Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
Critical: 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

7776–7800 of 31,057 matching · newest first

ExploitedClear filters

Unrated14 Apr 2026
Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 10.0.6, 9.0.15 or 8.0.26 by release line · >= 10.0.0, <= 10.0.5; >= 9.0.0, <= 9.0.14; >= 8.0.0, <= 8.0.25 · CVE-2026-32178 · GHSA-vmwf-m9c5-3jvc
14 Apr 2026Evidence →
Unrated14 Apr 2026
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
npm @novu/api · Upgrade to 3.15.0 or later · < 3.15.0 · CVE-2026-125114 · GHSA-4x48-cgf9-q33f · amended
14 Apr 2026Evidence →
High, CVSS 8.014 Apr 2026
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40944 · GHSA-7jrq-q4pq-rhm6
14 Apr 2026Evidence →
High, CVSS 8.714 Apr 2026
Oxia affected by server crash via race condition in session heartbeat handling
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40943 · GHSA-5gqc-qhrj-9xw8
14 Apr 2026Evidence →
Critical, CVSS 9.314 Apr 2026
Oxia has an OIDC token audience validation bypass via SkipClientIDCheck
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40946 · GHSA-fhvp-9hcj-6m33
14 Apr 2026Evidence →
High, CVSS 8.714 Apr 2026
Oxia exposes bearer token in debug log messages on authentication failure
Go github.com/oxia-db/oxia · Upgrade to 0.16.2 or later · <= 0.16.1 · CVE-2026-40945 · GHSA-pm7q-rjjx-979p
14 Apr 2026Evidence →
Medium, CVSS 5.414 Apr 2026
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
PyPI giskard-checks · Upgrade to 1.0.2b1 (pre-release) or later · <= 1.0.1b1 · CVE-2026-40320 · GHSA-7xjm-g8f4-rp26 · amended
14 Apr 2026Evidence →
Low, CVSS 1.014 Apr 2026
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
PyPI giskard-checks · Upgrade to 1.0.2b1 (pre-release) or later · <= 1.0.1b1 · CVE-2026-40319 · GHSA-rq2q-4r55-9877 · amended
14 Apr 2026Evidence →
Medium, CVSS 5.314 Apr 2026
SiYuan has incomplete fix for CVE-2026-33066: XSS
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260414013942-62eed37a3263 (pre-release) or later · < 0.0.0-20260414013942-62eed37a3263 · CVE-2026-40922 · GHSA-8q5w-mmxf-48jg
14 Apr 2026Evidence →
High, CVSS 7.514 Apr 2026
Go Markdown has an Out-of-bounds Read in SmartypantsRenderer
Go github.com/gomarkdown/markdown · Upgrade to 0.0.0-20260411013819-759bbc3e3207 (pre-release) or later · < 0.0.0-20260411013819-759bbc3e3207 · CVE-2026-40890 · GHSA-77fj-vx54-gvh7
14 Apr 2026Evidence →
Critical, CVSS 9.114 Apr 2026
@vendure/core has a SQL Injection vulnerability
npm @vendure/core · Upgrade to 3.6.2, 3.5.7 or 2.3.4 by release line · >= 3.0.0, < 3.5.7; >= 3.6.0, < 3.6.2; >= 1.7.4, < 2.3.4 · CVE-2026-40887 · GHSA-9pp3-53p2-ww9v · amended
14 Apr 2026Evidence →
High, CVSS 8.514 Apr 2026
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
Go github.com/kyverno/kyverno · Upgrade to 1.17.0 or later · >= 1.16.0, < 1.17.0 · CVE-2026-4789 · GHSA-rggm-jjmc-3394
14 Apr 2026Evidence →
Medium, CVSS 6.914 Apr 2026
XWiki's REST APIs can list all pages/spaces, leading to unavailability
Maven org.xwiki.platform:xwiki-platform-oldcore +1 · Upgrade all 2 to 17.10.1, 17.4.8 or 16.10.16 by release line · >= 1.8-rc-1, < 16.10.16; >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1 · CVE-2026-40104 · GHSA-mrqg-xmgm-rc5g
14 Apr 2026Evidence →
Medium, CVSS 6.514 Apr 2026
XWiki has Reflected Cross-Site Scripting (XSS) in page history compare
Maven org.xwiki.platform:xwiki-platform-web-templates · Upgrade to 17.10.1, 17.4.8 or 16.10.16 by release line · >= 10.4-rc-1, < 16.10.16; >= 17.0.0-rc-1, < 17.4.8; >= 17.5.0-rc-1, < 17.10.1 · CVE-2026-40105 · GHSA-w4fj-87j5-f25c
14 Apr 2026Evidence →
Medium, CVSS 6.014 Apr 2026
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
Go github.com/authzed/spicedb · Upgrade to 1.51.1 or later · >= 1.49.0, <= 1.51.0 · CVE-2026-40091 · GHSA-jf4f-rr2c-9m58
14 Apr 2026Evidence →
High, CVSS 7.114 Apr 2026
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
Go github.com/zarf-dev/zarf · Upgrade to 0.74.2 or later · >= 0.23.0, < 0.74.2 · CVE-2026-40090 · GHSA-pj97-4p9w-gx3q
14 Apr 2026Evidence →
High, CVSS 7.214 Apr 2026
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
Packagist s9y/serendipity · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2026-39971 · GHSA-458g-q4fh-mj6r
14 Apr 2026Evidence →
Medium, CVSS 6.914 Apr 2026
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php
Packagist s9y/serendipity · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2026-39963 · GHSA-4m6c-649p-f6gf
14 Apr 2026Evidence →
High, CVSS 8.314 Apr 2026
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
npm mcp-server-kubernetes · Upgrade to 3.5.0 or later · <= 3.4.0 · CVE-2026-39884 · GHSA-4xqg-gf5c-ghwq · amended
14 Apr 2026Evidence →
Critical, CVSS 9.914 Apr 2026
Expression Injection in OpenRemote
Maven io.openremote:openremote-manager · Upgrade to 1.22.0 or later · <= 1.21.0 · CVE-2026-39842 · GHSA-7mqr-33rv-p3mp
14 Apr 2026Evidence →
Low, CVSS 3.514 Apr 2026
OAuth2 Proxy's session cookies are not cleared when rendering sign-in page
Go github.com/oauth2-proxy/oauth2-proxy/v7 · Upgrade to 7.15.2 or later · >= 7.11.0, < 7.15.2 · CVE-2026-34454 · GHSA-f24x-5g9q-753f
14 Apr 2026Evidence →
Medium, CVSS 4.814 Apr 2026
October Rain has Stored XSS via SVG Filter Bypass
Packagist october/rain · Upgrade to 4.1.10 or 3.7.14 by release line · >= 4.0.0, <= 4.1.9; <= 3.7.13 · CVE-2026-25133 · GHSA-gcqv-f29m-67gr
14 Apr 2026Evidence →
Medium, CVSS 4.914 Apr 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
Packagist october/rain · Upgrade to 4.1.10 or 3.7.14 by release line · >= 4.0.0, <= 4.1.9; <= 3.7.13 · CVE-2026-25125 · GHSA-g6v3-wv4j-x9hg
14 Apr 2026Evidence →
High, CVSS 7.714 Apr 2026
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
Go github.com/patrickhener/goshs/v2 · Upgrade to 2.0.0-beta.6 (pre-release) or later · >= 2.0.0-beta.4, <= 2.0.0-beta.5 · CVE-2026-40885 · GHSA-7h3j-592v-jcrp
14 Apr 2026Evidence →
Medium, CVSS 6.114 Apr 2026
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Go github.com/patrickhener/goshs/v2 · Upgrade to 2.0.0-beta.6 (pre-release) or later · >= 2.0.0-beta.4, <= 2.0.0-beta.5 · CVE-2026-40883 · GHSA-jrq5-hg6x-j6g3
14 Apr 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in zread_cli (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence