Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
Critical: 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

6276–6300 of 14,180 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 7.919 Mar 2025
The WikiManager REST API allows any user to create wikis
Maven org.xwiki.platform:xwiki-platform-wiki-rest-default · Upgrade to 16.10.0, 16.4.6 or 15.10.15 by release line · >= 5.4-rc-1, < 15.10.15; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0 · CVE-2025-29926 · GHSA-gfp2-6qhm-7x43
19 Mar 2025Evidence →
High, CVSS 8.719 Mar 2025
XWiki allows unregistered users to access private pages information through REST endpoint
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 16.10.0-rc-1 (pre-release), 16.4.6 or 15.10.14 by release line · >= 1.9M1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1 · CVE-2025-29925 · GHSA-22q5-9phm-744v
19 Mar 2025Evidence →
High, CVSS 8.719 Mar 2025
XWiki uses the wrong wiki reference in AuthorizationManager
Maven org.xwiki.platform:xwiki-platform-security-authorization-api · Upgrade to 16.10.0-rc-1 (pre-release), 16.4.6 or 15.10.14 by release line · >= 6.1-rc-1, < 15.10.14; >= 16.0.0-rc-1, < 16.4.6; >= 16.5.0-rc-1, < 16.10.0-rc-1 · CVE-2025-29924 · GHSA-gq32-758c-3wm3
19 Mar 2025Evidence →
High, CVSS 7.519 Mar 2025
Nuxt allows DOS via cache poisoning with payload rendering response
npm nuxt · Upgrade to 3.16.0 or later · >= 3.0.0, < 3.16.0 · CVE-2025-27415 · GHSA-jvhm-gjrh-3h93 · amended
19 Mar 2025Evidence →
High, CVSS 7.519 Mar 2025
Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter
Go github.com/getkin/kin-openapi · Upgrade to 0.131.0 or later · < 0.131.0 · CVE-2025-30153 · GHSA-wq9g-9vfc-cfq9
19 Mar 2025Evidence →
Critical, CVSS 9.019 Mar 2025
vLLM Allows Remote Code Execution via Mooncake Integration
PyPI vllm · Upgrade to 0.8.0 or later · >= 0.6.5, < 0.8.0 · CVE-2025-29783 · GHSA-x3m8-f7g5-qhm7 · amended
19 Mar 2025Evidence →
High, CVSS 8.718 Mar 2025
jsPDF Bypass Regular Expression Denial of Service (ReDoS)
npm jspdf · Upgrade to 3.0.1 or later · < 3.0.1 · CVE-2025-29907 · GHSA-w532-jxjh-hjhj · amended
18 Mar 2025Evidence →
High, CVSS 8.118 Mar 2025
TastyIgniter Has an Incorrect Access Control Vulnerability via invoice() Function
Packagist tastyigniter/tastyigniter · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2024-44313 · GHSA-gg2f-r4jh-vpmh
18 Mar 2025Evidence →
High, CVSS 7.317 Mar 2025
zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write
crates.io zip · Upgrade to 2.3.0 or later · >= 1.3.0, < 2.3.0 · CVE-2025-29787 · GHSA-94vh-gphv-8pm8
17 Mar 2025Evidence →
High, CVSS 7.517 Mar 2025
Memory Exhaustion in Expr Parser with Unrestricted Input
Go github.com/expr-lang/expr · Upgrade to 1.17.0 or later · < 1.17.0 · CVE-2025-29786 · GHSA-93mq-9ffx-83m2
17 Mar 2025Evidence →
High, CVSS 8.717 Mar 2025
PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash
PyPI postquantum-feldman-vss · Upgrade to 0.7.7b0 (pre-release) or later · <= 0.7.6b0 · GHSA-v432-7f47-9g94 · amended
17 Mar 2025Evidence →
High, CVSS 8.6Exploited · CISA KEV15 Mar 2025
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
GitHub Actions tj-actions/changed-files · Upgrade to 46.0.1 or later · <= 45.0.7 · CVE-2025-30066 · GHSA-mrrh-fwg8-r2c3
15 Mar 2025Evidence →
High, CVSS 7.814 Mar 2025
Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs
RubyGems nokogiri · Upgrade to 1.18.4 or later · < 1.18.4 · GHSA-mrxw-mxhj-p664
14 Mar 2025Evidence →
High, CVSS 8.714 Mar 2025
In Azle, calling setTimer causes infinite loop of timers
npm azle · Upgrade to 0.30.0 or later · >= 0.27.0, < 0.30.0 · CVE-2025-29776 · GHSA-xc76-5pf9-mx8m · amended
14 Mar 2025Evidence →
Critical, CVSS 9.314 Mar 2025
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
npm xml-crypto · Upgrade to 6.0.1, 3.2.1 or 2.1.6 by release line · >= 4.0.0, < 6.0.1; >= 3.0.0, < 3.2.1; < 2.1.6 · CVE-2025-29775 · GHSA-x3m8-899r-f7c3 · amended
14 Mar 2025Evidence →
Critical, CVSS 9.314 Mar 2025
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
npm xml-crypto · Upgrade to 6.0.1, 3.2.1 or 2.1.6 by release line · >= 4.0.0, < 6.0.1; >= 3.0.0, < 3.2.1; < 2.1.6 · CVE-2025-29774 · GHSA-9p8x-f768-wp2g · amended
14 Mar 2025Evidence →
Critical, CVSS 9.414 Mar 2025
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment
RubyGems camaleon_cms · Upgrade to 2.9.1 or later · < 2.9.1 · CVE-2025-2304 · GHSA-rp28-mvq3-wf8j
14 Mar 2025Evidence →
Critical, CVSS 9.312 Mar 2025
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
RubyGems ruby-saml · Upgrade to 1.18.0 or 1.12.4 by release line · >= 1.13.0, < 1.18.0; < 1.12.4 · CVE-2025-25292 · GHSA-754f-8gm6-c4r2
12 Mar 2025Evidence →
Critical, CVSS 9.312 Mar 2025
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)
RubyGems ruby-saml · Upgrade to 1.18.0 or 1.12.4 by release line · < 1.12.4; >= 1.13.0, < 1.18.0 · CVE-2025-25291 · GHSA-4vc4-m8qh-g8jm
12 Mar 2025Evidence →
High, CVSS 7.712 Mar 2025
Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses
RubyGems ruby-saml · Upgrade to 1.18.0 or 1.12.4 by release line · < 1.12.4; >= 1.13.0, < 1.18.0 · CVE-2025-25293 · GHSA-92rq-c8cf-prrq
12 Mar 2025Evidence →
High, CVSS 8.712 Mar 2025
Cosmos SDK: x/group can halt when erroring in EndBlocker
Go github.com/cosmos/cosmos-sdk · Upgrade to 0.50.13 or 0.47.17 by release line · >= 0.50.0-alpha.0, <= 0.50.12; <= 0.47.16 · GHSA-47ww-ff84-4jrg
12 Mar 2025Evidence →
Critical, CVSS 9.012 Mar 2025
graphql allows remote code execution when loading a crafted GraphQL schema
RubyGems graphql · Upgrade to 2.4.13, 2.3.21, 2.2.17 or 5 more by release line · >= 2.4.0, < 2.4.13; >= 2.3.0, < 2.3.21; >= 2.0.0, < 2.0.32; >= 1.13.0, < 1.13.24; >= 1.12.0, < 1.12.25; >= 2.1.0, < 2.1.15; >= 1.11.5, < 1.11.11; >= 2.2.0, < 2.2.17 · CVE-2025-27407 · GHSA-q92j-grw3-h492
12 Mar 2025Evidence →
High, CVSS 7.512 Mar 2025
Out-of-bounds Read in Ruby JSON Parser
RubyGems json · Upgrade to 2.10.2 or later · >= 2.10.0, <= 2.10.1 · CVE-2025-27788 · GHSA-9m3q-rhmv-5q44
12 Mar 2025Evidence →
High, CVSS 7.512 Mar 2025
SmallRye Fault Tolerance out-of-memory (OOM) issue
Maven io.smallrye:smallrye-fault-tolerance-core · Upgrade to 6.9.0 or 6.4.2 by release line · >= 6.3.0, < 6.4.2; >= 6.5.0, < 6.9.0 · CVE-2025-2240 · GHSA-gfh6-3pqw-x2j4
12 Mar 2025Evidence →
Critical, CVSS 9.311 Mar 2025
cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement
Go github.com/cheqd/cheqd-node · Upgrade to 3.1.7 or later · < 3.1.7 · GHSA-33cr-m232-xqch
11 Mar 2025Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in stylelint-standard (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in em-owa-walletconnect-sign-client (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in jsconvict (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v811 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v647 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

The WikiManager REST API allows any user to create wikis

XWiki allows unregistered users to access private pages information through REST endpoint

XWiki uses the wrong wiki reference in AuthorizationManager

Nuxt allows DOS via cache poisoning with payload rendering response

Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

vLLM Allows Remote Code Execution via Mooncake Integration

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function

zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Memory Exhaustion in Expr Parser with Unrestricted Input

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

In Azle, calling `setTimer` causes infinite loop of timers

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

Cosmos SDK: x/group can halt when erroring in EndBlocker

graphql allows remote code execution when loading a crafted GraphQL schema

Out-of-bounds Read in Ruby JSON Parser

SmallRye Fault Tolerance out-of-memory (OOM) issue

cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence