Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

4751–4775 of 14,171 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 8.72 Mar 2026
OpenChatBI has a Path Traversal Vulnerability in save_report Tool
PyPI openchatbi · Upgrade to 0.2.2 or later · <= 0.2.1 · CVE-2026-28795 · GHSA-vmwq-8g8c-jm79 · amended
2 Mar 2026Evidence →
Critical, CVSS 9.32 Mar 2026
@orpc/client has Prototype Pollution via StandardRPCJsonSerializer Deserialization
npm @orpc/client · Upgrade to 1.13.6 or later · <= 1.13.5 · CVE-2026-28794 · GHSA-m272-9rp6-32mc · amended
2 Mar 2026Evidence →
High, CVSS 7.52 Mar 2026
OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260302002902-d9804182eae4 (pre-release) or later · < 0.0.0-20260302002902-d9804182eae4 · CVE-2026-28790 · GHSA-4fqm-6fmh-82mq
2 Mar 2026Evidence →
High, CVSS 7.52 Mar 2026
OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260301235225-f044d90d5525c (pre-release) or later · < 0.0.0-20260301235225-f044d90d5525c · CVE-2026-28789 · GHSA-45m3-398w-m2m9
2 Mar 2026Evidence →
Critical, CVSS 9.22 Mar 2026
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
npm @builder.io/qwik · Upgrade to 1.19.1 or later · <= 1.19.0 · CVE-2026-27971 · GHSA-p9x5-jp3h-96mm · amended
2 Mar 2026Evidence →
High, CVSS 8.62 Mar 2026
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Packagist idno/known · Upgrade to 1.6.4 or later · < 1.6.4 · CVE-2026-28507 · GHSA-37j7-56xc-c468
2 Mar 2026Evidence →
Critical, CVSS 9.22 Mar 2026
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
Packagist idno/known · Upgrade to 1.6.4 or later · <= 1.6.3 · CVE-2026-28508 · GHSA-fcrh-fqxh-6fx6
2 Mar 2026Evidence →
High, CVSS 8.02 Mar 2026
CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements
PyPI cocoindex · Upgrade to 0.3.34 or later · < 0.3.34 · CVE-2026-28438 · GHSA-59g6-v3vg-f7wc · amended
2 Mar 2026Evidence →
High, CVSS 7.12 Mar 2026
FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.61.0 or later · <= 2.60.0 · CVE-2026-28492 · GHSA-mr74-928f-rw69
2 Mar 2026Evidence →
High, CVSS 7.52 Mar 2026
OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260227002407-2eb5f0ba79d4 (pre-release) or later · < 0.0.0-20260227002407-2eb5f0ba79d4 · CVE-2026-28342 · GHSA-pc8g-78pf-4xrp
2 Mar 2026Evidence →
High, CVSS 7.52 Mar 2026
joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
PyPI joserfc · Upgrade to 1.6.3 or later · < 1.6.3 · CVE-2026-27932 · GHSA-w5r5-m38g-f9f9 · amended
2 Mar 2026Evidence →
High, CVSS 8.42 Mar 2026
OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write
PyPI openexr · Upgrade to 3.4.6, 3.3.8 or 3.2.6 by release line · >= 2.3.0, < 3.2.6; >= 3.3.0, < 3.3.8; >= 3.4.0, < 3.4.6 · CVE-2026-27622 · GHSA-cr4v-6jm6-4963 · amended
2 Mar 2026Evidence →
High, CVSS 8.42 Mar 2026
theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution
crates.io theshit · Upgrade to 0.2.0 or later · < 0.2.0 · CVE-2026-21882 · GHSA-2j3p-gqw5-g59j
2 Mar 2026Evidence →
High, CVSS 8.22 Mar 2026
Nest has a Fastify URL Encoding Middleware Bypass
npm @nestjs/platform-fastify · Upgrade to 11.1.14 or later · <= 11.1.13 · CVE-2026-2293 · GHSA-r4wm-x892-vjmx · amended
2 Mar 2026Evidence →
High, CVSS 8.71 Mar 2026
Statamic vulnerable to privilege escalation via stored cross-site scripting
Packagist statamic/cms · Upgrade to 6.4.0 or 5.73.11 by release line · < 5.73.11; >= 6.0.0-alpha.1, < 6.4.0 · CVE-2026-28426 · GHSA-5vrj-wf7v-5wr7
1 Mar 2026Evidence →
High, CVSS 8.01 Mar 2026
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
Packagist statamic/cms · Upgrade to 6.7.2 or 5.73.16 by release line · < 5.73.16; >= 6.0.0-alpha.1, < 6.7.2 · CVE-2026-28425 · GHSA-cpv7-q2wx-m8rw
1 Mar 2026Evidence →
High, CVSS 8.21 Mar 2026
Gradio has SSRF via Malicious proxy_url Injection in gr.load() Config Processing
PyPI gradio · Upgrade to 6.6.0 or later · < 6.6.0 · CVE-2026-28416 · GHSA-jmh7-g254-2cq9 · amended
1 Mar 2026Evidence →
High, CVSS 7.51 Mar 2026
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
PyPI gradio · Upgrade to 6.7.0 or later · < 6.7.0 · CVE-2026-28414 · GHSA-39mp-8hj3-5c49 · amended
1 Mar 2026Evidence →
High, CVSS 8.21 Mar 2026
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories
Go github.com/chainguard-dev/kaniko · Upgrade to 1.25.10 or later · >= 1.25.4, < 1.25.10 · CVE-2026-28406 · GHSA-6rxq-q92g-4rmf
1 Mar 2026Evidence →
High, CVSS 8.71 Mar 2026
INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints
Go github.com/romitou/insatutorat · Upgrade to 0.0.0-20260226075457-15ae47425aed (pre-release) or later · < 0.0.0-20260226075457-15ae47425aed · GHSA-xfx2-prg5-jq3g
1 Mar 2026Evidence →
High, CVSS 8.71 Mar 2026
Multer vulnerable to Denial of Service via incomplete cleanup
npm multer · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2026-3304 · GHSA-xf7r-hgr6-v32p · amended
1 Mar 2026Evidence →
High, CVSS 8.71 Mar 2026
Multer vulnerable to Denial of Service via resource exhaustion
npm multer · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2026-2359 · GHSA-v52c-386h-88mc · amended
1 Mar 2026Evidence →
High, CVSS 8.128 Feb 2026
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
npm serialize-javascript · Upgrade to 7.0.3 or later · <= 7.0.2 · GHSA-5c6j-r48x-rmvq · amended
28 Feb 2026Evidence →
High, CVSS 8.228 Feb 2026
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
npm @fastify/middie · Upgrade to 9.2.0 or later · < 9.2.0 · CVE-2026-2880 · GHSA-8p85-9qpw-fwgw · amended
28 Feb 2026Evidence →
High, CVSS 7.328 Feb 2026
osctrl is Vulnerable to OS Command Injection via Environment Configuration
Go github.com/jmpsec/osctrl · Upgrade to 0.5.0 or later · < 0.5.0 · CVE-2026-28279 · GHSA-rchw-322g-f7rm
28 Feb 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm12 Nov 2026
Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in teahy-znrpz-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in mock-data-sdk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in fcefi-wdojs-util (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in tailwindcss-hook-forms (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

OpenChatBI has a Path Traversal Vulnerability in save_report Tool

`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login

OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal

Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write

theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution

Nest has a Fastify URL Encoding Middleware Bypass

Statamic vulnerable to privilege escalation via stored cross-site scripting

Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+

kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories

INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints

Multer vulnerable to Denial of Service via incomplete cleanup

Multer vulnerable to Denial of Service via resource exhaustion

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware

osctrl is Vulnerable to OS Command Injection via Environment Configuration

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence