Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
Critical: 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

9201–9225 of 31,071 matching · newest first

ExploitedClear filters

High, CVSS 7.113 Mar 2026
OpenClaw: browser.request let operator.write persist admin-only browser profile changes
npm openclaw · Upgrade to 2026.3.11 or later · <= 2026.3.8 · CVE-2026-32972 · GHSA-vmhq-cqm9-6p7q · amended
13 Mar 2026Evidence →
Medium, CVSS 6.913 Mar 2026
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens
npm openclaw · Upgrade to 2026.3.12 or later · <= 2026.3.11 · CVE-2026-33575 · GHSA-7h7g-x2px-94hj · amended
13 Mar 2026Evidence →
Unrated13 Mar 2026
OpenClaw's Zalouser allowlist authorization matched mutable group names by default
npm openclaw · Upgrade to 2026.3.12 or later · <= 2026.3.11 · CVE-2026-32975 · GHSA-f5mf-3r52-r83w · amended
13 Mar 2026Evidence →
Critical, CVSS 9.913 Mar 2026
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
npm @apollo/federation-internals +2 · Upgrade all 3 to 2.13.2, 2.12.3, 2.11.6 or 2 more by release line · < 2.9.6; >= 2.10.0, < 2.10.5; >= 2.11.0, < 2.11.6; >= 2.12.0, < 2.12.3; >= 2.13.0, < 2.13.2 · CVE-2026-32621 · GHSA-pfjj-6f4p-rvmh · amended
13 Mar 2026Evidence →
Medium, CVSS 5.413 Mar 2026
Statamic vulnerable to privilege escalation via stored cross-site scripting
Packagist statamic/cms · Upgrade to 6.6.2 or later · >= 6.0.0, < 6.6.2 · CVE-2026-32612 · GHSA-hcch-w73c-jp4m
13 Mar 2026Evidence →
High, CVSS 7.513 Mar 2026
idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability
NuGet idunno.bluesky +2 · Upgrade all 3 to 1.7.0 or later · < 1.7.0 · GHSA-8fh9-c4jq-94h4
13 Mar 2026Evidence →
High, CVSS 8.213 Mar 2026
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
Packagist simplesamlphp/xml-security · Upgrade to 2.3.1 or 1.13.9 by release line · >= 2.0.0, < 2.3.1; < 1.13.9 · CVE-2026-32600 · GHSA-r353-4845-pr5p
13 Mar 2026Evidence →
High, CVSS 7.513 Mar 2026
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-1526 · GHSA-vrm6-8vpv-qv8q · amended
13 Mar 2026Evidence →
High, CVSS 7.513 Mar 2026
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-2229 · GHSA-v9p9-hfj2-hcw8 · amended
13 Mar 2026Evidence →
Medium, CVSS 4.613 Mar 2026
Undici has CRLF Injection in undici via upgrade option
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-1527 · GHSA-4992-7rv2-5pvq · amended
13 Mar 2026Evidence →
Medium, CVSS 5.913 Mar 2026
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
npm undici · Upgrade to 7.24.0 or later · >= 7.17.0, < 7.24.0 · CVE-2026-2581 · GHSA-phc3-fgpg-7m6h · amended
13 Mar 2026Evidence →
High, CVSS 7.513 Mar 2026
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · >= 6.0.0, < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-1528 · GHSA-f269-vfmq-vjvj · amended
13 Mar 2026Evidence →
Medium, CVSS 6.513 Mar 2026
Undici has an HTTP Request/Response Smuggling issue
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-1525 · GHSA-2mjp-6q6p-2qxm · amended
13 Mar 2026Evidence →
Medium, CVSS 6.913 Mar 2026
OneUptime: Password Reset Token Logged at INFO Level
npm oneuptime · Upgrade to 10.0.23 or later · < 10.0.23 · CVE-2026-32598 · GHSA-4524-cj9j-g4fj · amended
13 Mar 2026Evidence →
High, CVSS 7.513 Mar 2026
PyJWT accepts unknown crit header extensions
PyPI pyjwt · Upgrade to 2.12.0 or later · <= 2.11.0 · CVE-2026-32597 · GHSA-752w-5fwx-jx9f · amended
13 Mar 2026Evidence →
Medium, CVSS 6.913 Mar 2026
Parse Server's GraphQL WebSocket endpoint bypasses security middleware
npm parse-server · Upgrade to 9.6.0-alpha.14 (pre-release) or 8.6.40 by release line · >= 9.0.0, < 9.6.0-alpha.14; < 8.6.40 · CVE-2026-32594 · GHSA-p2x3-8689-cwpg · amended
13 Mar 2026Evidence →
High, CVSS 8.713 Mar 2026
Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145
crates.io yamux · Upgrade to 0.13.10 or later · < 0.13.10 · CVE-2026-32314 · GHSA-vxx9-2994-q338
13 Mar 2026Evidence →
High, CVSS 8.213 Mar 2026
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
Packagist robrichards/xmlseclibs · Upgrade to 3.1.5 or later · < 3.1.5 · CVE-2026-32313 · GHSA-4v26-v6cg-g6f9
13 Mar 2026Evidence →
High, CVSS 7.513 Mar 2026
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
PyPI scrapy · Upgrade to 2.14.2 or later · >= 1.4.0, <= 2.14.1 · CVE-2026-105782 · GHSA-cwxj-rr6w-m6w7 · amended
13 Mar 2026Evidence →
Medium, CVSS 6.313 Mar 2026
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
npm parse-server · Upgrade to 9.6.0-alpha.13 (pre-release) or 8.6.39 by release line · >= 9.0.0, < 9.6.0-alpha.13; >= 8.0.2, < 8.6.39 · CVE-2026-32269 · GHSA-69xg-f649-w5g2 · amended
13 Mar 2026Evidence →
High, CVSS 8.113 Mar 2026
Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process
crates.io deno · Upgrade to 2.7.2 or later · >= 2.7.0, < 2.7.2 · CVE-2026-32260 · GHSA-4c96-w8v2-p28j
13 Mar 2026Evidence →
Medium, CVSS 5.313 Mar 2026
rs-soroban-sdk: Fr scalar field equality comparison bypasses modular reduction
crates.io soroban-sdk · Upgrade to 25.3.0, 23.5.3 or 22.0.11 by release line · >= 25.0.0, < 25.3.0; >= 23.0.0, < 23.5.3; < 22.0.11 · CVE-2026-32322 · GHSA-x2hw-px52-wp4m
13 Mar 2026Evidence →
High, CVSS 7.613 Mar 2026
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
npm oneuptime · Upgrade to 10.0.23 or later · < 10.0.23 · CVE-2026-32308 · GHSA-wvh5-6vjm-23qh · amended
13 Mar 2026Evidence →
Critical, CVSS 9.913 Mar 2026
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
npm oneuptime · Upgrade to 10.0.23 or later · < 10.0.23 · CVE-2026-32306 · GHSA-p5g2-jm85-8g35 · amended
13 Mar 2026Evidence →
Medium, CVSS 5.413 Mar 2026
OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32923 · GHSA-9vvh-2768-c8vp · amended
13 Mar 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm15 Nov 2026
Malicious code in node-zserial (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratedPyPI15 Nov 2026
Malicious code in gateio-v4 (PyPI)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm15 Nov 2026
Malicious code in @crvouga/mockingbird-service-microsoft (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm14 Nov 2026
Malicious code in testpackage83 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratedPyPI14 Nov 2026
Malicious code in gateio-ws (PyPI)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes

OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

OpenClaw's Zalouser allowlist authorization matched mutable group names by default

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Statamic vulnerable to privilege escalation via stored cross-site scripting

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

Undici has CRLF Injection in undici via `upgrade` option

Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Undici has an HTTP Request/Response Smuggling issue

OneUptime: Password Reset Token Logged at INFO Level

PyJWT accepts unknown `crit` header extensions

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process

rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence