Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

801–825 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 5.120 Oct 2026
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
npm @angular/platform-server · Upgrade to 22.2.1, 21.2.25 or 20.3.33 by release line; some affected versions have no fix yet · >= 22.0.0, < 22.2.1; >= 21.0.0, < 21.2.25; >= 20.0.0, < 20.3.33; <= 19.2.25 · CVE-2026-111754 · GHSA-w739-gvwx-grc3 · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
npm markdown-it · Upgrade to 15.0.2 or 14.3.2 by release line · >= 15.0.0, < 15.0.2; < 14.3.2 · CVE-2026-111759 · GHSA-r7fv-28h4-cvq7 · amended
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
Go github.com/klauspost/compress · Upgrade to 1.18.7 or later · <= 1.18.6 · CVE-2026-63209 · GHSA-259r-337f-4rfw · amended
20 Oct 2026Evidence →
High, CVSS 8.920 Oct 2026
Crass : Large numeric exponents cause CPU and memory denial of service
RubyGems crass · Upgrade to 1.0.7 or later · < 1.0.7 · CVE-2026-61845 · GHSA-6wmf-3r64-vcwv · amended
20 Oct 2026Evidence →
High, CVSS 7.020 Oct 2026
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
crates.io pingora-proxy · Upgrade to 0.9.0 or later · >= 0.0.0-0, < 0.9.0 · CVE-2026-105299 · GHSA-vx4q-2c55-cvmg
20 Oct 2026Evidence →
High, CVSS 7.520 Oct 2026
Unbounded tool schema cache in Streamable HTTP server transport
crates.io rmcp · Upgrade to 3.6.0 or later · >= 3.0.0, < 3.6.0 · GHSA-4432-vg92-fqh6
20 Oct 2026Evidence →
Medium, CVSS 6.320 Oct 2026
Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
crates.io pingora-core · Upgrade to 0.9.0 or later · >= 0.0.0-0, < 0.9.0 · CVE-2026-105298 · GHSA-mgg9-6xw2-jfgp
20 Oct 2026Evidence →
High, CVSS 8.720 Oct 2026
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
crates.io pingora-core · Upgrade to 0.8.1 or later · >= 0.0.0-0, < 0.8.1 · CVE-2026-105297 · GHSA-7gpj-mj4q-x62x
20 Oct 2026Evidence →
Unrated20 Oct 2026
TLS certificate hostname bypass when the host loosely resolves to an IP address
Bitnami node-min +2 · Upgrade all 3 to 26.12.1, 24.22.1 or 22.23.4 by release line · < 22.23.4; >= 23.0.0, < 24.22.1; >= 25.0.0, < 26.12.1 · CVE-2026-106069 · amended
20 Oct 2026Evidence →
Unrated20 Oct 2026
TLS certificate hostname bypass when the IP is written fullwidth digits
Bitnami node-min +2 · Upgrade all 3 to 26.12.1 or 24.22.1 by release line · >= 23.0.0, < 24.22.1; >= 25.0.0, < 26.12.1 · CVE-2026-105483 · amended
20 Oct 2026Evidence →
Unrated20 Oct 2026
Permission Model bypass with fs.realpathSync
Bitnami node-min +2 · Upgrade all 3 to 26.12.1, 24.22.1 or 22.23.4 by release line · < 22.23.4; >= 23.0.0, < 24.22.1; >= 25.0.0, < 26.12.1 · CVE-2026-106073 · amended
20 Oct 2026Evidence →
Unrated20 Oct 2026
Keep-alive socket process a response that was written before the request was sent
Bitnami node-min +2 · Upgrade all 3 to 26.12.1, 24.22.1 or 22.23.4 by release line · < 22.23.4; >= 23.0.0, < 24.22.1; >= 25.0.0, < 26.12.1 · CVE-2026-105481 · amended
20 Oct 2026Evidence →
Unrated20 Oct 2026
crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values
Bitnami node-min +2 · Upgrade all 3 to 26.12.1, 24.22.1 or 22.23.4 by release line · < 22.23.4; >= 23.0.0, < 24.22.1; >= 25.0.0, < 26.12.1 · CVE-2026-106074 · amended
20 Oct 2026Evidence →
Unrated20 Oct 2026
dns.resolve truncates names containing NUL char
Bitnami node-min +2 · Upgrade all 3 to 26.12.1, 24.22.1 or 22.23.4 by release line · < 22.23.4; >= 23.0.0, < 24.22.1; >= 25.0.0, < 26.12.1 · CVE-2026-105482 · amended
20 Oct 2026Evidence →
Unrated20 Oct 2026
Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
Bitnami node-min +2 · Upgrade all 3 to 26.12.1, 24.22.1 or 22.23.4 by release line · < 22.23.4; >= 23.0.0, < 24.22.1; >= 25.0.0, < 26.12.1 · CVE-2026-106072 · amended
20 Oct 2026Evidence →
High, CVSS 7.119 Oct 2026
Nginx UI: Casdoor SSO callback uses a constant state parameter (login CSRF)
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84312 · GHSA-44xr-mrhh-qm78 · amended
19 Oct 2026Evidence →
High, CVSS 8.819 Oct 2026
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84313 · GHSA-gfrc-g87h-7h5w · amended
19 Oct 2026Evidence →
High, CVSS 8.219 Oct 2026
aiohttp server lacks an initial request/header timeout
PyPI aiohttp · Upgrade to 3.14.4 or later · <= 3.14.3 · CVE-2026-111064 · GHSA-5wr8-gcqf-gqf3 · amended
19 Oct 2026Evidence →
Medium, CVSS 6.319 Oct 2026
AIOHTTP: Secure attribute not enforced for shared cookie
PyPI aiohttp · Upgrade to 3.14.4 or later · < 3.14.4 · CVE-2026-111063 · GHSA-494j-54xm-rwp3 · amended
19 Oct 2026Evidence →
High, CVSS 8.719 Oct 2026
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
PyPI aiohttp · Upgrade to 3.14.4 or later · < 3.14.4 · CVE-2026-123817 · GHSA-2g87-pp6c-29x5 · amended
19 Oct 2026Evidence →
Medium, CVSS 4.319 Oct 2026
russh: Unbounded memory allocation in agent protocol server via crafted constraint records
crates.io russh · Upgrade to 0.64.1 or later · <= 0.64.0 · CVE-2026-111061 · GHSA-4wc5-f2rc-q74m · amended
19 Oct 2026Evidence →
Low, CVSS 2.319 Oct 2026
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
crates.io russh · Upgrade to 0.64.0 or later · >= 0.34.0-beta.1, < 0.64.0 · CVE-2026-111062 · GHSA-j7h2-66j4-ghjf · amended
19 Oct 2026Evidence →
Medium, CVSS 6.119 Oct 2026
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
PyPI mercury · Upgrade to 3.2.11 or later · >= 3.0.0, < 3.2.11 · CVE-2026-111059 · GHSA-2658-85cv-9wwq · amended
19 Oct 2026Evidence →
Critical, CVSS 10.019 Oct 2026
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
PyPI mercury · Upgrade to 3.2.4 or later · >= 3.0.0, <= 3.2.3 · CVE-2026-111057 · GHSA-f8c7-rwf9-fmgm · amended
19 Oct 2026Evidence →
Medium, CVSS 6.819 Oct 2026
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
Go github.com/envoyproxy/ai-gateway · Upgrade to 1.2.0-rc1 (pre-release) or later · >= 0.4.0-rc1, < 1.2.0-rc1 · GHSA-953h-535j-jg2v · amended
19 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence