Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
Critical: 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

7426–7450 of 31,057 matching · newest first

ExploitedClear filters

Medium, CVSS 5.923 Apr 2026
OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads
NuGet opentelemetry.resources.aws · Upgrade to 1.15.1 or later · < 1.15.1 · +1 more package · CVE-2026-41173 · GHSA-28xm-prxc-5866
23 Apr 2026Evidence →
Medium, CVSS 5.323 Apr 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
NuGet opentelemetry.extensions.propagators +1 · Upgrade all 2 to 1.15.3 or later · >= 1.3.1, < 1.15.3 · CVE-2026-40894 · GHSA-g94r-2vxg-569j
23 Apr 2026Evidence →
Medium, CVSS 5.323 Apr 2026
OpenTelemetry dotnet: Unbounded grpc-status-details-bin parsing in OTLP/gRPC retry handling
NuGet opentelemetry.exporter.opentelemetryprotocol · Upgrade to 1.15.3 or later · >= 1.13.1, < 1.15.3 · CVE-2026-40891 · GHSA-mr8r-92fq-pj8p
23 Apr 2026Evidence →
High, CVSS 7.723 Apr 2026
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller
Go github.com/argoproj/argo-workflows/v4 · Upgrade to 4.0.5 or later · >= 4.0.0, < 4.0.5 · +1 more package · CVE-2026-40886 · GHSA-5jv8-h7qh-rf5p
23 Apr 2026Evidence →
Medium, CVSS 5.323 Apr 2026
OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies
NuGet opentelemetry.exporter.opentelemetryprotocol · Upgrade to 1.15.2 or later · >= 1.13.1, < 1.15.2 · CVE-2026-40182 · GHSA-q834-8qmm-v933
23 Apr 2026Evidence →
Medium, CVSS 5.323 Apr 2026
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
Packagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · < 4.9.0; >= 5.0.0, < 5.4.0 · CVE-2026-40099 · GHSA-w942-j9r6-hr6r
23 Apr 2026Evidence →
High, CVSS 7.123 Apr 2026
Apktool: Path Traversal to Arbitrary File Write
Maven org.apktool:apktool-lib · Upgrade to 3.0.2 or later · >= 3.0.0, < 3.0.2 · CVE-2026-39973 · GHSA-m8mh-x359-vm8m
23 Apr 2026Evidence →
High, CVSS 7.623 Apr 2026
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Packagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · < 4.9.0; >= 5.0.0, < 5.4.0 · CVE-2026-34587 · GHSA-jcjw-58rv-c452
23 Apr 2026Evidence →
High, CVSS 8.823 Apr 2026
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
npm @actual-app/sync-server · Upgrade to 26.4.0 or later · < 26.4.0 · CVE-2026-33318 · GHSA-prp4-2f49-fcgp · amended
23 Apr 2026Evidence →
Medium, CVSS 5.323 Apr 2026
go-ntlmssp NTLM challenges can panic on malformed payloads
Go github.com/Azure/go-ntlmssp · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-32952 · GHSA-pjcq-xvwq-hhpj
23 Apr 2026Evidence →
Medium, CVSS 6.923 Apr 2026
Kirby has XML injection in its XML creator toolkit
Packagist getkirby/cms · Upgrade to 5.4.0 or 4.9.0 by release line · < 4.9.0; >= 5.0.0, < 5.4.0 · CVE-2026-32870 · GHSA-9wfj-c55w-j9qr
23 Apr 2026Evidence →
Critical, CVSS 9.823 Apr 2026
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
PyPI pipecat-ai · Upgrade to 0.0.94 or later · >= 0.0.41, < 0.0.94 · CVE-2025-62373 · GHSA-c2jg-5cp7-6wc7 · amended
23 Apr 2026Evidence →
Critical, CVSS 9.823 Apr 2026
ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function
Go heckel.io/ntfy/v2 · Upgrade to 2.22.0 or later · < 2.22.0 · CVE-2026-39087 · GHSA-pqhx-w72w-m393
23 Apr 2026Evidence →
Critical, CVSS 9.123 Apr 2026
Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege
NuGet microsoft.aspnetcore.dataprotection · Upgrade to 10.0.7 or later · >= 10.0.0, <= 10.0.6 · CVE-2026-40372 · GHSA-9mv3-2cwr-p262
23 Apr 2026Evidence →
Medium, CVSS 5.323 Apr 2026
Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed
npm @astrojs/node · Upgrade to 10.0.5 or later · < 10.0.5 · CVE-2026-41322 · GHSA-c57f-mm3j-27q9 · amended
23 Apr 2026Evidence →
Medium, CVSS 5.323 Apr 2026
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
npm n8n-mcp · Upgrade to 2.47.11 or later · < 2.47.11 · CVE-2026-41495 · GHSA-pfm2-2mhg-8wpx · amended
23 Apr 2026Evidence →
Medium, CVSS 5.923 Apr 2026
H2O-3 is Vulnerable to Code Injection
PyPI h2o +1 · Upgrade all 2 to 3.46.0.10 or later · < 3.46.0.10 · CVE-2026-3960 · GHSA-qmcv-hh7c-3m56 · amended
23 Apr 2026Evidence →
Medium, CVSS 4.622 Apr 2026
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
PyPI openc3 +1 · Upgrade all 2 to 7.0.0 or later · < 7.0.0 · CVE-2026-42086 · GHSA-ffq5-qpvf-xq7x · amended
22 Apr 2026Evidence →
Medium, CVSS 6.222 Apr 2026
OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle
NuGet openmcdf · Upgrade to 3.1.3 or later · < 3.1.3 · CVE-2026-41511 · GHSA-jxpf-xq2m-q525
22 Apr 2026Evidence →
High, CVSS 8.122 Apr 2026
Evolver: Path Traversal via --out flag in fetch command allows Arbitrary File Write
npm @evomap/evolver · Upgrade to 1.69.3 or later · < 1.69.3 · CVE-2026-42075 · GHSA-r466-rxw4-3j9j · amended
22 Apr 2026Evidence →
Critical, CVSS 9.822 Apr 2026
Evolver: Command Injection via execSync in _extractLLM() function allows Remote Code Execution
npm @evomap/evolver · Upgrade to 1.69.3 or later · < 1.69.3 · CVE-2026-42076 · GHSA-j5w5-568x-rq53 · amended
22 Apr 2026Evidence →
Medium, CVSS 5.222 Apr 2026
Evolver has Prototype Pollution via Object.assign() in its mailbox store operations
npm @evomap/evolver · Upgrade to 1.69.3 or later · < 1.69.3 · CVE-2026-42077 · GHSA-2cjr-5v3h-v2w4 · amended
22 Apr 2026Evidence →
Critical, CVSS 9.822 Apr 2026
NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access
Go github.com/orneryd/nornicdb · Upgrade to 1.0.42-hotfix (pre-release) or later · < 1.0.42-hotfix · CVE-2026-42072 · GHSA-2hp7-65r3-wv54
22 Apr 2026Evidence →
Medium, CVSS 6.022 Apr 2026
justhtml has sanitization bypass in custom policies and programmatic DOM
PyPI justhtml · Upgrade to 1.17.0 or later · < 1.17.0 · CVE-2026-6827 · GHSA-vrx2-77f2-ww34 · amended
22 Apr 2026Evidence →
High, CVSS 7.222 Apr 2026
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
crates.io openssl · Upgrade to 0.10.78 or later · >= 0.9.27, < 0.10.78 · CVE-2026-41676 · GHSA-pqf5-4pqq-29f5 · amended
22 Apr 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in zread_cli (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

Apktool: Path Traversal to Arbitrary File Write

Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

go-ntlmssp NTLM challenges can panic on malformed payloads

Kirby has XML injection in its XML creator toolkit

Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed

n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

H2O-3 is Vulnerable to Code Injection

OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender

OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

justhtml has sanitization bypass in custom policies and programmatic DOM

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence