Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
Critical: 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

9126–9150 of 14,192 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 8.29 Nov 2022
Failing DTLS handshakes may cause throttling to block processing of records
Maven org.eclipse.californium:scandium · Upgrade to 3.7.0 or 2.7.4 by release line · >= 3.0.0, < 3.7.0; >= 2.7.0, < 2.7.4 · CVE-2022-39368 · GHSA-p72g-cgh9-ghjg
9 Nov 2022Evidence →
Critical, CVSS 9.88 Nov 2022
Remote code execution via MongoDB BSON parser through prototype pollution
npm parse-server · Upgrade to 5.3.1 or 4.10.18 by release line · < 4.10.18; >= 5.0.0, < 5.3.1 · CVE-2022-39396 · GHSA-prm5-8g2m-24gg · amended
8 Nov 2022Evidence →
Critical, CVSS 9.87 Nov 2022
Apache Commons BCEL vulnerable to out-of-bounds write
Maven org.apache.bcel:bcel · Upgrade to 6.6.0 or later · < 6.6.0 · CVE-2022-42920 · GHSA-97xg-phpr-rg8q
7 Nov 2022Evidence →
High, CVSS 7.57 Nov 2022
Apache Ivy vulnerable to path traversal
Maven org.apache.ivy:ivy · Upgrade to 2.5.1 or later · >= 2.0.0, < 2.5.1 · CVE-2022-37866 · GHSA-wv7w-rj2x-556x
7 Nov 2022Evidence →
Critical, CVSS 9.87 Nov 2022
btcd mishandles witness size checking
Go github.com/btcsuite/btcd · Upgrade to 0.23.2 or later · < 0.23.2 · +1 more package · CVE-2022-44797 · GHSA-2chg-86hq-7w38
7 Nov 2022Evidence →
Critical, CVSS 9.17 Nov 2022
Apache Ivy does not verify target path when extracting the archive
Maven org.apache.ivy:ivy · Upgrade to 2.5.1 or later · >= 2.4.0, < 2.5.1 · CVE-2022-37865 · GHSA-94rr-4jr5-9h2p
7 Nov 2022Evidence →
High, CVSS 8.14 Nov 2022
Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack
PyPI pulsar-client · Upgrade to 2.10.2, 2.9.3, 2.8.4 or 2.7.5 by release line · < 2.7.5; >= 2.8.0, < 2.8.4; >= 2.9.0, < 2.9.3; >= 2.10.0, < 2.10.2 · CVE-2022-33684 · GHSA-5r3h-c3r7-9w4h · amended
4 Nov 2022Evidence →
Critical, CVSS 9.14 Nov 2022
XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider
Maven org.xwiki.contrib.oidc:oidc-authenticator · Upgrade to 1.29.1 or later · < 1.29.1 · CVE-2022-39387 · GHSA-m7gv-v8xx-v47w
4 Nov 2022Evidence →
High, CVSS 7.53 Nov 2022
Apache UIMA Path Traversal vulnerability
Maven org.apache.uima:uimaj-core · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2022-32287 · GHSA-xgqr-5wqw-9fpv
3 Nov 2022Evidence →
Critical, CVSS 9.83 Nov 2022
@keystone-6/core's NODE_ENV defaults to development with esbuild
npm @keystone-6/core · Upgrade to 3.0.2 or later · >= 3.0.0, < 3.0.2 · CVE-2022-39382 · GHSA-25mx-2mxm-6343 · amended
3 Nov 2022Evidence →
Critical, CVSS 9.82 Nov 2022
Centreon vulnerable to SQL Injection
Packagist centreon/centreon · Upgrade to 22.10.0-beta1 (pre-release) or later · < 22.10.0-beta1 · CVE-2022-3827 · GHSA-j5wx-jvw3-j363
2 Nov 2022Evidence →
High, CVSS 7.52 Nov 2022
Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
npm hummus · Upgrade to 1.0.111 or later · < 1.0.111 · +1 more package · CVE-2022-39381 · GHSA-rcrx-fpjp-mfrw · amended
2 Nov 2022Evidence →
High, CVSS 8.81 Nov 2022
IBAX go-ibax vulnerable to SQL injection
Go github.com/IBAX-io/go-ibax · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2022-3802 · GHSA-g23g-mw97-65c8
1 Nov 2022Evidence →
High, CVSS 8.81 Nov 2022
IBAX go-ibax vulnerable to SQL injection
Go github.com/IBAX-io/go-ibax · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2022-3799 · GHSA-fcgf-j8cf-h2rm
1 Nov 2022Evidence →
High, CVSS 8.81 Nov 2022
IBAX go-ibax vulnerable to SQL injection
Go github.com/IBAX-io/go-ibax · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2022-3798 · GHSA-mgqh-3qm7-gx82
1 Nov 2022Evidence →
High, CVSS 8.81 Nov 2022
IBAX go-ibax vulnerable to SQL injection
Go github.com/IBAX-io/go-ibax · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2022-3800 · GHSA-rwcf-gq22-ph83
1 Nov 2022Evidence →
High, CVSS 8.81 Nov 2022
IBAX go-ibax vulnerable to SQL injection
Go github.com/IBAX-io/go-ibax · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2022-3801 · GHSA-m738-584h-26p6
1 Nov 2022Evidence →
High, CVSS 8.01 Nov 2022
phpCAS vulnerable to Service Hostname Discovery Exploitation
Packagist apereo/phpcas · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2022-39369 · GHSA-8q72-6qq8-xv64
1 Nov 2022Evidence →
Critical, CVSS 9.81 Nov 2022
X.509 Email Address 4-byte Buffer Overflow
crates.io openssl-src · Upgrade to 300.0.11 or later · >= 300.0.0, < 300.0.11 · CVE-2022-3602 · GHSA-8rwr-x37p-mx23
1 Nov 2022Evidence →
High, CVSS 7.51 Nov 2022
X.509 Email Address Variable Length Buffer Overflow
crates.io openssl-src · Upgrade to 300.0.11 or later · >= 300.0.0, < 300.0.11 · CVE-2022-3786 · GHSA-h8jm-2x53-xhp5
1 Nov 2022Evidence →
High, CVSS 8.11 Nov 2022
spring-security-oauth2-client vulnerable to Privilege Escalation
Maven org.springframework.security:spring-security-oauth2-client · Upgrade to 5.7.5 or 5.6.9 by release line · >= 5.7.0, < 5.7.5; < 5.6.9 · CVE-2022-31690 · GHSA-32vj-v39g-jh23
1 Nov 2022Evidence →
Critical, CVSS 9.81 Nov 2022
Spring Security authorization rules can be bypassed via forward or include dispatcher types
Maven org.springframework.security:spring-security-core · Upgrade to 5.7.5 or 5.6.9 by release line · >= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9 · CVE-2022-31692 · GHSA-mmmh-wcxm-2wr4
1 Nov 2022Evidence →
High, CVSS 7.51 Nov 2022
Apache Tomcat may reject request containing invalid Content-Length header
Maven org.apache.tomcat:tomcat-coyote · Upgrade to 10.1.1, 10.0.27 or 9.0.68 by release line · >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1 · +1 more package · CVE-2022-42252 · GHSA-p22x-g9px-3945
1 Nov 2022Evidence →
High, CVSS 7.51 Nov 2022
muhammara and hummus vulnerable to denial of service by NULL pointer dereference
npm hummus · Upgrade to 1.0.111 or later · < 1.0.111 · +1 more package · CVE-2022-25892 · GHSA-9cv5-4wqv-9w94 · amended
1 Nov 2022Evidence →
High, CVSS 7.51 Nov 2022
muhammara and hummus vulnerable to null pointer dereference on bad response object
npm hummus · Upgrade to 1.0.111 or later · >= 1.0.0, <= 1.0.110 · +1 more package · CVE-2022-25885 · GHSA-frp9-2v6r-gj97 · amended
1 Nov 2022Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in zread_cli (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence