Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

826–850 of 14,167 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 7.122 Sep 2026
Spree: Broken Access Control in PATCH /api/v3/store/carts/:id/associate (IDOR)
RubyGems spree_api · Upgrade to 5.5.4 or 5.4.4 by release line · >= 5.4.0, < 5.4.4; >= 5.5.0, < 5.5.4 · CVE-2026-94462 · GHSA-4825-p4xm-pcf2 · amended
22 Sep 2026Evidence →
High, CVSS 7.122 Sep 2026
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
PyPI lightrag-hku · Upgrade to 1.5.5 or later · < 1.5.5 · CVE-2026-85740 · GHSA-vv3m-f8x4-7377 · amended
22 Sep 2026Evidence →
Critical, CVSS 9.122 Sep 2026
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
PyPI lightrag-hku · Upgrade to 1.5.5 or later · < 1.5.5 · CVE-2026-85734 · GHSA-frch-4w6v-q5xx · amended
22 Sep 2026Evidence →
High, CVSS 8.122 Sep 2026
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
Go github.com/tinyauthapp/tinyauth · Upgrade to 1.0.1-0.20260720133915-80bc87188ec3 (pre-release) or later · < 1.0.1-0.20260720133915-80bc87188ec3 · CVE-2026-77560 · GHSA-328g-jx67-v94g · amended
22 Sep 2026Evidence →
High, CVSS 8.822 Sep 2026
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.12.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62371 · GHSA-5jpj-293f-rhvj · amended
22 Sep 2026Evidence →
High, CVSS 8.122 Sep 2026
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.16.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62369 · GHSA-9vm9-pqxx-x83v · amended
22 Sep 2026Evidence →
Critical, CVSS 9.122 Sep 2026
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260713141742-763625a20721 (pre-release); some affected versions have no fix yet · < 0.0.0-20260713141742-763625a20721; >= 0.1.0, <= 1.1.5 · CVE-2026-63132 · GHSA-34fc-gh42-pj53 · amended
22 Sep 2026Evidence →
High, CVSS 7.522 Sep 2026
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
Go github.com/openbao/openbao · Upgrade to 0.0.0-20260710001938-2d4ebafec5c5 (pre-release); some affected versions have no fix yet · < 0.0.0-20260710001938-2d4ebafec5c5; >= 0.1.0, <= 1.1.5 · CVE-2026-71543 · GHSA-59w7-v8rr-pr4p · amended
22 Sep 2026Evidence →
High, CVSS 8.822 Sep 2026
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
Go github.com/kubeedge/kubeedge · Upgrade to 1.23.1, 1.22.2 or 1.21.2 by release line · >= 1.21.0, < 1.21.2; >= 1.22.0, < 1.22.2; >= 1.23.0, < 1.23.1 · CVE-2026-62182 · GHSA-m3c6-2p7h-cfr3 · amended
22 Sep 2026Evidence →
High, CVSS 7.122 Sep 2026
Unleash: Missing await on permission check + cross-project IDOR in admin API
npm unleash-server · Upgrade to 8.0.3 or later · < 8.0.3 · CVE-2026-77426 · GHSA-72h8-wp98-7hch · amended
22 Sep 2026Evidence →
High, CVSS 7.722 Sep 2026
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77258 · GHSA-93xw-j965-9mx3 · amended
22 Sep 2026Evidence →
Critical, CVSS 10.022 Sep 2026
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77244 · GHSA-wrhw-j3f9-8vc6 · amended
22 Sep 2026Evidence →
High, CVSS 8.822 Sep 2026
MCP Atlassian: SSRF Protection Bypass
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77274 · GHSA-hgcf-4mq8-5266 · amended
22 Sep 2026Evidence →
High, CVSS 8.322 Sep 2026
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77271 · GHSA-6vmq-24h2-pj7j · amended
22 Sep 2026Evidence →
High, CVSS 8.322 Sep 2026
mcp-atlassian has an incomplete SSRF remediation
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77267 · GHSA-5wf4-jqxh-8gm3 · amended
22 Sep 2026Evidence →
High, CVSS 8.622 Sep 2026
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77262 · GHSA-p6hp-93wp-fh6p · amended
22 Sep 2026Evidence →
High, CVSS 7.722 Sep 2026
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77259 · GHSA-6cr4-ccf3-x7h4 · amended
22 Sep 2026Evidence →
High, CVSS 7.122 Sep 2026
MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77261 · GHSA-6529-c226-h328 · amended
22 Sep 2026Evidence →
High, CVSS 8.322 Sep 2026
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77260 · GHSA-f4p7-qx46-wc5j · amended
22 Sep 2026Evidence →
High, CVSS 8.322 Sep 2026
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77257 · GHSA-mrq8-fv7v-hhjg · amended
22 Sep 2026Evidence →
High, CVSS 8.822 Sep 2026
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77243 · GHSA-3r68-hf9h-887v · amended
22 Sep 2026Evidence →
High, CVSS 8.622 Sep 2026
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77255 · GHSA-2xj6-xx86-cwwc · amended
22 Sep 2026Evidence →
High, CVSS 7.122 Sep 2026
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77253 · GHSA-vc25-24vv-fxxm · amended
22 Sep 2026Evidence →
High, CVSS 8.322 Sep 2026
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77251 · GHSA-w66g-j6c4-hcfc · amended
22 Sep 2026Evidence →
High, CVSS 7.422 Sep 2026
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
PyPI mcp-atlassian · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2026-77246 · GHSA-wv8v-v4c5-v75j · amended
22 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence