Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 963 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,112 in the 30 days before.
Critical: 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

7851–7875 of 31,057 matching · newest first

ExploitedClear filters

Medium, CVSS 5.313 Apr 2026
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
Go github.com/prometheus/prometheus · Upgrade to 3.11.2, 3.5.2 or 0.311.2-0.20260410083055-07c6232d159b (pre-release) by release line · >= 3.0.0, <= 3.5.1; >= 3.6.0, <= 3.11.1; < 0.311.2-0.20260410083055-07c6232d159b · CVE-2026-40179 · GHSA-vffh-x6r8-xx99
13 Apr 2026Evidence →
High, CVSS 8.813 Apr 2026
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Maven gov.nsa.emissary:emissary · Upgrade to 8.43.0 or later · < 8.43.0 · CVE-2026-35582 · GHSA-3p24-9x7v-7789 · amended
13 Apr 2026Evidence →
High, CVSS 7.113 Apr 2026
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
Go github.com/external-secrets/external-secrets · Upgrade to 1.3.3-0.20260331202714-6800989bdc12 (pre-release); some affected versions have no fix yet · < 1.3.3-0.20260331202714-6800989bdc12; >= 2.0.0, <= 2.2.0 · CVE-2026-34984 · GHSA-r2pg-r6h7-crf3
13 Apr 2026Evidence →
High, CVSS 8.113 Apr 2026
simple-git Affected by Command Execution via Option-Parsing Bypass
npm simple-git · Upgrade to 3.32.0 or later · < 3.32.0 · CVE-2026-28291 · GHSA-jcxm-m3jx-f287 · amended
13 Apr 2026Evidence →
High, CVSS 8.813 Apr 2026
Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
PyPI apache-airflow · Upgrade to 3.2.0 or later · >= 3.1.8, < 3.2.0 · CVE-2026-33858 · GHSA-mc4f-r875-v87w · amended
13 Apr 2026Evidence →
Medium, CVSS 5.313 Apr 2026
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
PyPI apache-airflow · Upgrade to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2025-66236 · GHSA-j86x-fwp2-qh7v · amended
13 Apr 2026Evidence →
High, CVSS 8.813 Apr 2026
Keras has an untrusted deserialization vulnerability
PyPI keras · Upgrade to 3.13.2 or later · < 3.13.2 · CVE-2026-1462 · GHSA-4f3f-g24h-fr8m · amended
13 Apr 2026Evidence →
High, CVSS 7.113 Apr 2026
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
Go github.com/apache/skywalking-mcp · Upgrade to 0.2.0 or later · < 0.2.0 · CVE-2026-34476 · GHSA-c4hg-6933-x62x
13 Apr 2026Evidence →
Medium, CVSS 5.413 Apr 2026
Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata
Maven org.apache.storm:storm-webapp · Upgrade to 2.8.6 or later · < 2.8.6 · CVE-2026-35565 · GHSA-f2hp-qw27-8wfq
13 Apr 2026Evidence →
High, CVSS 8.813 Apr 2026
Apache Storm: Deserialization of Untrusted Data vulnerability
Maven org.apache.storm:storm-client · Upgrade to 2.8.6 or later · < 2.8.6 · CVE-2026-35337 · GHSA-jf89-3q6q-vcgr
13 Apr 2026Evidence →
Critical, CVSS 9.313 Apr 2026
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability
PyPI google-adk · Upgrade to 2.0.0a2 (pre-release) or 1.28.1 by release line · >= 2.0.0a1, < 2.0.0a2; >= 1.7.0, < 1.28.1 · CVE-2026-4810 · GHSA-rg7c-g689-fr3x · amended
13 Apr 2026Evidence →
Low, CVSS 2.112 Apr 2026
Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression
Maven org.dromara.warm:warm-flow-plugin-modes-sb · Upgrade to 1.8.5 or later · < 1.8.5 · CVE-2026-6125 · GHSA-822v-8w6h-5jxp
12 Apr 2026Evidence →
Medium, CVSS 6.112 Apr 2026
PYSEC-2026-2200
PyPI lollms · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-1116
12 Apr 2026Evidence →
Critical, CVSS 10.010 Apr 2026
Daptin has Unauthenticated Path Traversal and Zip Slip
Go github.com/daptin/daptin · Upgrade to 0.12.0 or later · <= 0.11.3 · GHSA-9cp7-j3f8-p5jx
10 Apr 2026Evidence →
High, CVSS 8.810 Apr 2026
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
npm mathjs · Upgrade to 15.2.0 or later · >= 13.1.0, < 15.2.0 · CVE-2026-41139 · GHSA-jvff-x2qm-6286
10 Apr 2026Evidence →
Low, CVSS 2.310 Apr 2026
unhead: Streaming SSR streamKey injected into inline script without identifier validation
npm unhead · Upgrade to 3.0.1 or later · >= 3.0.0-beta.5, <= 3.0.0 · GHSA-x7mm-9vvv-64w8 · amended
10 Apr 2026Evidence →
Medium, CVSS 4.310 Apr 2026
rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration
PyPI rembg · Upgrade to 2.0.75 or later · < 2.0.75 · GHSA-55v6-g8pm-pw4c · amended
10 Apr 2026Evidence →
Medium, CVSS 6.310 Apr 2026
Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint
Go go.temporal.io/server · Upgrade to 1.30.4, 1.29.6 or 1.28.4 by release line · < 1.28.4; >= 1.29.0-135.0, < 1.29.6; >= 1.30.0-143.0, < 1.30.4 · CVE-2026-5724 · GHSA-q98v-9f9w-f49q
10 Apr 2026Evidence →
Critical, CVSS 10.010 Apr 2026
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
npm paperclipai +1 · Upgrade all 2 to 2026.410.0 or later · < 2026.410.0 · CVE-2026-41679 · GHSA-68qg-g8mg-6pr7 · amended
10 Apr 2026Evidence →
Medium, CVSS 4.710 Apr 2026
rhukster/dom-sanitizer: SVG tag allows CSS injection via unfiltered url() and @import directives
Packagist rhukster/dom-sanitizer · Upgrade to 1.0.10 or later · < 1.0.10 · CVE-2026-40301 · GHSA-93vf-569f-22cq
10 Apr 2026Evidence →
Medium, CVSS 6.910 Apr 2026
DNN: Same HostGUID for all new installs
NuGet dotnetnuke.core · Upgrade to 10.2.2 or later · >= 10.0.0, < 10.2.2 · CVE-2026-40306 · GHSA-2rhw-gw3f-477j
10 Apr 2026Evidence →
Medium, CVSS 4.310 Apr 2026
DNN: Force Friend Request Acceptance
NuGet dotnetnuke.core · Upgrade to 10.2.2 or later · >= 6.0.0, < 10.2.2 · CVE-2026-40305 · GHSA-fpj4-9qhx-5m6m
10 Apr 2026Evidence →
Medium, CVSS 6.910 Apr 2026
next-intl has an open redirect vulnerability
npm next-intl · Upgrade to 4.9.1 or later · < 4.9.1 · CVE-2026-40299 · GHSA-8f24-v5vv-gm5j · amended
10 Apr 2026Evidence →
Medium, CVSS 6.110 Apr 2026
Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence
Go github.com/juju/juju · Upgrade to 0.0.0-20260408003526-d395054dc2c3 (pre-release) or later · < 0.0.0-20260408003526-d395054dc2c3 · CVE-2026-5774 · GHSA-7m55-2hr4-pw78
10 Apr 2026Evidence →
Critical, CVSS 9.910 Apr 2026
Juju: CloudSpec method leaking cloud credentials
Go github.com/juju/juju · Upgrade to 0.0.0-20260408003526-d395054dc2c3 (pre-release) or later · < 0.0.0-20260408003526-d395054dc2c3 · CVE-2026-5412 · GHSA-w5fq-8965-c969
10 Apr 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in zread_cli (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

simple-git Affected by Command Execution via Option-Parsing Bypass

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (type/var) Bypass in XCom API

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Keras has an untrusted deserialization vulnerability

Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server

Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata

Apache Storm: Deserialization of Untrusted Data vulnerability

Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability

Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression

PYSEC-2026-2200

Daptin has Unauthenticated Path Traversal and Zip Slip

mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration

Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

rhukster/dom-sanitizer: SVG tag allows CSS injection via unfiltered url() and @import directives

DNN: Same HostGUID for all new installs

DNN: Force Friend Request Acceptance

next-intl has an open redirect vulnerability

Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence

Juju: CloudSpec method leaking cloud credentials

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence