Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

4126–4150 of 14,168 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 8.731 Mar 2026
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2025-32957 · GHSA-hv78-cwp4-8r7r
31 Mar 2026Evidence →
Critical, CVSS 9.631 Mar 2026
Mlflow: Command Injection when serving models with enable_mlserver=True
PyPI mlflow · Upgrade to 3.9.0 or later · < 3.9.0 · CVE-2026-0596 · GHSA-rvhj-8chj-8v3c · amended
31 Mar 2026Evidence →
High, CVSS 8.430 Mar 2026
Zebra has a Consensus Failure due to Improper Verification of V5 Transactions
crates.io zebra-consensus · Upgrade to 5.0.1 or later · < 5.0.1 · +1 more package · CVE-2026-34377 · GHSA-3vmh-33xr-9cqh
30 Mar 2026Evidence →
High, CVSS 8.130 Mar 2026
OpenClaw: browser.request still allows POST /reset-profile through the operator.write surface
npm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · CVE-2026-35653 · GHSA-xp9r-prpg-373r · amended
30 Mar 2026Evidence →
High, CVSS 8.430 Mar 2026
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
npm openclaw · Upgrade to 2026.3.24 or later · <= 2025.3.23 · CVE-2026-35641 · GHSA-m3mh-3mpg-37hw · amended
30 Mar 2026Evidence →
High, CVSS 7.730 Mar 2026
OpenClaw has Sandbox Media Root Bypass via Unnormalized mediaUrl / fileUrl Parameter Keys (CWE-22)
npm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · CVE-2026-35668 · GHSA-hr5v-j9h9-xjhg · amended
30 Mar 2026Evidence →
High, CVSS 8.230 Mar 2026
LiveQuery protected field leak via shared mutable state across concurrent subscribers
npm parse-server · Upgrade to 9.7.0-alpha.9 (pre-release) or 8.6.65 by release line · >= 9.0.0, < 9.7.0-alpha.9; < 8.6.65 · CVE-2026-34363 · GHSA-m983-v2ff-wq65 · amended
30 Mar 2026Evidence →
Critical, CVSS 9.330 Mar 2026
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation · Upgrade to 6.9.4 or later · < 6.9.4 · CVE-2026-34361 · GHSA-vr79-8m62-wh98
30 Mar 2026Evidence →
High, CVSS 7.430 Mar 2026
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities +1 · Upgrade all 2 to 6.9.4 or later · < 6.9.4 · CVE-2026-34359 · GHSA-fgv2-4q4g-wc35
30 Mar 2026Evidence →
Critical, CVSS 9.930 Mar 2026
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
npm @nocobase/plugin-workflow-javascript · Upgrade to 2.0.28 or later · <= 2.0.27 · CVE-2026-34156 · GHSA-px3p-vgh9-m57c · amended
30 Mar 2026Evidence →
High, CVSS 8.130 Mar 2026
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
npm @tinacms/graphql · Upgrade to 2.2.2 or later · <= 2.2.1 · CVE-2026-33949 · GHSA-v9p7-gf3q-h779 · amended
30 Mar 2026Evidence →
High, CVSS 7.830 Mar 2026
Glances Vulnerable to Command Injection via Dynamic Configuration Values
PyPI glances · Upgrade to 4.5.3 or later · <= 4.5.2 · CVE-2026-33641 · GHSA-qhj7-v7h7-q4c7 · amended
30 Mar 2026Evidence →
High, CVSS 7.130 Mar 2026
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
PyPI glances · Upgrade to 4.5.3 or later · < 4.5.3 · CVE-2026-33533 · GHSA-7p93-6934-f4q7 · amended
30 Mar 2026Evidence →
Critical, CVSS 9.430 Mar 2026
nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260315015203-f61bcec547c0 (pre-release) or later · < 1.9.10-0.20260315015203-f61bcec547c0 · CVE-2026-33026 · GHSA-fhh2-gg7w-gwpq
30 Mar 2026Evidence →
Critical, CVSS 9.130 Mar 2026
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-27599 · GHSA-66m2-v9v9-95c3
30 Mar 2026Evidence →
High, CVSS 8.230 Mar 2026
libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling
crates.io libp2p-gossipsub · Upgrade to 0.49.4 or later · < 0.49.4 · CVE-2026-34219 · GHSA-xqmp-fxgv-xvq5
30 Mar 2026Evidence →
Critical, CVSS 10.030 Mar 2026
MLflow Command Injection vulnerability
PyPI mlflow · Upgrade to 3.8.1 or later · < 3.8.1 · CVE-2025-15379 · GHSA-r23q-823p-vmf7 · amended
30 Mar 2026Evidence →
Critical, CVSS 9.630 Mar 2026
MLFlow path traversal vulnerability
PyPI mlflow · Upgrade to 3.9.0rc0 (pre-release) or later · < 3.9.0rc0 · CVE-2025-15036 · GHSA-vhcx-3pq2-4fvc · amended
30 Mar 2026Evidence →
High, CVSS 8.329 Mar 2026
PYSEC-2026-204
PyPI lollms · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-0562
29 Mar 2026Evidence →
High, CVSS 7.529 Mar 2026
PYSEC-2026-2199
PyPI lollms · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-0560
29 Mar 2026Evidence →
Critical, CVSS 9.829 Mar 2026
PYSEC-2026-2198
PyPI lollms · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-0558
29 Mar 2026Evidence →
High, CVSS 8.329 Mar 2026
MikroORM has Prototype Pollution in Utils.merge
npm @mikro-orm/core · Upgrade to 7.0.6 or 6.6.10 by release line · < 6.6.10; >= 7.0.0-dev.0, < 7.0.6 · CVE-2026-34221 · GHSA-qpfv-44f3-qqx6 · amended
29 Mar 2026Evidence →
Critical, CVSS 9.329 Mar 2026
MikroORM is vulnerable to SQL Injection via specially crafted object
npm @mikro-orm/core · Upgrade to 7.0.6 or 6.6.10 by release line · < 6.6.10; >= 7.0.0-dev.0, < 7.0.6 · CVE-2026-34220 · GHSA-gwhv-j974-6fxm · amended
29 Mar 2026Evidence →
High, CVSS 7.829 Mar 2026
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)
Go github.com/traefik/traefik/v3 · Upgrade to 3.7.0-ea.3 (pre-release) or 3.6.12 by release line · >= 3.0.0-beta3, < 3.6.12; >= 3.7.0-ea.1, < 3.7.0-ea.3 · +1 more package · GHSA-46wh-3698-f2cx
29 Mar 2026Evidence →
High, CVSS 7.529 Mar 2026
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
npm happy-dom · Upgrade to 20.8.9 or later · < 20.8.9 · CVE-2026-34226 · GHSA-w4gp-fjgq-3q4g · amended
29 Mar 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

Mlflow: Command Injection when serving models with enable_mlserver=True

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface

OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)

LiveQuery protected field leak via shared mutable state across concurrent subscribers

FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

Glances Vulnerable to Command Injection via Dynamic Configuration Values

Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling

MLflow Command Injection vulnerability

MLFlow path traversal vulnerability

PYSEC-2026-204

PYSEC-2026-2199

PYSEC-2026-2198

MikroORM has Prototype Pollution in Utils.merge

MikroORM is vulnerable to SQL Injection via specially crafted object

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence