Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
Critical: 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

7601–7625 of 14,180 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 7.519 Jan 2024
Vite dev server option server.fs.deny can be bypassed when hosted on case-insensitive filesystem
npm vite · Upgrade to 5.0.12, 4.5.2, 3.2.8 or 2.9.17 by release line · >= 2.7.0, <= 2.9.16; >= 3.0.0, <= 3.2.7; >= 4.0.0, <= 4.5.1; >= 5.0.0, <= 5.0.11 · CVE-2024-23331 · GHSA-c24v-8rfc-w8vw · amended
19 Jan 2024Evidence →
Critical, CVSS 9.319 Jan 2024
Arbitrary Code Execution in Pillow
PyPI pillow · Upgrade to 10.2.0 or later · < 10.2.0 · CVE-2023-50447 · GHSA-3f63-hfp8-52jq · amended
19 Jan 2024Evidence →
High, CVSS 7.519 Jan 2024
SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
crates.io surrealdb · Upgrade to 1.1.0 or later · < 1.1.0 · GHSA-58j9-j2fj-v8f4
19 Jan 2024Evidence →
High, CVSS 7.619 Jan 2024
JupyterLab vulnerable to potential authentication and CSRF tokens leak
PyPI jupyterlab · Upgrade to 4.0.11 or 3.6.7 by release line · >= 4.0.0, <= 4.0.10; <= 3.6.6 · +1 more package · CVE-2024-22421 · GHSA-44cc-43rp-5947 · amended
19 Jan 2024Evidence →
High, CVSS 7.319 Jan 2024
concat built-in can corrupt memory in vyper
PyPI vyper · Upgrade to 0.4.0 or later · >= 0.3.0, <= 0.3.10 · CVE-2024-22419 · GHSA-2q8v-3gqq-4f8p · amended
19 Jan 2024Evidence →
Critical, CVSS 9.419 Jan 2024
Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
PyPI pyload-ng · Upgrade to 0.5.0b3.dev78 (pre-release) or later · < 0.5.0b3.dev78 · CVE-2024-22416 · GHSA-pgpj-v85q-h5fm · amended
19 Jan 2024Evidence →
High, CVSS 7.519 Jan 2024
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
npm jsrsasign · Upgrade to 11.0.0 or later · < 11.0.0 · CVE-2024-21484 · GHSA-rh63-9qcf-83gf · amended
19 Jan 2024Evidence →
High, CVSS 7.318 Jan 2024
Unsecured endpoints in the jupyter-lsp server extension
PyPI jupyter-lsp · Upgrade to 2.2.2 or later · <= 2.2.1 · CVE-2024-22415 · GHSA-4qhp-652w-c22x · amended
18 Jan 2024Evidence →
High, CVSS 7.518 Jan 2024
Uncaught Exception processing HTTP Headers in SurrealDB
crates.io surrealdb · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2024-58368 · GHSA-m24x-r6q3-2vp9
18 Jan 2024Evidence →
High, CVSS 7.118 Jan 2024
Cross-Frame Scripting vulnerability has been found on Plone CMS
PyPI plone · Upgrade to 6.0.7 or later · <= 6.0.5 · CVE-2024-0669 · GHSA-5xfx-55x4-j223 · amended
18 Jan 2024Evidence →
Critical, CVSS 9.317 Jan 2024
Blind SQL injection in shopware
Packagist shopware/core +1 · Upgrade all 2 to 6.5.7.4 or later · <= 6.5.7.3 · CVE-2024-22406 · GHSA-qmp9-2xwj-m6m9
17 Jan 2024Evidence →
High, CVSS 7.316 Jan 2024
avo vulnerable to stored cross-site scripting (XSS) in key_value field
RubyGems avo · Upgrade to 3.2.4 or 2.47.0 by release line · >= 3.0.0.beta1, <= 3.2.3; <= 2.46.0 · CVE-2024-22191 · GHSA-ghjv-mh6x-7q6h
16 Jan 2024Evidence →
High, CVSS 8.115 Jan 2024
Remote Code Execution vulnerability in Apache IoTDB via UDF
PyPI apache-iotdb +1 · Upgrade all 2 to 1.3.0 or later · >= 1.0.0, < 1.3.0 · CVE-2023-46226 · GHSA-rxgg-273w-rfw7 · amended
15 Jan 2024Evidence →
Critical, CVSS 9.113 Jan 2024
EverShop at risk to unauthorized access via weak HMAC secret
npm @evershop/evershop · Upgrade to 1.0.0-rc.9 (pre-release) or later · < 1.0.0-rc.9 · CVE-2023-46943 · GHSA-32r3-57hp-cgfw · amended
13 Jan 2024Evidence →
High, CVSS 7.513 Jan 2024
EverShop vulnerable to improper authorization in GraphQL endpoints
npm @evershop/evershop · Upgrade to 1.0.0-rc.9 (pre-release) or later · < 1.0.0-rc.9 · CVE-2023-46942 · GHSA-ggpm-9qfx-mhwg · amended
13 Jan 2024Evidence →
Critical, CVSS 9.012 Jan 2024
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
npm @clerk/nextjs · Upgrade to 4.29.3 or later · >= 4.7.0, < 4.29.3 · CVE-2024-22206 · GHSA-q6w5-jg5q-47vg · amended
12 Jan 2024Evidence →
High, CVSS 8.112 Jan 2024
Gentoo Portage missing PGP validation of executed code
PyPI portage · Upgrade to 3.0.47 or later · < 3.0.47 · CVE-2016-20021 · GHSA-pw5x-x5jw-ccmh · amended
12 Jan 2024Evidence →
Critical, CVSS 9.311 Jan 2024
Django Template Engine Vulnerable to XSS
Go github.com/gofiber/template/django/v3 · Upgrade to 3.1.9 or later · < 3.1.9 · CVE-2024-22199 · GHSA-4mq2-gc4j-cmw6
11 Jan 2024Evidence →
High, CVSS 7.111 Jan 2024
Authenticated (user role) arbitrary command execution by modifying start_cmd setting (GHSL-2023-268)
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20231219184941-827e76c46e63 (pre-release) or later · < 1.9.10-0.20231219184941-827e76c46e63 · CVE-2024-22198 · GHSA-8r25-68wm-jw35
11 Jan 2024Evidence →
High, CVSS 7.711 Jan 2024
Authenticated (user role) remote command execution by modifying nginx settings (GHSL-2023-269)
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20231219184941-827e76c46e63 (pre-release) or later · < 1.9.10-0.20231219184941-827e76c46e63 · CVE-2024-22197 · GHSA-pxmr-q2x3-9x9m
11 Jan 2024Evidence →
High, CVSS 7.011 Jan 2024
Authenticated (user role) SQL injection in OrderAndPaginate (GHSL-2023-270)
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec (pre-release) or later · < 1.9.10-0.20231219195202-ec93ab05a3ec · CVE-2024-22196 · GHSA-h374-mm57-879c
11 Jan 2024Evidence →
High, CVSS 8.610 Jan 2024
Untrusted search path under some conditions on Windows allows arbitrary code execution
PyPI gitpython · Upgrade to 3.1.41 or later · < 3.1.41 · CVE-2024-22190 · GHSA-2mqj-m65w-jghx · amended
10 Jan 2024Evidence →
Critical, CVSS 9.99 Jan 2024
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
PyPI aries-cloudagent · Upgrade to 0.11.0 or 0.10.5 by release line · >= 0.7.0, < 0.10.5; >= 0.11.0rc1, < 0.11.0 · CVE-2024-21669 · GHSA-97x9-59rv-q5pm · amended
9 Jan 2024Evidence →
High, CVSS 8.79 Jan 2024
Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass
NuGet system.data.sqlclient · Upgrade to 4.8.6 or later · < 4.8.6 · +1 more package · CVE-2024-0056 · GHSA-98g6-xh36-x2p7
9 Jan 2024Evidence →
High, CVSS 7.19 Jan 2024
Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability
NuGet microsoft.identitymodel.protocols.signedhttprequest · Upgrade to 7.1.2 or 6.34.0 by release line · < 6.34.0; >= 7.0.0-preview, < 7.1.2 · CVE-2024-21643 · GHSA-rv9j-c866-gp5h
9 Jan 2024Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in stylelint-standard (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in em-owa-walletconnect-sign-client (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in jsconvict (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v811 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in internallib_v647 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Arbitrary Code Execution in Pillow

SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface

JupyterLab vulnerable to potential authentication and CSRF tokens leak

concat built-in can corrupt memory in vyper

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Marvin Attack of RSA and RSAOAEP decryption in jsrsasign

Unsecured endpoints in the jupyter-lsp server extension

Uncaught Exception processing HTTP Headers in SurrealDB

Cross-Frame Scripting vulnerability has been found on Plone CMS

Blind SQL injection in shopware

avo vulnerable to stored cross-site scripting (XSS) in key_value field

Remote Code Execution vulnerability in Apache IoTDB via UDF

EverShop at risk to unauthorized access via weak HMAC secret

EverShop vulnerable to improper authorization in GraphQL endpoints

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Gentoo Portage missing PGP validation of executed code

Django Template Engine Vulnerable to XSS

Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

Untrusted search path under some conditions on Windows allows arbitrary code execution

Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence