Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
Critical: 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

9301–9325 of 14,192 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 8.120 Sep 2022
XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 14.2-rc-1 (pre-release) or 13.10.4 by release line · >= 11.3.7, < 13.10.4; >= 14.0-rc-1, < 14.2-rc-1 · CVE-2022-31166 · GHSA-g4h6-qp44-wqvx
20 Sep 2022Evidence →
High, CVSS 7.120 Sep 2022
XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference
Maven org.xwiki.platform:xwiki-platform-security · Upgrade to 13.10.1, 13.4.6 or 12.10.11 by release line · >= 5.0, < 12.10.11; >= 13.0, < 13.4.6; >= 13.10, < 13.10.1 · CVE-2022-31167 · GHSA-gg53-wf5x-r3r6
20 Sep 2022Evidence →
High, CVSS 7.520 Sep 2022
Fastly Compute@Edge JS Runtime has fixed random number seed during compilation
npm @fastly/js-compute · Upgrade to 0.5.3 or later · >= 0.4.0, < 0.5.3 · CVE-2022-39218 · GHSA-cmr8-5w4c-44v8 · amended
20 Sep 2022Evidence →
High, CVSS 7.120 Sep 2022
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure
Go github.com/cri-o/cri-o · Upgrade to 1.25.0 or later · < 1.25.0 · CVE-2022-2995 · GHSA-phjr-8j92-w5v7
20 Sep 2022Evidence →
Critical, CVSS 9.620 Sep 2022
Valine code injection vulnerability
npm valine · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2022-38545 · GHSA-mcvg-g9wx-v5vx · amended
20 Sep 2022Evidence →
High, CVSS 7.517 Sep 2022
Jettison memory exhaustion
Maven org.codehaus.jettison:jettison · Upgrade to 1.5.2 or later · < 1.5.2 · CVE-2022-40150 · GHSA-x27m-9w8j-5vcw
17 Sep 2022Evidence →
High, CVSS 8.816 Sep 2022
Binary vulnerable to Slice Memory Allocation with Excessive Size Value
Go github.com/gagliardetto/binary · Upgrade to 0.7.1 or later · < 0.7.1 · CVE-2022-36078 · GHSA-4p6f-m4f9-ch88
16 Sep 2022Evidence →
Critical, CVSS 9.816 Sep 2022
Elrond-go has improper initialization
Go github.com/ElrondNetwork/elrond-go · Upgrade to 1.3.35 or later · <= 1.3.34 · CVE-2022-36061 · GHSA-mv8x-668m-53fg
16 Sep 2022Evidence →
High, CVSS 8.616 Sep 2022
Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
npm parse-server · Upgrade to 5.2.5 or 4.10.14 by release line · < 4.10.14; >= 5.0.0, < 5.2.5 · CVE-2022-36079 · GHSA-2m6g-crv8-p3c6 · amended
16 Sep 2022Evidence →
High, CVSS 8.316 Sep 2022
SFTPGo vulnerable to recovery codes abuse
Go github.com/drakkan/sftpgo/v2 · Upgrade to 2.3.4 or later · >= 2.2.0, < 2.3.4 · CVE-2022-36071 · GHSA-54qx-8p8w-xhg8
16 Sep 2022Evidence →
High, CVSS 7.016 Sep 2022
TensorFlow vulnerable to OOB write in scatter_nd in TF Lite
PyPI tensorflow +2 · Upgrade all 3 to 2.9.1, 2.8.1 or 2.7.2 by release line · < 2.7.2; >= 2.8.0, < 2.8.1; >= 2.9.0, < 2.9.1 · CVE-2022-35939 · GHSA-ffjm-4qwc-7cmf · amended
16 Sep 2022Evidence →
High, CVSS 7.016 Sep 2022
TensorFlow vulnerable to OOB read in Gather_nd in TF Lite
PyPI tensorflow +2 · Upgrade all 3 to 2.9.1, 2.8.1 or 2.7.2 by release line · < 2.7.2; >= 2.8.0, < 2.8.1; >= 2.9.0, < 2.9.1 · CVE-2022-35937 · GHSA-pxrw-j2fv-hx3h · amended
16 Sep 2022Evidence →
High, CVSS 7.516 Sep 2022
Go-CVSS has Out-of-bounds Read vulnerability in ParseVector function
Go github.com/pandatix/go-cvss · Upgrade to 0.4.0 or later · >= 0.2.0, < 0.4.0 · CVE-2022-39213 · GHSA-xhmf-mmv2-4hhx
16 Sep 2022Evidence →
High, CVSS 7.716 Sep 2022
Harbor fails to validate the user permissions when viewing Webhook policies
Go github.com/goharbor/harbor · Upgrade to 2.5.2, 2.4.3 or 1.10.13 by release line · >= 1.0.0, <= 1.10.12; >= 2.0.0, <= 2.4.2; >= 2.5.0, <= 2.5.1 · CVE-2022-31666 · GHSA-jf8p-3vjh-pq94
16 Sep 2022Evidence →
High, CVSS 7.716 Sep 2022
Harbor fails to validate the user permissions when updating tag retention policies
Go github.com/goharbor/harbor · Upgrade to 2.5.2, 2.4.3 or 1.10.13 by release line · >= 1.0.0, <= 1.10.12; >= 2.0.0, <= 2.4.2; >= 2.5.0, <= 2.5.1 · CVE-2022-31670 · GHSA-3637-v6vq-xqqw
16 Sep 2022Evidence →
High, CVSS 7.316 Sep 2022
Poetry Argument Injection can lead to Local Code Execution
PyPI poetry · Upgrade to 1.1.9 or later · < 1.1.9 · CVE-2022-36069 · GHSA-9xgj-fcgf-x6mw · amended
16 Sep 2022Evidence →
High, CVSS 7.716 Sep 2022
Helm Controller denial of service
Go github.com/fluxcd/helm-controller · Upgrade to 0.23.0 or later · >= 0.0.4, < 0.23.0 · +1 more package · CVE-2022-36049 · GHSA-p2g7-xwvr-rrw3
16 Sep 2022Evidence →
High, CVSS 7.516 Sep 2022
NodeBB account takeover via SSO plugins
npm nodebb · Upgrade to 1.17.2 or later · <= 1.17.1 · CVE-2022-36076 · GHSA-xmgg-fx9p-prq6 · amended
16 Sep 2022Evidence →
Critical, CVSS 9.916 Sep 2022
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch
npm cruddl · Upgrade to 3.0.2 or 2.7.0 by release line · >= 3.0.0, < 3.0.2; >= 1.1.0, < 2.7.0 · CVE-2022-36084 · GHSA-qm4w-4995-vg7f · amended
16 Sep 2022Evidence →
High, CVSS 7.416 Sep 2022
OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions
Go github.com/open-policy-agent/opa · Upgrade to 0.43.1 or later · >= 0.40.0, < 0.43.1 · CVE-2022-36085 · GHSA-f524-rf33-2jjr
16 Sep 2022Evidence →
High, CVSS 8.416 Sep 2022
linked_list_allocator vulnerable to out-of-bound writes on Heap initialization and Heap::extend
crates.io linked_list_allocator · Upgrade to 0.10.2 or later · <= 0.10.1 · CVE-2022-36086 · GHSA-xg8p-34w2-j49j
16 Sep 2022Evidence →
High, CVSS 8.116 Sep 2022
XWiki Platform Improper Authorization check for inactive users
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 14.3-rc-1 (pre-release) or 13.10.5 by release line · >= 1.1, < 13.10.5; >= 14.0, < 14.3-rc-1 · CVE-2022-36090 · GHSA-jgc8-gvcx-9vfx
16 Sep 2022Evidence →
High, CVSS 7.516 Sep 2022
XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
Maven org.xwiki.platform:xwiki-platform-web · Upgrade to 14.2 or later · >= 14.0, < 14.2 · +1 more package · CVE-2022-36091 · GHSA-599v-w48h-rjrm
16 Sep 2022Evidence →
High, CVSS 8.916 Sep 2022
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
Maven org.xwiki.platform:xwiki-platform-index-ui · Upgrade to 14.3 or 13.10.6 by release line · >= 2.2-milestone-1, < 13.10.6; >= 14.0, < 14.3 · CVE-2022-36096 · GHSA-gjmq-x5x7-wc36
16 Sep 2022Evidence →
High, CVSS 8.916 Sep 2022
XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
Maven org.xwiki.platform:xwiki-platform-attachment-ui · Upgrade to 14.4-rc-1 (pre-release) or later · >= 14.0-rc-1, < 14.4-rc-1 · CVE-2022-36097 · GHSA-9r9j-57rf-f6vj
16 Sep 2022Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-win32-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in zread_cli (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-x64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm13 Nov 2026
Malicious code in @zread/cli-darwin-arm64 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups

XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference

Fastly Compute@Edge JS Runtime has fixed random number seed during compilation

CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure

Valine code injection vulnerability

Jettison memory exhaustion

Binary vulnerable to Slice Memory Allocation with Excessive Size Value

Elrond-go has improper initialization

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

SFTPGo vulnerable to recovery codes abuse

TensorFlow vulnerable to OOB write in `scatter_nd` in TF Lite

TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite

Go-CVSS has Out-of-bounds Read vulnerability in ParseVector function

Harbor fails to validate the user permissions when viewing Webhook policies

Harbor fails to validate the user permissions when updating tag retention policies

Poetry Argument Injection can lead to Local Code Execution

Helm Controller denial of service

NodeBB account takeover via SSO plugins

cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions

linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

XWiki Platform Improper Authorization check for inactive users

XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor

XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence