Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 970 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

4426–4450 of 30,946 matching · newest first

ExploitedClear filters

High, CVSS 7.127 Jun 2026
pnpm: patch-remove could delete project-selected files outside the patches directory
npm pnpm · Upgrade to 11.7.0 or 10.34.4 by release line · < 10.34.4; >= 11.0.0, < 11.7.0 · CVE-2026-59194 · GHSA-72r4-9c5j-mj57 · amended
27 Jun 2026Evidence →
High, CVSS 7.127 Jun 2026
pnpm: Hoisted install imports lockfile alias outside node_modules
npm pnpm · Upgrade to 11.7.0 or 10.34.4 by release line · < 10.34.4; >= 11.0.0, < 11.7.0 · CVE-2026-59196 · GHSA-fr4h-3cph-29xv · amended
27 Jun 2026Evidence →
Medium, CVSS 5.526 Jun 2026
Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API
Go github.com/nezhahq/nezha · Upgrade to 2.2.5 or later · < 2.2.5 · GHSA-ww5p-j6cj-6mqq
26 Jun 2026Evidence →
High, CVSS 7.126 Jun 2026
pnpm: stage download writes outside its destination directory via manifest name/version traversal
npm pnpm · Upgrade to 11.5.3 or later · >= 11.3.0, < 11.5.3 · CVE-2026-55700 · GHSA-v23m-ccfg-pq9h · amended
26 Jun 2026Evidence →
Medium, CVSS 6.526 Jun 2026
pnpm: Reserved bin name deletes PNPM_HOME during global remove
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55699 · GHSA-4gxm-v5v7-fqc4 · amended
26 Jun 2026Evidence →
High, CVSS 8.826 Jun 2026
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55698 · GHSA-w466-c33r-3gjp · amended
26 Jun 2026Evidence →
High, CVSS 7.126 Jun 2026
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49338 · GHSA-hmgp-w9jm-vp95
26 Jun 2026Evidence →
High, CVSS 7.126 Jun 2026
gonic: Path Traversal in playlist id bypasses ownership check, enabling any user to read/delete other users' playlists
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49339 · GHSA-2fp4-5v5c-4448
26 Jun 2026Evidence →
High, CVSS 8.126 Jun 2026
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
Go go.senan.xyz/gonic · Upgrade to 0.21.0 or later · <= 0.20.1 · CVE-2026-49340 · GHSA-4gxv-p5g5-j7w7
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55697 · GHSA-gj8w-mvpf-x27x · amended
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55487 · GHSA-5wx6-mg75-v57r · amended
26 Jun 2026Evidence →
Medium, CVSS 6.526 Jun 2026
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
npm pnpm · Upgrade to 11.5.3 or 10.34.2 by release line · < 10.34.2; >= 11.0.0, < 11.5.3 · CVE-2026-55180 · GHSA-3qhv-2rgh-x77r · amended
26 Jun 2026Evidence →
Medium, CVSS 6.226 Jun 2026
ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53465 · GHSA-44cp-c3ww-9rv5
26 Jun 2026Evidence →
Medium, CVSS 4.026 Jun 2026
ImageMagick: Memory Leak in wand option parser when providing invalid arguments
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53464 · GHSA-j989-f892-2335
26 Jun 2026Evidence →
Low, CVSS 3.526 Jun 2026
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Packagist statamic/cms · Upgrade to 6.20.3 or 5.74.0 by release line · < 5.74.0; >= 6.0.0, < 6.20.3 · CVE-2026-54244 · GHSA-7mqq-4v55-88gh
26 Jun 2026Evidence →
Medium, CVSS 6.826 Jun 2026
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Go github.com/nezhahq/nezha · Upgrade to 2.2.0 or later · >= 1.0.0, < 2.2.0 · CVE-2026-53523 · GHSA-9rc6-8cjv-rcvx
26 Jun 2026Evidence →
Medium, CVSS 6.526 Jun 2026
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
Go github.com/nezhahq/nezha · Upgrade to 2.2.0 or later · >= 1.0.0, < 2.2.0 · CVE-2026-53522 · GHSA-jg62-j5h6-8mpq
26 Jun 2026Evidence →
Medium, CVSS 6.126 Jun 2026
Statamic Vulnerable to CSV formula injection in form submission exports
Packagist statamic/cms · Upgrade to 6.20.1 or 5.73.24 by release line · >= 6.0.0, < 6.20.1; < 5.73.24 · CVE-2026-54243 · GHSA-h77m-qrj7-jxcw
26 Jun 2026Evidence →
Medium, CVSS 4.926 Jun 2026
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
Packagist statamic/cms · Upgrade to 6.20.1 or 5.73.24 by release line · < 5.73.24; >= 6.0.0, < 6.20.1 · CVE-2026-54242 · GHSA-v5c4-wcpj-x73m
26 Jun 2026Evidence →
Critical, CVSS 9.126 Jun 2026
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
Go github.com/nezhahq/nezha · Upgrade to 2.0.13 or later · < 2.0.13 · CVE-2026-53519 · GHSA-5c25-7vpj-9mqh
26 Jun 2026Evidence →
Medium, CVSS 6.426 Jun 2026
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Go github.com/nezhahq/nezha · Upgrade to 2.1.0 or later · >= 2.0.14, < 2.1.0 · CVE-2026-53521 · GHSA-39g2-8x68-pmx8
26 Jun 2026Evidence →
Medium, CVSS 6.526 Jun 2026
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Go github.com/nezhahq/nezha · Upgrade to 2.1.0 or later · >= 2.0.14, < 2.1.0 · CVE-2026-53520 · GHSA-x6fg-52vr-hj4w
26 Jun 2026Evidence →
High, CVSS 7.326 Jun 2026
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50015 · GHSA-rxhj-4m44-96r4 · amended
26 Jun 2026Evidence →
Medium, CVSS 6.926 Jun 2026
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50017 · GHSA-cjhr-43r9-cfmw · amended
26 Jun 2026Evidence →
High, CVSS 8.826 Jun 2026
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
npm pnpm · Upgrade to 11.4.0 or 10.34.0 by release line · < 10.34.0; >= 11.0.0, < 11.4.0 · CVE-2026-50016 · GHSA-hwx4-2j3j-g496 · amended
26 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

pnpm: `patch-remove` could delete project-selected files outside the patches directory

pnpm: Hoisted install imports lockfile alias outside node_modules

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

pnpm: Reserved bin name deletes PNPM_HOME during global remove

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

Statamic Vulnerable to CSV formula injection in form submission exports

Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence