Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
Critical: 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

5551–5575 of 30,985 matching · newest first

ExploitedClear filters

High, CVSS 7.58 Jun 2026
Netty: SCTP reassembly nests buffers without bound
Maven io.netty:netty-transport-sctp · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-46340 · GHSA-5xrh-qmmq-w6ch
8 Jun 2026Evidence →
High, CVSS 8.78 Jun 2026
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45674 · GHSA-676x-f7gg-47vc
8 Jun 2026Evidence →
Medium, CVSS 6.88 Jun 2026
Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port
Maven io.netty:netty-resolver-dns · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45673 · GHSA-xmv7-r254-6q78
8 Jun 2026Evidence →
Medium, CVSS 4.08 Jun 2026
Netty: Unix-socket fd receive leaks descriptors when peer sends two at once
Maven io.netty:netty-transport-native-epoll +1 · Upgrade all 2 to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45536 · GHSA-w573-9ffj-6ff9
8 Jun 2026Evidence →
High, CVSS 7.58 Jun 2026
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh
8 Jun 2026Evidence →
Critical, CVSS 9.28 Jun 2026
PHPSpreadsheet has a patch bypass for CVE-2026-34084
Packagist phpoffice/phpspreadsheet · Upgrade to 1.30.5 or later · <= 1.30.4 · CVE-2026-45034 · GHSA-87m4-826x-3crx
8 Jun 2026Evidence →
High, CVSS 7.58 Jun 2026
Netty's Default QUIC token handler accepts any client-supplied token
Maven io.netty:netty-codec-classes-quic · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44894 · GHSA-cmm3-54f8-px4j
8 Jun 2026Evidence →
High, CVSS 7.58 Jun 2026
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44893 · GHSA-cc37-9q2j-3hfv
8 Jun 2026Evidence →
High, CVSS 7.58 Jun 2026
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.15.Final or later · >= 4.2.0.Final, <= 4.2.14.Final · CVE-2026-44892 · GHSA-c2rx-5r8w-8xr2
8 Jun 2026Evidence →
High, CVSS 7.58 Jun 2026
Netty has Unbounded Direct Memory Consumption in its RedisDecoder
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44890 · GHSA-6ghj-frrj-jjj3
8 Jun 2026Evidence →
High, CVSS 7.58 Jun 2026
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
Maven io.netty:netty-codec-redis · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44250 · GHSA-3244-j874-rhc2
8 Jun 2026Evidence →
High, CVSS 8.18 Jun 2026
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Maven io.netty:netty-handler · Upgrade to 4.2.15.Final or 4.1.135.Final by release line · >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final · CVE-2026-44249 · GHSA-3qp7-7mw8-wx86
8 Jun 2026Evidence →
Low, CVSS 2.18 Jun 2026
MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler
PyPI mysql-mcp-server · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-11529 · GHSA-mvq4-39wx-6h5g · amended
8 Jun 2026Evidence →
Medium, CVSS 4.88 Jun 2026
actual Allows Electron to Run As Node
npm actual · Upgrade to 26.5.0 or later · < 26.5.0 · CVE-2026-42890 · GHSA-7rvm-xjpp-63r9 · amended
8 Jun 2026Evidence →
Medium, CVSS 5.48 Jun 2026
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
PyPI authlib · Upgrade to 1.7.1 or 1.6.10 by release line · < 1.6.10; >= 1.7.0, <= 1.7.0 · CVE-2026-41479 · GHSA-w8p2-r796-3vmq · amended
8 Jun 2026Evidence →
High, CVSS 8.28 Jun 2026
Routinator crashes when sending a maliciously crafted select-asn query parameter
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49234 · GHSA-gc6q-cwcj-3vh9
8 Jun 2026Evidence →
High, CVSS 8.78 Jun 2026
Routinator crashes when encountering maliciously crafted RRDP XML files
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49235 · GHSA-5qf9-cf9c-hjc6
8 Jun 2026Evidence →
High, CVSS 8.38 Jun 2026
Routinator has cache path traversal when processing the module component of rsync URIs
crates.io routinator · Upgrade to 0.15.2 or later · <= 0.15.1 · CVE-2026-49233 · GHSA-33mj-99mg-8g73
8 Jun 2026Evidence →
Medium, CVSS 5.38 Jun 2026
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
PyPI geonode · Upgrade to 5.0.2 or 4.4.5 by release line · >= 4.0.0, < 4.4.5; >= 5.0.0, < 5.0.2 · CVE-2026-39922 · GHSA-hw9r-6m78-w6h3 · amended
8 Jun 2026Evidence →
Critical, CVSS 9.58 Jun 2026
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
npm cordova-plugin-inappbrowser · Upgrade to 6.0.1 or later · < 6.0.1 · CVE-2026-47430 · GHSA-q42j-x8rq-pjg6 · amended
8 Jun 2026Evidence →
Unrated5 Jun 2026
Twig: Sandbox: multiple __toString() policy bypasses via unguarded string coercion points
Packagist twig/twig · Upgrade to 3.26.0 or later · <= 3.25.0 · CVE-2026-47732 · GHSA-pr2w-4gpj-cpq4
5 Jun 2026Evidence →
Unrated5 Jun 2026
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Packagist twig/twig · Upgrade to 3.26.0 or later · >= 3.0.0, < 3.26.0 · CVE-2026-47730 · GHSA-2g2g-8p8h-fgwm
5 Jun 2026Evidence →
Medium, CVSS 4.35 Jun 2026
Bugsink: DOS using large numbers of event tags
PyPI bugsink · Upgrade to 2.2.2 or later · <= 2.2.1 · CVE-2026-53954 · GHSA-5x67-j5xg-c5gj · amended
5 Jun 2026Evidence →
Medium, CVSS 4.35 Jun 2026
Bugsink: Project scoping missing in sourcemap and debug-file lookup
PyPI bugsink · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-47728 · GHSA-5389-f7vh-wxj8 · amended
5 Jun 2026Evidence →
Low, CVSS 3.15 Jun 2026
Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
PyPI bugsink · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-47716 · GHSA-g5vc-q7qc-v939 · amended
5 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in stylelint-standard (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in em-owa-walletconnect-sign-client (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in jsconvict (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v811 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v647 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence