Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
Critical: 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

8876–8900 of 31,057 matching · newest first

ExploitedClear filters

High, CVSS 8.223 Mar 2026
Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · <= 1.41.0; >= 2.0.0, <= 2.41.0 · CVE-2026-32278 · GHSA-mv3p-7p89-wq9p
23 Mar 2026Evidence →
High, CVSS 8.723 Mar 2026
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · >= 1.35.0, < 1.41.1; >= 2.35.0, < 2.41.1 · CVE-2026-32277 · GHSA-cmfh-mpmf-fmq4
23 Mar 2026Evidence →
High, CVSS 8.823 Mar 2026
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
Packagist opensource-workshop/connect-cms · Upgrade to 2.41.1 or 1.41.1 by release line · < 1.41.1; >= 2.0.0, < 2.41.1 · CVE-2026-32276 · GHSA-hxqw-6qv7-cqfv
23 Mar 2026Evidence →
Medium, CVSS 6.523 Mar 2026
New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
Go github.com/QuantumNous/new-api · Upgrade to 0.11.4-alpha.2 (pre-release) or later · < 0.11.4-alpha.2 · CVE-2026-30886 · GHSA-f35r-v9x5-r8mc
23 Mar 2026Evidence →
Critical, CVSS 9.323 Mar 2026
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
Packagist mantisbt/mantisbt · Upgrade to 2.28.1 or later · < 2.28.1 · CVE-2026-30849 · GHSA-phrq-pc6r-f6gh
23 Mar 2026Evidence →
Medium, CVSS 5.523 Mar 2026
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
Packagist putyourlightson/craft-sprig · Upgrade to 3.7.2 or 2.15.2 by release line · >= 2.0.0, < 2.15.2; >= 3.0.0, < 3.7.2 · CVE-2026-27131 · GHSA-m59h-42jf-cphr
23 Mar 2026Evidence →
High, CVSS 7.523 Mar 2026
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
PyPI cbor2 · Upgrade to 5.9.0 or later · <= 5.8.0 · CVE-2026-26209 · GHSA-3c37-wwvx-h642 · amended
23 Mar 2026Evidence →
Low, CVSS 3.723 Mar 2026
Keycloak's identity-first login flow exposes user information
Maven org.keycloak:keycloak-services · Upgrade to 26.6.1 or 26.4.12 by release line · >= 26.5.0, < 26.6.1; < 26.4.12 · CVE-2026-4633 · GHSA-rhgq-f8x5-j2jc · amended
23 Mar 2026Evidence →
High, CVSS 8.823 Mar 2026
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4601 · GHSA-w8q8-93cx-6h7r · amended
23 Mar 2026Evidence →
High, CVSS 8.123 Mar 2026
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4600 · GHSA-wvqx-v3f6-w8rh · amended
23 Mar 2026Evidence →
Low, CVSS 2.023 Mar 2026
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4603 · GHSA-464q-cqxq-xhgr · amended
23 Mar 2026Evidence →
High, CVSS 7.723 Mar 2026
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4598 · GHSA-8g7p-jf3g-gxcp · amended
23 Mar 2026Evidence →
Critical, CVSS 9.323 Mar 2026
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
npm jsrsasign · Upgrade to 11.1.1 or later · >= 7.0.0, < 11.1.1 · CVE-2026-4599 · GHSA-5jx8-q4cp-rhh6 · amended
23 Mar 2026Evidence →
High, CVSS 7.723 Mar 2026
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
npm jsrsasign · Upgrade to 11.1.1 or later · < 11.1.1 · CVE-2026-4602 · GHSA-8qwj-4jxw-m8jw · amended
23 Mar 2026Evidence →
Low, CVSS 1.922 Mar 2026
Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
PyPI pygments · Upgrade to 2.20.0 or later · < 2.20.0 · CVE-2026-4539 · GHSA-5239-wwwm-4pmq · amended
22 Mar 2026Evidence →
Medium, CVSS 6.922 Mar 2026
Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function
Go github.com/free5gc/amf · Upgrade to 1.4.3-0.20260306074636-52e9386401ce (pre-release) or later · < 1.4.3-0.20260306074636-52e9386401ce · CVE-2026-4531 · GHSA-xq44-64rg-8g3h
22 Mar 2026Evidence →
Medium, CVSS 6.521 Mar 2026
NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter
Go github.com/kubernetes-csi/csi-driver-nfs · Upgrade to 0.0.0-20260210055231-316af2d86b91 (pre-release) or later · < 0.0.0-20260210055231-316af2d86b91 · CVE-2026-3864 · GHSA-2mjq-54qg-7w6j
21 Mar 2026Evidence →
Medium, CVSS 4.420 Mar 2026
webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic
crates.io rustls-webpki · Upgrade to 0.104.0-alpha.5 (pre-release) or 0.103.10 by release line · >= 0.104.0-alpha.1, < 0.104.0-alpha.5; >= 0.102.0-alpha.0, < 0.103.10 · GHSA-pwjx-qhcg-rvj4
20 Mar 2026Evidence →
High, CVSS 8.220 Mar 2026
Parse Server LiveQuery subscription query depth bypass
npm parse-server · Upgrade to 9.6.0-alpha.45 (pre-release) or 8.6.56 by release line · >= 9.0.0, < 9.6.0-alpha.45; < 8.6.56 · CVE-2026-33508 · GHSA-6qh5-m6g3-xhq6 · amended
20 Mar 2026Evidence →
High, CVSS 7.220 Mar 2026
DreamFactory has a directory traversal
Packagist dreamfactory/df-core · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2025-55988 · GHSA-gv7f-w92j-383q
20 Mar 2026Evidence →
High, CVSS 8.720 Mar 2026
Parse Server has a query condition depth bypass via pre-validation transform pipeline
npm parse-server · Upgrade to 9.6.0-alpha.44 (pre-release) or 8.6.55 by release line · >= 9.0.0, < 9.6.0-alpha.44; < 8.6.55 · CVE-2026-33498 · GHSA-9fjp-q3c4-6w3j · amended
20 Mar 2026Evidence →
High, CVSS 8.720 Mar 2026
langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
PyPI langflow · Upgrade to 1.7.1 or later · < 1.7.1 · CVE-2026-33497 · GHSA-ph9w-r52h-28p7 · amended
20 Mar 2026Evidence →
High, CVSS 7.220 Mar 2026
Ory Keto has a SQL injection via forged pagination tokens
Go github.com/ory/keto · Upgrade to 0.14.1-0.20260320140104-e4393662cd2e (pre-release) or later · < 0.14.1-0.20260320140104-e4393662cd2e · CVE-2026-33505 · GHSA-c38g-mx2c-9wf2
20 Mar 2026Evidence →
High, CVSS 7.220 Mar 2026
Ory Kratos has a SQL injection via forged pagination tokens
Go github.com/ory/kratos · Upgrade to 1.3.1-0.20260320110106-9d7085948039 (pre-release) or later · < 1.3.1-0.20260320110106-9d7085948039 · CVE-2026-33503 · GHSA-hgx2-28f8-6g2r
20 Mar 2026Evidence →
Critical, CVSS 10.020 Mar 2026
Ory Oathkeeper has a path traversal authorization bypass
Go github.com/ory/oathkeeper · Upgrade to 0.40.10-0.20260320084758-8e0002140491 (pre-release) or later · < 0.40.10-0.20260320084758-8e0002140491 · CVE-2026-33494 · GHSA-p224-6x5r-fjpm
20 Mar 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in zread_cli (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence