Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
Critical: 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

5901–5925 of 30,985 matching · newest first

ExploitedClear filters

Medium, CVSS 4.927 May 2026
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12 or 6.4.40 by release line · >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45069 · GHSA-29fc-p6c4-24cg
27 May 2026Evidence →
Medium, CVSS 6.227 May 2026
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line · < 5.4.52; >= 6.0.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45068 · GHSA-xx3c-qf5g-hc39
27 May 2026Evidence →
High, CVSS 7.127 May 2026
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Packagist symfony/mime +1 · Upgrade all 2 to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line · < 5.4.52; >= 6.0.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45067 · GHSA-qpmx-3rfj-7rhv
27 May 2026Evidence →
Unrated27 May 2026
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and Misclassification
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12 or 6.4.40 by release line · >= 6.1.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45066 · GHSA-qc95-4862-92fh
27 May 2026Evidence →
Medium, CVSS 6.927 May 2026
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12 or 6.4.40 by release line · >= 6.1.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45064 · GHSA-h5vq-qfcg-4m6p
27 May 2026Evidence →
High, CVSS 7.227 May 2026
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
Go github.com/crowdsecurity/crowdsec · Upgrade to 1.7.8 or later · >= 1.5.0, <= 1.7.7 · CVE-2026-44982 · GHSA-rw47-hm26-6wr7
27 May 2026Evidence →
Medium, CVSS 4.627 May 2026
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
Go github.com/crowdsecurity/crowdsec · Upgrade to 1.7.8 or later · >= 1.7.0, < 1.7.8 · CVE-2026-44981 · GHSA-273h-gvwr-c3qj
27 May 2026Evidence →
High, CVSS 7.427 May 2026
Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
crates.io deno · Upgrade to 2.7.8 or later · >= 2.0.0, < 2.7.8 · CVE-2026-44726 · GHSA-chqv-56wv-7564
27 May 2026Evidence →
Critical, CVSS 9.827 May 2026
Langroid has Prompt to SQL Injection, Leading to RCE
PyPI langroid · Upgrade to 0.63.0 or later · < 0.63.0 · CVE-2026-25879 · GHSA-mxfr-6hcw-j9rq · amended
27 May 2026Evidence →
Critical, CVSS 10.027 May 2026
LiquidJS is Vulnerable to Remote Code Execution
npm liquidjs · Upgrade to 10.26.0 or later · < 10.26.0 · CVE-2026-45618 · GHSA-gf2q-c269-pqgc · amended
27 May 2026Evidence →
High, CVSS 7.527 May 2026
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in strip_html Filter Regex
npm liquidjs · Upgrade to 10.26.0 or later · < 10.26.0 · CVE-2026-45617 · GHSA-r7g9-xpmj-5fcq · amended
27 May 2026Evidence →
High, CVSS 8.427 May 2026
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-45368 · GHSA-qvjf-922g-pj44
27 May 2026Evidence →
High, CVSS 7.527 May 2026
LiquidJS has a memory and render limit bypass via unbounded width padding in date filter (strftime)
npm liquidjs · Upgrade to 10.26.0 or later · < 10.26.0 · CVE-2026-45357 · GHSA-hh27-hf48-9f5q · amended
27 May 2026Evidence →
Medium, CVSS 5.327 May 2026
Kirby CMS's content locks disclose IDs and emails of inaccessible users from users.access/list permissions
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-45334 · GHSA-39vq-49qm-r2mc
27 May 2026Evidence →
High, CVSS 8.127 May 2026
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; >= 2026.1.0, < 2026.1.3; <= 11.5.16 · CVE-2026-45260 · GHSA-wc7j-g8wx-m2qx
27 May 2026Evidence →
High, CVSS 8.027 May 2026
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
Packagist pimcore/pimcore · Upgrade to 2026.1.3, 12.3.7 or 11.5.17 by release line · >= 12.0.0-RC1, <= 12.3.6; <= 11.5.16; >= 2026.1.0, < 2026.1.3 · CVE-2026-45162 · GHSA-36fc-7wjg-mfvj
27 May 2026Evidence →
Unrated27 May 2026
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line · < 5.4.52; >= 6.0.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12 · CVE-2026-45065 · GHSA-72xp-p242-47p9
27 May 2026Evidence →
High, CVSS 8.727 May 2026
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Packagist symfony/symfony +1 · Upgrade all 2 to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line · < 5.4.52; >= 6.0.0-BETA1, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 · CVE-2026-45063 · GHSA-ph86-p8f6-f9r2
27 May 2026Evidence →
Low, CVSS 3.827 May 2026
pretix vulnerable to Authorization Bypass Through User-Controlled Key
PyPI pretix · Upgrade to 2026.4.2 or later · < 2026.4.2 · CVE-2026-9712 · GHSA-72p9-6vv6-gvqh · amended
27 May 2026Evidence →
Medium, CVSS 4.327 May 2026
Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability
Maven org.jenkins-ci.plugins:jenkins-multijob-plugin · Upgrade to 669.v9d96a (pre-release) or later · < 669.v9d96a · CVE-2026-9674 · GHSA-hj3h-r49w-34wh
27 May 2026Evidence →
Medium, CVSS 4.327 May 2026
Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint
Maven org.jenkins-ci.plugins:job-import-plugin · Upgrade to 143.145.v48f9a (pre-release) or later · < 143.145.v48f9a · CVE-2026-48926 · GHSA-p8jh-4p5p-2rfp
27 May 2026Evidence →
Medium, CVSS 4.327 May 2026
Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation
Maven com.rapid7:jenkinsci-appspider-plugin · Upgrade to 1.0.18 or later · <= 1.0.17 · CVE-2026-48923 · GHSA-9wm7-8qf3-9v98
27 May 2026Evidence →
Medium, CVSS 4.327 May 2026
Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login
Maven org.jenkins-ci.plugins:bitbucket-oauth · Upgrade to 0.18 or later · <= 0.17 · CVE-2026-48924 · GHSA-r8fj-rff6-f7h5
27 May 2026Evidence →
Medium, CVSS 4.327 May 2026
Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability
Maven org.jenkins-ci.plugins:github-integration-parent · Upgrade to 0.7.4 or later · <= 0.7.3 · CVE-2026-48925 · GHSA-rf8w-7c3g-7h3g
27 May 2026Evidence →
High, CVSS 7.527 May 2026
Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials
Maven org.jenkins-ci.plugins:credentials-binding · Upgrade to 725.ve52b (pre-release) or later · <= 720.v3f6decef43ea · CVE-2026-48922 · GHSA-fxxf-w25w-mcx2
27 May 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in stylelint-standard (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in em-owa-walletconnect-sign-client (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in jsconvict (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v811 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v647 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and Misclassification

Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Langroid has Prompt to SQL Injection, Leading to RCE

LiquidJS is Vulnerable to Remote Code Execution

LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

pretix vulnerable to Authorization Bypass Through User-Controlled Key

Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability

Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint

Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation

Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login

Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence