Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
Critical: 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

9251–9275 of 31,071 matching · newest first

ExploitedClear filters

High, CVSS 7.512 Mar 2026
Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload
Go github.com/ellanetworks/core · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-32319 · GHSA-m9pm-w3gv-c68f
12 Mar 2026Evidence →
High, CVSS 8.112 Mar 2026
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32302 · GHSA-5wcw-8jjv-m286 · amended
12 Mar 2026Evidence →
Medium, CVSS 6.212 Mar 2026
TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction
npm @tinacms/cli · Upgrade to 2.1.8 or later · < 2.1.8 · CVE-2026-29066 · GHSA-m48g-4wr2-j2h6 · amended
12 Mar 2026Evidence →
High, CVSS 8.412 Mar 2026
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
npm @tinacms/cli · Upgrade to 2.1.8 or later · < 2.1.8 · CVE-2026-28793 · GHSA-2f24-mg4x-534q · amended
12 Mar 2026Evidence →
Critical, CVSS 9.612 Mar 2026
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
npm @tinacms/cli · Upgrade to 2.1.8 or later · < 2.1.8 · CVE-2026-28792 · GHSA-8pw3-9m7f-q734 · amended
12 Mar 2026Evidence →
Medium, CVSS 5.512 Mar 2026
ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
NuGet magick.net-q8-arm64 +18 · Upgrade all 19 to 13.0.0 or later · <= 12.3.0 · CVE-2023-1289 · GHSA-j96m-mjp6-99xr
12 Mar 2026Evidence →
High, CVSS 8.712 Mar 2026
Black: Arbitrary file writes from unsanitized user input in cache file name
PyPI black · Upgrade to 26.3.1 or later · >= 24.3.0, < 26.3.1 · CVE-2026-32274 · GHSA-3936-cmfr-pm3m · amended
12 Mar 2026Evidence →
Medium, CVSS 6.512 Mar 2026
Hyperterse: Raw exposure of database statements in MCP search tool
npm hyperterse · Upgrade to 2.2.0 or later · >= 2.0.0, < 2.2.0 · CVE-2026-31841 · GHSA-92gp-jfgx-9qpv · amended
12 Mar 2026Evidence →
High, CVSS 7.412 Mar 2026
Tina: Path Traversal in Media Upload Handle
npm tinacms · Upgrade to 2.1.7 or later · < 2.1.7 · CVE-2026-28791 · GHSA-5hxf-c7j4-279c · amended
12 Mar 2026Evidence →
High, CVSS 7.512 Mar 2026
multipart vulnerable to ReDoS in parse_options_header()
PyPI multipart · Upgrade to 1.3.1 or 1.2.2 by release line · >= 1.3.0, < 1.3.1; < 1.2.2 · CVE-2026-28356 · GHSA-p2m9-wcp5-6qw3 · amended
12 Mar 2026Evidence →
Medium, CVSS 6.312 Mar 2026
@tinacms/graphql has a Path Traversal issue
npm @tinacms/graphql · Upgrade to 2.1.2 or later · <= 2.1.1 · CVE-2026-24125 · GHSA-2238-xc5r-v9hj · amended
12 Mar 2026Evidence →
Critical, CVSS 9.312 Mar 2026
Parse Server: Account takeover via operator injection in authentication data identifier
npm parse-server · Upgrade to 9.6.0-alpha.12 (pre-release) or 8.6.38 by release line · >= 9.0.0, < 9.6.0-alpha.12; < 8.6.38 · CVE-2026-32248 · GHSA-5fw2-8jcv-xh87 · amended
12 Mar 2026Evidence →
Critical, CVSS 9.112 Mar 2026
Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
npm parse-server · Upgrade to 9.6.0-alpha.11 (pre-release) or 8.6.37 by release line · >= 9.0.0, < 9.6.0-alpha.11; < 8.6.37 · CVE-2026-32242 · GHSA-2cjm-2gwv-m892 · amended
12 Mar 2026Evidence →
Medium, CVSS 4.612 Mar 2026
Trix has a Stored XSS vulnerability through serialized attributes
npm trix +1 · Upgrade all 2 to 2.1.17 or later · < 2.1.17 · CVE-2026-73426 · GHSA-qmpg-8xg6-ph5q · amended
12 Mar 2026Evidence →
High, CVSS 8.112 Mar 2026
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
PyPI graphiti-core · Upgrade to 0.28.2 or later · <= 0.28.1 · CVE-2026-32247 · GHSA-gg5m-55jj-8m5g · amended
12 Mar 2026Evidence →
High, CVSS 8.512 Mar 2026
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
Go github.com/steveiliop56/tinyauth · Upgrade to 1.0.1-20260311144920-9eb2d33064b7 (pre-release) or later · < 1.0.1-20260311144920-9eb2d33064b7 · CVE-2026-32246 · GHSA-3q28-qjrv-qr39
12 Mar 2026Evidence →
Medium, CVSS 6.512 Mar 2026
Tinyauth's OIDC authorization codes are not bound to client on token exchange
Go github.com/steveiliop56/tinyauth · Upgrade to 1.0.1-20260311144920-9eb2d33064b7 (pre-release) or later · < 1.0.1-20260311144920-9eb2d33064b7 · CVE-2026-32245 · GHSA-xg2q-62g2-cvcm
12 Mar 2026Evidence →
Medium, CVSS 6.512 Mar 2026
ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
crates.io zeptoclaw · Upgrade to 0.7.6 or later · <= 0.7.5 · GHSA-4cm8-xpfv-jv6f
12 Mar 2026Evidence →
Low, CVSS 2.712 Mar 2026
Sveltejs devalue's devalue.parse and devalue.unflatten emit objects with __proto__ own properties
npm devalue · Upgrade to 5.6.4 or later · >= 4.0.0, < 5.6.4 · CVE-2026-123567 · GHSA-mwv9-gp5h-frr4 · amended
12 Mar 2026Evidence →
Medium, CVSS 5.112 Mar 2026
Parse Server has a SQL injection via query field name when using PostgreSQL
npm parse-server · Upgrade to 9.6.0-alpha.10 (pre-release) or 8.6.36 by release line · >= 9.0.0, < 9.6.0-alpha.10; < 8.6.36 · CVE-2026-32234 · GHSA-c442-97qw-j6c6 · amended
12 Mar 2026Evidence →
High, CVSS 8.812 Mar 2026
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
crates.io zeptoclaw · Upgrade to 0.7.6 or later · <= 0.7.5 · CVE-2026-32232 · GHSA-2m67-cxxq-c3h8
12 Mar 2026Evidence →
High, CVSS 8.212 Mar 2026
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
crates.io zeptoclaw · Upgrade to 0.7.6 or later · <= 0.7.5 · CVE-2026-32231 · GHSA-46q5-g3j9-wx5c
12 Mar 2026Evidence →
Medium, CVSS 4.412 Mar 2026
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
npm @backstage/plugin-scaffolder-backend · Upgrade to 3.1.5 or later · >= 3.1.0, < 3.1.5 · CVE-2026-32237 · GHSA-8wq8-6859-qx77 · amended
12 Mar 2026Evidence →
Low, CVSS 1.712 Mar 2026
@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch
npm @backstage/plugin-auth-backend · Upgrade to 0.27.1 or later · < 0.27.1 · CVE-2026-32236 · GHSA-qp4c-xg64-7c6x · amended
12 Mar 2026Evidence →
Medium, CVSS 5.912 Mar 2026
@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass
npm @backstage/plugin-auth-backend · Upgrade to 0.27.1 or later · < 0.27.1 · CVE-2026-32235 · GHSA-wqvh-63mv-9w92 · amended
12 Mar 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm15 Nov 2026
Malicious code in node-zserial (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratedPyPI15 Nov 2026
Malicious code in gateio-v4 (PyPI)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm15 Nov 2026
Malicious code in @crvouga/mockingbird-service-microsoft (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm14 Nov 2026
Malicious code in testpackage83 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratedPyPI14 Nov 2026
Malicious code in gateio-ws (PyPI)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode

TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS

Black: Arbitrary file writes from unsanitized user input in cache file name

Hyperterse: Raw exposure of database statements in MCP search tool

Tina: Path Traversal in Media Upload Handle

multipart vulnerable to ReDoS in `parse_options_header()`

@tinacms/graphql has a Path Traversal issue

Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance

Trix has a Stored XSS vulnerability through serialized attributes

Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Tinyauth's OIDC authorization codes are not bound to client on token exchange

ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own properties

Parse Server has a SQL injection via query field name when using PostgreSQL

ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink

ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence