

install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite

ln: rejects non-UTF-8 source filenames in target-directory mode

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

mktemp: empty TMPDIR creates temp files in CWD instead of /tmp

chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)

chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)

flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

OpenRemote read-only asset users can write predicted datapoints

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence