Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 972 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
Critical: 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

6976–7000 of 30,985 matching · newest first

ExploitedClear filters

High, CVSS 8.15 May 2026
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42609 · GHSA-rr73-568v-28f8
5 May 2026Evidence →
Low, CVSS 1.35 May 2026
Grav has Insecure Deserialization in File Cache
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-7317 · GHSA-gwfr-jfjf-92vv
5 May 2026Evidence →
Unrated5 May 2026
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · GHSA-vj3m-2g9h-vm4p
5 May 2026Evidence →
High, CVSS 8.55 May 2026
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42612 · GHSA-9695-8fr9-hw5q
5 May 2026Evidence →
Medium, CVSS 6.55 May 2026
Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42610 · GHSA-3f29-pqwf-v4j4
5 May 2026Evidence →
Critical, CVSS 9.45 May 2026
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42613 · GHSA-pxm6-mhxr-q4mj
5 May 2026Evidence →
Medium, CVSS 5.45 May 2026
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42842 · GHSA-c2q3-p4jr-c55f
5 May 2026Evidence →
Medium, CVSS 6.95 May 2026
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42841 · GHSA-r7fx-8g49-7hhr
5 May 2026Evidence →
Critical, CVSS 9.15 May 2026
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
Packagist getgrav/grav · Upgrade to 2.0.0-beta.2 (pre-release) or later · < 2.0.0-beta.2 · CVE-2026-42607 · GHSA-w48r-jppp-rcfw
5 May 2026Evidence →
High, CVSS 8.85 May 2026
Grav API Privilege Escalation to Super Admin
Packagist getgrav/grav-plugin-api · Upgrade to 1.0.0-beta.15 (pre-release) or later · < 1.0.0-beta.15 · CVE-2026-42843 · GHSA-r945-h4vm-h736
5 May 2026Evidence →
High, CVSS 8.15 May 2026
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
PyPI pyload-ng · Upgrade to 0.5.0b3.dev100 (pre-release) or later · <= 0.5.0b3.dev99 · CVE-2026-42315 · GHSA-838g-gr43-qqg9 · amended
5 May 2026Evidence →
High, CVSS 7.55 May 2026
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
Packagist phpseclib/phpseclib · Upgrade to 3.0.52, 2.0.54 or 1.0.29 by release line · >= 2.0.0, <= 2.0.53; >= 3.0.0, <= 3.0.51; >= 0.1.1, <= 1.0.28 · CVE-2026-44167 · GHSA-3qpq-r242-jqj7
5 May 2026Evidence →
Medium, CVSS 6.15 May 2026
PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade
Go github.com/pocketbase/pocketbase · Upgrade to 0.37.4 or 0.22.42 by release line · < 0.22.42; >= 0.30.0, < 0.37.4 · CVE-2026-44166 · GHSA-pq7p-mc74-g65w
5 May 2026Evidence →
High, CVSS 7.55 May 2026
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
PyPI changedetection-io · Upgrade to 0.55.1 or later · <= 0.54.10 · CVE-2026-43891 · GHSA-8757-69j2-hx56 · amended
5 May 2026Evidence →
High, CVSS 8.15 May 2026
@evomap/evolver's validator sandbox allowlist permits npm/npx, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
npm @evomap/evolver · Upgrade to 1.70.0-beta.5 (pre-release) or later · <= 1.70.0-beta.4 · GHSA-jxh8-jh77-xh6g · amended
5 May 2026Evidence →
Medium, CVSS 6.25 May 2026
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
npm @evomap/evolver · Upgrade to 1.70.0-beta.5 (pre-release) or later · <= 1.70.0-beta.4 · GHSA-7xp7-m392-h92c · amended
5 May 2026Evidence →
High, CVSS 8.85 May 2026
@evomap/evolver: Path Traversal in evolver fetch default-branch safeId allows Hub-controlled overwrite of project files (RCE)
npm @evomap/evolver · Upgrade to 1.70.0-beta.5 (pre-release) or later · <= 1.70.0-beta.4 · GHSA-cfcj-hqpf-hccf · amended
5 May 2026Evidence →
Medium, CVSS 6.55 May 2026
PyLoad Vulnerable to Path Traversal via Package Folder Name
PyPI pyload-ng · Upgrade to 0.5.0b3.dev100 (pre-release) or later · <= 0.5.0b3.dev79 · CVE-2026-42314 · GHSA-97r3-5w84-r4q8 · amended
5 May 2026Evidence →
High, CVSS 7.55 May 2026
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
PyPI twisted · Upgrade to 26.4.0rc2 (pre-release) or later · <= 25.5.0 · CVE-2026-42304 · GHSA-grgv-6hw6-v9g4 · amended
5 May 2026Evidence →
Medium, CVSS 6.15 May 2026
Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
PyPI ethyca-fides · Upgrade to 2.83.2 or later · >= 2.75.0, < 2.83.2 · CVE-2026-42303 · GHSA-qx5f-ghc2-7g5c · amended
5 May 2026Evidence →
Critical, CVSS 9.35 May 2026
DevGuard has an unauthenticated identity assertion via X-Admin-Token header
Go github.com/l3montree-dev/devguard · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2026-42300 · GHSA-2g9v-7mr5-fgjg
5 May 2026Evidence →
High, CVSS 7.55 May 2026
GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
Go github.com/osrg/gobgp/v4 · Upgrade to 4.5.0 or later · >= 4.4.0, <= 4.4.0 · CVE-2026-42285 · GHSA-p3w2-64xm-833j
5 May 2026Evidence →
Critical, CVSS 9.25 May 2026
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
npm magicmirror · Upgrade to 2.36.0 or later · <= 2.35.0 · CVE-2026-42281 · GHSA-ph6f-2cvq-79hq · amended
5 May 2026Evidence →
Medium, CVSS 5.45 May 2026
Kimai vulnerable to formula Injection via tag names in XLSX export
Packagist kimai/kimai · Upgrade to 2.54.0 or later · >= 2.27.0, <= 2.53.0 · CVE-2026-42267 · GHSA-3xc2-h5r3-wv3r
5 May 2026Evidence →
High, CVSS 8.85 May 2026
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
PyPI jupyterlab · Upgrade to 4.5.7 or later · >= 4.0.0, <= 4.5.6 · CVE-2026-42266 · GHSA-37w4-hwhx-4rc4 · amended
5 May 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in stylelint-standard (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in em-owa-walletconnect-sign-client (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in jsconvict (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v811 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v647 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

Grav has Insecure Deserialization in File Cache

Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass

Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

Grav CMS vulnerable to stored XSS via Markdown media attribute() action

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

Grav API Privilege Escalation to Super Admin

PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data

phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

changedetection.io has an Arbitrary Local File Read via a crafted backup restore

@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts

@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS

@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)

PyLoad Vulnerable to Path Traversal via Package Folder Name

Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

Kimai vulnerable to formula Injection via tag names in XLSX export

JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence