Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 409 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
Critical: 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

6076–6100 of 14,177 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 8.328 May 2025
Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users
Maven com.ritense.valtimo:object-management +1 · Upgrade all 2 to 12.13.0.RELEASE; some affected versions have no fix yet · >= 11.0.0.RELEASE, <= 11.3.3.RELEASE; >= 12.0.0.RELEASE, < 12.13.0.RELEASE · CVE-2025-48881 · GHSA-965r-9cg9-g42p
28 May 2025Evidence →
High, CVSS 8.128 May 2025
Apache InLong: JDBC Vulnerability during verification processing
Maven org.apache.inlong:manager-pojo · Upgrade to 2.2.0 or later · >= 1.13.0, < 2.2.0 · CVE-2025-27522 · GHSA-r324-vgr5-73c9
28 May 2025Evidence →
High, CVSS 8.227 May 2025
Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
PyPI django-select2 · Upgrade to 8.4.1 or later · < 8.4.1 · CVE-2025-48383 · GHSA-wjrh-hj83-3wh7 · amended
27 May 2025Evidence →
High, CVSS 7.722 May 2025
Fiber panics when fiber.Ctx.BodyParser parses invalid range index
Go github.com/gofiber/fiber/v2 · Upgrade to 2.52.7 or later · >= 2.52.6, < 2.52.7 · CVE-2025-48075 · GHSA-hg3g-gphw-5hhm
22 May 2025Evidence →
High, CVSS 7.622 May 2025
Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin
Go github.com/grafana/grafana · Upgrade to 0.0.0-20250521183405-c7a690348df7 (pre-release) or later · < 0.0.0-20250521183405-c7a690348df7 · CVE-2025-4123 · GHSA-q53q-gxq9-mgrj
22 May 2025Evidence →
Critical, CVSS 10.021 May 2025
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution
Packagist sjbr/sr-feuser-register · Upgrade to 12.5.0 or later · >= 5.1.0, < 12.5.0 · CVE-2025-48200 · GHSA-qfm8-78qf-p75j
21 May 2025Evidence →
High, CVSS 8.621 May 2025
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
Packagist nitsan/ns-backup · Upgrade to 13.0.1 or later · < 13.0.1 · CVE-2025-48201 · GHSA-hq4f-5qjv-fwrg
21 May 2025Evidence →
High, CVSS 8.621 May 2025
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference
Packagist sjbr/sr-feuser-register · Upgrade to 12.5.0 or later · >= 5.1.0, < 12.5.0 · CVE-2025-48205 · GHSA-cvgc-mx2w-h3w8
21 May 2025Evidence →
High, CVSS 7.621 May 2025
containerd allows host filesystem access on pull
Go github.com/containerd/containerd/v2 · Upgrade to 2.1.1 or later · >= 2.1.0, < 2.1.1 · CVE-2025-47290 · GHSA-cm76-qm8v-3j95
21 May 2025Evidence →
Critical, CVSS 9.121 May 2025
Spring Security authorization bypass for method security annotations on private methods
Maven org.springframework.security:spring-security-core +1 · Upgrade all 2 to 6.4.6 or later · >= 6.4.0, < 6.4.6 · CVE-2025-41232 · GHSA-9pp5-9c7g-4r83
21 May 2025Evidence →
High, CVSS 7.220 May 2025
The TYPO3 CMS Backend has Broken Authentication in Backend MFA
Packagist typo3/cms-backend · Upgrade to 13.4.12 or 12.4.31 by release line · >= 12.0.0, <= 12.4.30; >= 13.0.0, <= 13.4.11 · CVE-2025-47941 · GHSA-744g-7qm9-hjh9
20 May 2025Evidence →
High, CVSS 7.220 May 2025
TYPO3 Allows Privilege Escalation to System Maintainer
Packagist typo3/cms-core · Upgrade to 13.4.12, 12.4.31, 11.5.44 or 10.4.50 by release line · >= 10.4.0, <= 10.4.49; >= 11.0.0, <= 11.5.43; >= 12.0.0, <= 12.4.30; >= 13.0.0, <= 13.4.11 · CVE-2025-47940 · GHSA-6frx-j292-c844
20 May 2025Evidence →
Critical, CVSS 9.820 May 2025
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
PyPI vllm · Upgrade to 0.8.5 or later · >= 0.6.5, < 0.8.5 · CVE-2025-47277 · GHSA-hjq4-87xh-g4fv · amended
20 May 2025Evidence →
High, CVSS 8.120 May 2025
Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
PyPI langroid · Upgrade to 0.53.15 or later · < 0.53.15 · CVE-2025-46725 · GHSA-22c2-9gwg-mj59 · amended
20 May 2025Evidence →
Critical, CVSS 9.820 May 2025
Langroid has a Code Injection vulnerability in TableChatAgent
PyPI langroid · Upgrade to 0.53.15 or later · < 0.53.15 · CVE-2025-46724 · GHSA-jqq5-wc57-f8hj · amended
20 May 2025Evidence →
Critical, CVSS 9.919 May 2025
samlify SAML Signature Wrapping attack
npm samlify · Upgrade to 2.10.0 or later · < 2.10.0 · CVE-2025-47949 · GHSA-r683-v43c-6xqv · amended
19 May 2025Evidence →
High, CVSS 7.519 May 2025
Multer vulnerable to Denial of Service from maliciously crafted requests
npm multer · Upgrade to 2.0.0 or later · >= 1.4.4-lts.1, < 2.0.0 · CVE-2025-47944 · GHSA-4pg4-qvpc-4q3h · amended
19 May 2025Evidence →
High, CVSS 7.519 May 2025
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
npm multer · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2025-47935 · GHSA-44fp-w29j-9vj5 · amended
19 May 2025Evidence →
High, CVSS 8.719 May 2025
OpenPGP.js's message signature verification can be spoofed
npm openpgp · Upgrade to 6.1.1 or 5.11.3 by release line · >= 5.0.1, <= 5.11.2; >= 6.0.0-alpha.0, <= 6.1.0 · CVE-2025-47934 · GHSA-8qff-qr5q-5pr8 · amended
19 May 2025Evidence →
Critical, CVSS 9.919 May 2025
Gardener allows metadata injection for a project secret which can lead to privilege escalation
Go github.com/gardener/gardener · Upgrade to 1.118.2, 1.117.5 or 1.116.4 by release line · < 1.116.4; >= 1.117.0, < 1.117.5; >= 1.118.0, < 1.118.2 · CVE-2025-47284 · GHSA-9x73-87fh-54w9
19 May 2025Evidence →
Critical, CVSS 9.919 May 2025
Gardener allows bypassing project secret validation which can lead to privilege escalation
Go github.com/gardener/gardener · Upgrade to 1.118.2, 1.117.5 or 1.116.4 by release line · < 1.116.4; >= 1.117.0, < 1.117.5; >= 1.118.0, < 1.118.2 · CVE-2025-47283 · GHSA-3hw7-qj9h-r835
19 May 2025Evidence →
High, CVSS 7.719 May 2025
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
PyPI setuptools · Upgrade to 78.1.1 or later · < 78.1.1 · CVE-2025-47273 · GHSA-5rjg-fvgr-3xxf · amended
19 May 2025Evidence →
Critical, CVSS 9.117 May 2025
laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Packagist auth0/login · Upgrade to 7.17.0 or later · < 7.17.0 · GHSA-9fwj-9mjf-rhj3
17 May 2025Evidence →
Critical, CVSS 9.117 May 2025
Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Packagist auth0/wordpress · Upgrade to 5.3.0 or later · < 5.3.0 · GHSA-2f4r-34m4-3w8q
17 May 2025Evidence →
Critical, CVSS 9.117 May 2025
Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Packagist auth0/symfony · Upgrade to 5.4.0 or later · < 5.4.0 · GHSA-9wg9-93h9-j8ch
17 May 2025Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in stylelint-standard (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in em-owa-walletconnect-sign-client (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in jsconvict (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v811 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v647 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence