Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
Critical: 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

9351–9375 of 31,071 matching · newest first

ExploitedClear filters

Medium, CVSS 6.311 Mar 2026
Parse Server vulnerable to user enumeration via email verification endpoint
npm parse-server · Upgrade to 9.6.0-alpha.8 (pre-release) or 8.6.34 by release line · >= 9.0.0-alpha.1, < 9.6.0-alpha.8; < 8.6.34 · CVE-2026-31901 · GHSA-w54v-hf9p-8856 · amended
11 Mar 2026Evidence →
High, CVSS 8.211 Mar 2026
Parse Server's MFA recovery codes not consumed after use
npm parse-server · Upgrade to 9.6.0-alpha.7 (pre-release) or 8.6.33 by release line · >= 9.0.0-alpha.1, < 9.6.0-alpha.7; < 8.6.33 · CVE-2026-31875 · GHSA-4hf6-3x24-c9m8 · amended
11 Mar 2026Evidence →
High, CVSS 8.711 Mar 2026
Parse Server has a protected fields bypass via dot-notation in query and sort
npm parse-server · Upgrade to 9.6.0-alpha.6 (pre-release) or 8.6.32 by release line · >= 9.0.0-alpha.1, < 9.6.0-alpha.6; < 8.6.32 · CVE-2026-31872 · GHSA-r2m8-pxm9-9c4g · amended
11 Mar 2026Evidence →
Critical, CVSS 9.311 Mar 2026
Parse Server vulnerable to SQL Injection via dot-notation sub-key name in Increment operation on PostgreSQL
npm parse-server · Upgrade to 9.6.0-alpha.5 (pre-release) or 8.6.31 by release line · >= 9.0.0-alpha.1, < 9.6.0-alpha.5; < 8.6.31 · CVE-2026-31871 · GHSA-gqpp-xgvh-9h7h · amended
11 Mar 2026Evidence →
Medium, CVSS 6.311 Mar 2026
Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types
npm parse-server · Upgrade to 9.6.0-alpha.4 (pre-release) or 8.6.30 by release line · >= 9.0.0-alpha.1, < 9.6.0-alpha.4; < 8.6.30 · CVE-2026-31868 · GHSA-v5hf-f4c3-m5rv · amended
11 Mar 2026Evidence →
High, CVSS 7.511 Mar 2026
flagd Vulnerable to Allocation of Resources Without Limits or Throttling
Go github.com/open-feature/flagd/flagd · Upgrade to 0.14.2 or later · < 0.14.2 · CVE-2026-31866 · GHSA-rmrf-g9r3-73pm
11 Mar 2026Evidence →
Medium, CVSS 4.811 Mar 2026
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
npm hono · Upgrade to 4.12.7 or later · < 4.12.7 · CVE-2026-56763 · GHSA-v8w9-8mx6-g223 · amended
11 Mar 2026Evidence →
Medium, CVSS 5.411 Mar 2026
actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects
crates.io actix-web-lab · Upgrade to 0.26.0 or later · <= 0.25.0 · GHSA-vhj5-x93p-67jw
11 Mar 2026Evidence →
High, CVSS 8.711 Mar 2026
CraftCMS's ElementSearchController Affected by Blind SQL Injection
Packagist craftcms/cms · Upgrade to 5.9.9 or later · >= 5.0.0-RC1, <= 5.9.8 · CVE-2026-31858 · GHSA-g7j6-fmwx-7vp8
11 Mar 2026Evidence →
Critical, CVSS 9.311 Mar 2026
Parse Server vulnerable to SQL injection via Increment operation on nested object field in PostgreSQL
npm parse-server · Upgrade to 9.6.0-alpha.3 (pre-release) or 8.6.29 by release line · >= 9.0.0-alpha.1, < 9.6.0-alpha.3; < 8.6.29 · CVE-2026-31856 · GHSA-q3vj-96h2-gwvg · amended
11 Mar 2026Evidence →
Medium, CVSS 6.911 Mar 2026
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
Packagist craftcms/cms · Upgrade to 5.9.7 or 4.17.3 by release line · >= 4.15.3, <= 4.17.2; >= 5.7.5, <= 5.9.6 · CVE-2026-31859 · GHSA-fvwq-45qv-xvhv
11 Mar 2026Evidence →
Critical, CVSS 9.111 Mar 2026
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
npm @siteboon/claude-code-ui +1 · Upgrade all 2 to 1.24.0 or later · < 1.24.0 · CVE-2026-31862 · GHSA-f2fc-vc88-6w7q · amended
11 Mar 2026Evidence →
Medium, CVSS 5.411 Mar 2026
Umbraco Backoffice API Allows Unauthorized Modification of Domain Data
NuGet umbraco.cms · Upgrade to 17.2.2 or 16.5.1 by release line · >= 14.0.0, < 16.5.1; >= 17.0.0, < 17.2.2 · CVE-2026-31832 · GHSA-fpvf-fvp5-996r
11 Mar 2026Evidence →
High, CVSS 7.511 Mar 2026
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
RubyGems sigstore · Upgrade to 0.2.3 or later · < 0.2.3 · CVE-2026-31830 · GHSA-mhg6-2q2v-9h2c
11 Mar 2026Evidence →
High, CVSS 7.111 Mar 2026
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
npm flowise +1 · Upgrade all 2 to 3.0.13 or later · <= 3.0.12 · CVE-2026-31829 · GHSA-fvcw-9w9r-pxc7 · amended
11 Mar 2026Evidence →
Medium, CVSS 6.011 Mar 2026
Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction
npm parse-server · Upgrade to 9.5.2-alpha.13 (pre-release) or 8.6.26 by release line · >= 9.0.0-alpha.1, < 9.5.2-alpha.13; < 8.6.26 · CVE-2026-31828 · GHSA-7m6r-fhh7-r47c · amended
11 Mar 2026Evidence →
High, CVSS 8.811 Mar 2026
Parse Server: Classes _GraphQLConfig and _Audience master key bypass via generic class routes
npm parse-server · Upgrade to 9.5.2-alpha.12 (pre-release) or 8.6.25 by release line · >= 9.0.0-alpha.1, < 9.5.2-alpha.12; < 8.6.25 · CVE-2026-31800 · GHSA-7xg7-rqf6-pw6c · amended
11 Mar 2026Evidence →
Medium, CVSS 6.511 Mar 2026
@appium/support has a Zip Slip arbitrary file write in its ZIP extraction
npm @appium/support · Upgrade to 7.0.6 or later · <= 7.0.5 · CVE-2026-30973 · GHSA-rfx7-4xw3-gh4m · amended
11 Mar 2026Evidence →
Medium, CVSS 6.911 Mar 2026
Parse Server has a rate limit bypass via batch request endpoint
npm parse-server · Upgrade to 9.5.2-alpha.10 (pre-release) or 8.6.23 by release line · >= 9.0.0-alpha.1, < 9.5.2-alpha.10; < 8.6.23 · CVE-2026-30972 · GHSA-775h-3xrc-c228 · amended
11 Mar 2026Evidence →
High, CVSS 7.611 Mar 2026
Parse Server OAuth2 authentication adapter account takeover via identity spoofing
npm parse-server · Upgrade to 9.5.2-alpha.9 (pre-release) or 8.6.22 by release line · >= 9.0.0-alpha.1, < 9.5.2-alpha.9; < 8.6.22 · CVE-2026-30967 · GHSA-fr88-w35c-r596 · amended
11 Mar 2026Evidence →
Critical, CVSS 10.011 Mar 2026
Parse Server has role escalation and CLP bypass via direct _Join table write
npm parse-server · Upgrade to 9.5.2-alpha.7 (pre-release) or 8.6.20 by release line · >= 9.0.0-alpha.1, < 9.5.2-alpha.7; < 8.6.20 · CVE-2026-30966 · GHSA-5f92-jrq3-28rc · amended
11 Mar 2026Evidence →
Critical, CVSS 9.911 Mar 2026
Parse Server vulnerable to session token exfiltration via redirectClassNameForKey query parameter
npm parse-server · Upgrade to 9.5.2-alpha.8 (pre-release) or 8.6.21 by release line · >= 9.0.0-alpha.1, < 9.5.2-alpha.8; < 8.6.21 · CVE-2026-30965 · GHSA-6r2j-cxgf-495f · amended
11 Mar 2026Evidence →
High, CVSS 7.111 Mar 2026
Parse Server has a protected fields bypass via logical query operators
npm parse-server · Upgrade to 9.5.2-alpha.6 (pre-release) or 8.6.19 by release line · >= 9.0.0, < 9.5.2-alpha.6; < 8.6.19 · CVE-2026-30962 · GHSA-72hp-qff8-4pvv · amended
11 Mar 2026Evidence →
High, CVSS 7.511 Mar 2026
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
npm sequelize · Upgrade to 6.37.8 or later · >= 6.0.0-beta.1, <= 6.37.7 · CVE-2026-30951 · GHSA-6457-6jrx-69cr · amended
11 Mar 2026Evidence →
High, CVSS 7.611 Mar 2026
Parse Server missing audience validation in Keycloak authentication adapter
npm parse-server · Upgrade to 9.5.2-alpha.5 (pre-release) or 8.6.18 by release line · >= 9.0.0, < 9.5.2-alpha.5; < 8.6.18 · CVE-2026-30949 · GHSA-48mh-j4p5-7j9v · amended
11 Mar 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV13 Nov 2026
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
NewsExploited · CISA KEV13 Nov 2026
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm15 Nov 2026
Malicious code in node-zserial (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratedPyPI15 Nov 2026
Malicious code in gateio-v4 (PyPI)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm15 Nov 2026
Malicious code in @crvouga/mockingbird-service-microsoft (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm14 Nov 2026
Malicious code in testpackage83 (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratedPyPI14 Nov 2026
Malicious code in gateio-ws (PyPI)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Parse Server vulnerable to user enumeration via email verification endpoint

Parse Server's MFA recovery codes not consumed after use

Parse Server has a protected fields bypass via dot-notation in query and sort

Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types

flagd Vulnerable to Allocation of Resources Without Limits or Throttling

Hono vulnerable to Prototype Pollution possible through proto key allowed in parseBody({ dot: true })

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL

CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization

@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters

Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

@appium/support has a Zip Slip arbitrary file write in its ZIP extraction

Parse Server has a rate limit bypass via batch request endpoint

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Parse Server has role escalation and CLP bypass via direct `_Join` table write

Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter

Parse Server has a protected fields bypass via logical query operators

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Parse Server missing audience validation in Keycloak authentication adapter

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence