Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

51–75 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 5.310 Nov 2026
Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
RubyGems activestorage · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; >= 8.0.0.beta1, < 8.0.5.2 · CVE-2026-126071 · GHSA-4v2w-w6g6-f8f8 · amended
10 Nov 2026Evidence →
High, CVSS 7.410 Nov 2026
Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
RubyGems actionpack · Upgrade to 8.1.4.1 or later · >= 8.1.0.beta1, < 8.1.4.1 · CVE-2026-126083 · GHSA-2gff-2mmg-m73p · amended
10 Nov 2026Evidence →
Medium, CVSS 4.210 Nov 2026
Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore
RubyGems actionpack · Upgrade to 8.1.4.1 or 8.0.5.2 by release line · >= 8.1.0.beta1, < 8.1.4.1; < 8.0.5.2 · CVE-2026-126076 · GHSA-2586-8ghr-69fj · amended
10 Nov 2026Evidence →
Low, CVSS 3.710 Nov 2026
Forge: Ed25519 signature verification accepts small-order public keys
npm node-forge · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-125335 · GHSA-6889-vf6x-f3g5 · amended
10 Nov 2026Evidence →
Medium, CVSS 5.910 Nov 2026
Forge: TLS client crash on an unsupported ServerHello compression method
npm node-forge · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-125332 · GHSA-w4xr-hqv8-ch44 · amended
10 Nov 2026Evidence →
Medium, CVSS 5.910 Nov 2026
Forge: ReDoS in forge.http response header and cookie trimming
npm node-forge · Upgrade to 1.4.3 or later · >= 0.1.2, < 1.4.3 · CVE-2026-125333 · GHSA-6cv4-p8m7-4r25 · amended
10 Nov 2026Evidence →
Medium, CVSS 5.910 Nov 2026
Forge: TLS client crash on a handshake record received without a session
npm node-forge · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-125334 · GHSA-j8rw-jp99-435v · amended
10 Nov 2026Evidence →
Low, CVSS 3.710 Nov 2026
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
npm fast-xml-parser · Upgrade to 5.12.0 or later · < 5.12.0 · CVE-2026-126066 · GHSA-474x-hrwr-fgx4 · amended
10 Nov 2026Evidence →
Medium, CVSS 4.810 Nov 2026
Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125116 · GHSA-wr5m-5jph-8m96 · amended
10 Nov 2026Evidence →
High, CVSS 8.210 Nov 2026
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125117 · GHSA-8332-j7wj-wjw4 · amended
10 Nov 2026Evidence →
Low, CVSS 3.710 Nov 2026
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
RubyGems nokogiri · Upgrade to 1.19.5 or later · < 1.19.5 · CVE-2026-126062 · GHSA-v995-44v6-5fqm · amended
10 Nov 2026Evidence →
Low, CVSS 2.010 Nov 2026
Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value
RubyGems nokogiri · Upgrade to 1.19.5 or later · < 1.19.5 · CVE-2026-126064 · GHSA-3w22-6jfg-527w · amended
10 Nov 2026Evidence →
Low, CVSS 2.310 Nov 2026
Nokogiri: Mutation XSS through noscript content in Nokogiri's HTML5 serializer
RubyGems nokogiri · Upgrade to 1.19.5 or later · >= 1.12.0, < 1.19.5 · CVE-2026-126063 · GHSA-4p39-36wj-23h4 · amended
10 Nov 2026Evidence →
Medium, CVSS 6.510 Nov 2026
Mongoose: Prototype pollution via Schema.prototype.virtual()
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125118 · GHSA-6972-9mcm-vhwj · amended
10 Nov 2026Evidence →
High, CVSS 7.510 Nov 2026
Mongoose: Connection-level sanitizeFilter not applied
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · >= 6.0.0, < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125119 · GHSA-gg4r-jv3p-qx3c · amended
10 Nov 2026Evidence →
Critical, CVSS 9.810 Nov 2026
Mongoose: sanitizeFilter not applied on countDocuments
npm mongoose · Upgrade to 9.9.2, 8.24.3, 7.8.12 or 6.13.11 by release line · < 6.13.11; >= 7.0.0, < 7.8.12; >= 8.0.0, < 8.24.3; >= 9.0.0, < 9.9.2 · CVE-2026-125120 · GHSA-pcrw-h46h-c93h · amended
10 Nov 2026Evidence →
High, CVSS 8.710 Nov 2026
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
RubyGems rack · Upgrade to 3.2.8, 3.1.23 or 2.2.25 by release line · < 2.2.25; >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125111 · GHSA-5v64-555j-wjxm · amended
10 Nov 2026Evidence →
Low, CVSS 3.710 Nov 2026
Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
RubyGems rack · Upgrade to 3.2.8, 3.1.23 or 2.2.25 by release line · < 2.2.25; >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125108 · GHSA-p8x9-v4hv-2w4g · amended
10 Nov 2026Evidence →
Medium, CVSS 4.310 Nov 2026
NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
npm @nocobase/plugin-action-custom-request · Upgrade to 2.2.0-alpha.4 (pre-release) or 2.1.15 by release line · >= 2.1.0-alpha.8, < 2.1.15; >= 2.2.0-alpha.1, < 2.2.0-alpha.4 · CVE-2026-79914 · GHSA-wrr5-j383-f7h2 · amended
10 Nov 2026Evidence →
Medium, CVSS 4.810 Nov 2026
Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
RubyGems rack · Upgrade to 3.2.8 or 3.1.23 by release line · >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125109 · GHSA-2j8w-xcrc-x985 · amended
10 Nov 2026Evidence →
Medium, CVSS 5.310 Nov 2026
Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
RubyGems rack · Upgrade to 3.2.8, 3.1.23 or 2.2.25 by release line · < 2.2.25; >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125110 · GHSA-wvg4-6p58-3gh3 · amended
10 Nov 2026Evidence →
Medium, CVSS 5.310 Nov 2026
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
PyPI compose-lint · Upgrade to 0.32.0 or later · >= 0.31.0, < 0.32.0 · CVE-2026-125121 · GHSA-r7j4-crjv-h467 · amended
10 Nov 2026Evidence →
High, CVSS 8.810 Nov 2026
OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
npm @ohif/extension-dicom-pdf · Upgrade to 3.14.0-beta.36 (pre-release), 3.13.10 or 3.12.18 by release line · >= 3.5.0-beta.0, < 3.12.18; >= 3.13.0-beta.0, < 3.13.10; >= 3.14.0-beta.0, < 3.14.0-beta.36 · CVE-2026-118670 · GHSA-xwgp-w3pj-q5h3 · amended
10 Nov 2026Evidence →
Low, CVSS 3.710 Nov 2026
Forge: Certificate signature verified with the issuer's RSA signature scheme
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118774 · GHSA-9wg5-mj3p-v49q · amended
10 Nov 2026Evidence →
Low, CVSS 3.710 Nov 2026
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118776 · GHSA-2vgq-wchc-25w7 · amended
10 Nov 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence