Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 970 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

4301–4325 of 30,946 matching · newest first

ExploitedClear filters

High, CVSS 8.81 Jul 2026
Rancher has over-inclusive team membership expansion in GitHub App authentication provider
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6 or 0.0.0-20260519172014-d0c047bbc6d2 (pre-release) by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; < 0.0.0-20260519172014-d0c047bbc6d2 · CVE-2026-41053 · GHSA-4j6x-2764-m8gh
1 Jul 2026Evidence →
Critical, CVSS 9.91 Jul 2026
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated valuesFrom references in Helm Deployer
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44935 · GHSA-xr65-5cpm-g36x
1 Jul 2026Evidence →
Medium, CVSS 5.01 Jul 2026
Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44936 · GHSA-hx4v-cxpf-vh8m
1 Jul 2026Evidence →
Critical, CVSS 9.41 Jul 2026
Rancher vulnerable to command injection through unsanitized YAML parameter
Go github.com/rancher/rancher · Upgrade to 2.14.2, 2.13.6, 2.12.10 or 3 more by release line · >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; >= 2.11.0, < 2.11.14; >= 2.10.0, < 2.10.12; < 0.0.0-20260617231817-2aa77eb283e7 · CVE-2026-44939 · GHSA-mhc6-2gfq-xx62
1 Jul 2026Evidence →
High, CVSS 7.51 Jul 2026
Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44937 · GHSA-jmf4-m7j9-g72r
1 Jul 2026Evidence →
High, CVSS 8.81 Jul 2026
Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
Go github.com/rancher/fleet · Upgrade to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 by release line · >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15 · CVE-2026-44938 · GHSA-864g-863m-vcvq
1 Jul 2026Evidence →
Unrated1 Jul 2026
land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory
Maven land.oras:oras-java-sdk · Upgrade to 0.6.4 or later · <= 0.6.3 · GHSA-j6hm-v3x2-qv6j
1 Jul 2026Evidence →
Medium, CVSS 5.41 Jul 2026
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-49997 · GHSA-whwg-vh4f-pmmf
1 Jul 2026Evidence →
Medium, CVSS 4.31 Jul 2026
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63761 · GHSA-fwg2-gr34-q3w8
1 Jul 2026Evidence →
Medium, CVSS 4.31 Jul 2026
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63742 · GHSA-c8jx-96c9-8xrp · amended
1 Jul 2026Evidence →
Medium, CVSS 6.51 Jul 2026
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63741 · GHSA-wp87-mgvq-5j93 · amended
1 Jul 2026Evidence →
Medium, CVSS 6.41 Jul 2026
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63743 · GHSA-97vg-427p-8hx5
1 Jul 2026Evidence →
Medium, CVSS 4.31 Jul 2026
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63749 · GHSA-6wqw-vhfr-9999 · amended
1 Jul 2026Evidence →
Medium, CVSS 4.31 Jul 2026
SurrealDB: RELATE overwrites existing edge records without UPDATE permission
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63752 · GHSA-f82j-v89j-mf86 · amended
1 Jul 2026Evidence →
Medium, CVSS 4.31 Jul 2026
SurrealDB has bypass of field-level SELECT permissions through JSON Patch copy and move with empty from
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63751 · GHSA-fpxg-5xmv-922m
1 Jul 2026Evidence →
Medium, CVSS 4.31 Jul 2026
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63748 · GHSA-6g9v-7gq3-p2c6
1 Jul 2026Evidence →
Medium, CVSS 4.31 Jul 2026
SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63753 · GHSA-4m82-p8cx-f94j · amended
1 Jul 2026Evidence →
Medium, CVSS 5.31 Jul 2026
SurrealDB vulnerable to pre-auth memory amplification via unbounded /sql WebSocket frames
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63750 · GHSA-65rj-r9fh-jp2v · amended
1 Jul 2026Evidence →
Medium, CVSS 5.41 Jul 2026
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63758 · GHSA-gcwr-5mrf-fvch
1 Jul 2026Evidence →
Medium, CVSS 6.51 Jul 2026
SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63754 · GHSA-4v76-cw68-4vc9 · amended
1 Jul 2026Evidence →
Medium, CVSS 5.41 Jul 2026
SurrealDB has an Authorization Bypass via Composite Record-id Paths
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63745 · GHSA-6vg3-hgrw-p5gf · amended
1 Jul 2026Evidence →
Medium, CVSS 6.51 Jul 2026
SurrealDB: Graph traversal bypasses table SELECT permissions
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63746 · GHSA-vjjx-rfw4-rmfc
1 Jul 2026Evidence →
Medium, CVSS 6.51 Jul 2026
SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63755 · GHSA-98fx-66cf-fc7c
1 Jul 2026Evidence →
Medium, CVSS 6.51 Jul 2026
SurrealDB vulnerable to Denial of Service due to nested types annotations
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63759 · GHSA-q8qp-67f9-wr3f · amended
1 Jul 2026Evidence →
High, CVSS 7.51 Jul 2026
SurrealDB has unauthenticated remote DoS via malformed RPC use call
crates.io surrealdb · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2026-63747 · GHSA-wjjj-24cx-f28g · amended
1 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Rancher vulnerable to command injection through unsanitized YAML parameter

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions

SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission

SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls

SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames

SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required

SurrealDB has an Authorization Bypass via Composite Record-id Paths

SurrealDB: Graph traversal bypasses table SELECT permissions

SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level

SurrealDB vulnerable to Denial of Service due to nested types annotations

SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence