Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

701–725 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 6.521 Oct 2026
Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file
npm @vitest/ui · Upgrade to 5.0.5 or later · >= 5.0.0-beta.6, < 5.0.5 · +2 more packages · CVE-2026-112948 · GHSA-p458-7748-mcp3 · amended
21 Oct 2026Evidence →
Medium, CVSS 4.721 Oct 2026
Vitest: Code injection via unauthenticated manual mock registration
npm @vitest/mocker · Upgrade to 5.0.3 or 4.1.12 by release line · >= 2.1.0-beta.7, < 4.1.12; >= 5.0.0-beta.1, < 5.0.3 · CVE-2026-112949 · GHSA-qxg6-89mg-rqv8 · amended
21 Oct 2026Evidence →
Medium, CVSS 5.921 Oct 2026
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
npm @vitest/mocker · Upgrade to 5.0.3 or 4.1.12 by release line · >= 4.1.11, < 4.1.12; >= 5.0.0-rc.2, < 5.0.3 · CVE-2026-112950 · GHSA-xp26-3454-mjgp · amended
21 Oct 2026Evidence →
Medium, CVSS 6.021 Oct 2026
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
npm @apostrophecms/import-export · Upgrade to 3.7.1 or later · < 3.7.1 · CVE-2026-112953 · GHSA-5gc8-frw3-3vqm · amended
21 Oct 2026Evidence →
Medium, CVSS 6.321 Oct 2026
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
npm openclaw · Upgrade to 2026.6.6 or later · < 2026.6.6 · CVE-2026-62197 · GHSA-3x84-qq85-fj65 · amended
21 Oct 2026Evidence →
Unrated21 Oct 2026
DRUPAL-CONTRIB-2026-229
Packagist drupal/sector · Upgrade to 10.4.2 or 10.3.3 by release line · < 10.3.3; >= 10.4.0, < 10.4.2 · CVE-2026-107260
21 Oct 2026Evidence →
Critical, CVSS 9.421 Oct 2026
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
npm storybook · Upgrade to 11.0.0-alpha.6 (pre-release), 10.6.2, 9.1.21 or 8.6.19 by release line · >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · +5 more packages · CVE-2026-114125 · GHSA-f2ph-cmg5-wxc8 · amended
21 Oct 2026Evidence →
Medium, CVSS 5.421 Oct 2026
Electron: HID and USB permission checks can be attributed to the wrong origin
npm electron · Upgrade to 45.0.0-alpha.5 (pre-release), 44.3.0, 43.7.0 or 42.11.3 by release line · >= 45.0.0-alpha.1, < 45.0.0-alpha.5; >= 44.0.0-alpha.1, < 44.3.0; >= 43.0.0-alpha.1, < 43.7.0; < 42.11.3 · CVE-2026-113800 · GHSA-fw47-9c62-h3vw · amended
21 Oct 2026Evidence →
Low, CVSS 3.321 Oct 2026
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
PyPI djust · Upgrade to 1.3.0rc8 (pre-release), 1.2.4, 1.1.7 or 1.0.10 by release line · >= 0.9.0, <= 1.0.9; >= 1.1.0, <= 1.1.6; >= 1.2.0.dev0, <= 1.2.3; >= 1.3.0.dev0, <= 1.3.0rc7 · CVE-2026-113731 · GHSA-r57g-mc79-8hj2
21 Oct 2026Evidence →
Medium, CVSS 4.321 Oct 2026
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
npm apostrophe · Upgrade to 4.34.0 or later · < 4.34.0 · CVE-2026-112952 · GHSA-f66c-mpj2-3r8h · amended
21 Oct 2026Evidence →
Medium, CVSS 4.321 Oct 2026
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
npm apostrophe · Upgrade to 4.34.0 or later · < 4.34.0 · CVE-2026-112957 · GHSA-vh56-5m88-39rq · amended
21 Oct 2026Evidence →
Medium, CVSS 5.421 Oct 2026
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
npm apostrophe · Upgrade to 4.34.0 or later · < 4.34.0 · CVE-2026-112958 · GHSA-7jg5-frgc-c67w · amended
21 Oct 2026Evidence →
Low, CVSS 3.121 Oct 2026
ApostropheCMS: Missing Authentication in cleanExport Route
npm @apostrophecms/import-export · Upgrade to 3.7.1 or later · < 3.7.1 · CVE-2026-113648 · GHSA-rw26-wwfc-9wvm · amended
21 Oct 2026Evidence →
Medium, CVSS 5.321 Oct 2026
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
npm apostrophe · Upgrade to 4.34.0 or later · < 4.34.0 · CVE-2026-112954 · GHSA-rqgm-cfrp-4hx8 · amended
21 Oct 2026Evidence →
Medium, CVSS 5.421 Oct 2026
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
npm apostrophe · Upgrade to 4.34.0 or later · < 4.34.0 · CVE-2026-112951 · GHSA-vmgj-9cwm-cf3h · amended
21 Oct 2026Evidence →
Medium, CVSS 5.321 Oct 2026
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
npm sanitize-html · Upgrade to 2.18.1 or later · >= 2.18.0, < 2.18.1 · CVE-2026-113650 · GHSA-c9rx-x947-fp3h · amended
21 Oct 2026Evidence →
Medium, CVSS 6.521 Oct 2026
ApostropheCMS: Import API bypasses publication roles for protected content
npm @apostrophecms/import-export · Upgrade to 3.7.1 or later · < 3.7.1 · +1 more package · CVE-2026-113649 · GHSA-5m22-7pfq-vp65 · amended
21 Oct 2026Evidence →
Medium, CVSS 6.521 Oct 2026
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
npm @apostrophecms/import-export · Upgrade to 3.7.1 or later · < 3.7.1 · CVE-2026-112956 · GHSA-jf5h-36mg-rp6x · amended
21 Oct 2026Evidence →
Medium, CVSS 6.521 Oct 2026
ApostropheCMS: Import archives can exhaust server storage and deny service
npm @apostrophecms/import-export · Upgrade to 3.7.1 or later · < 3.7.1 · CVE-2026-112955 · GHSA-9g7p-m758-rp72 · amended
21 Oct 2026Evidence →
Medium, CVSS 6.021 Oct 2026
pypdf: Possible infinite loop in PdfWriter.find_outline_item
PyPI pypdf · Upgrade to 6.20.1 or later · < 6.20.1 · CVE-2026-113792 · GHSA-qfv9-64jg-mh7p · amended
21 Oct 2026Evidence →
Medium, CVSS 6.021 Oct 2026
pypdf: Possible infinite loop when removing tree items
PyPI pypdf · Upgrade to 6.20.1 or later · < 6.20.1 · CVE-2026-113793 · GHSA-9mx8-4j7g-633p · amended
21 Oct 2026Evidence →
Medium, CVSS 6.021 Oct 2026
pypdf: Possible infinite loop when hitting EOF in standard xref table
PyPI pypdf · Upgrade to 6.20.0 or later · < 6.20.0 · CVE-2026-113794 · GHSA-39mj-jf6j-2qj3 · amended
21 Oct 2026Evidence →
High, CVSS 7.821 Oct 2026
virtualenv bash activate runs commands from an environment name with a backslash before $
PyPI virtualenv +1 · Upgrade all 2 to 21.14.7 or later · < 21.14.7 · CVE-2026-113725 · GHSA-vxj4-q4g9-crj7 · amended
21 Oct 2026Evidence →
Medium, CVSS 6.021 Oct 2026
pypdf: Possible large memory usage for streams with multiple filters
PyPI pypdf · Upgrade to 6.20.0 or later · < 6.20.0 · CVE-2026-113795 · GHSA-7mh2-4gg2-979f · amended
21 Oct 2026Evidence →
Low, CVSS 2.121 Oct 2026
Vite: Cross origin script execution through Vite custom middleware
npm vite · Upgrade to 8.3.3, 8.2.4, 8.1.6 or 2 more by release line · >= 8.3.0, <= 8.3.2; >= 8.2.0, <= 8.2.3; >= 8.0.0, <= 8.1.5; >= 7.0.0, <= 7.3.6; <= 6.4.3 · +1 more package · CVE-2026-112945 · GHSA-9jrq-w75r-8gcw · amended
21 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest: Code injection via unauthenticated manual mock registration

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

DRUPAL-CONTRIB-2026-229

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Electron: HID and USB permission checks can be attributed to the wrong origin

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS: Import API bypasses publication roles for protected content

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

ApostropheCMS: Import archives can exhaust server storage and deny service

pypdf: Possible infinite loop in PdfWriter.find_outline_item

pypdf: Possible infinite loop when removing tree items

pypdf: Possible infinite loop when hitting EOF in standard xref table

virtualenv bash activate runs commands from an environment name with a backslash before $

pypdf: Possible large memory usage for streams with multiple filters

Vite: Cross origin script execution through Vite custom middleware

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence