Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

926–950 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 5.914 Oct 2026
Wasmtime may not properly enforce async-entrypoint requirement
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 42.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119136 · GHSA-vcg5-q8m5-8379 · amended
14 Oct 2026Evidence →
High, CVSS 8.814 Oct 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
crates.io wasmtime-wasi · Upgrade to 49.0.3, 48.0.6 or 36.0.18 by release line · >= 0.0.0-0, < 36.0.18; >= 37.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-118688 · GHSA-m9f7-9w4p-gv38 · amended
14 Oct 2026Evidence →
Medium, CVSS 5.914 Oct 2026
Overlapping string transcode in a fused adapter can panic
crates.io wasmtime · Upgrade to 49.0.3 or later · >= 49.0.0, < 49.0.3 · CVE-2026-119132 · GHSA-54p9-vhhq-8f7q · amended
14 Oct 2026Evidence →
Medium, CVSS 5.914 Oct 2026
Panic viewing component model stream or future as the wrong type
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119135 · GHSA-63h4-6cx9-pjfj · amended
14 Oct 2026Evidence →
High, CVSS 7.514 Oct 2026
Remote DoS through unchecked IdList allocation in negentropy
crates.io negentropy · Upgrade to 0.5.2 or 0.4.4 by release line · >= 0.2.0, < 0.4.4; >= 0.5.0, < 0.5.2
14 Oct 2026Evidence →
Low, CVSS 3.714 Oct 2026
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
crates.io rustls · Upgrade to 0.24.0-dev.2 (pre-release) or 0.23.46 by release line · < 0.23.46; >= 0.24.0-dev.1, < 0.24.0-dev.2 · CVE-2026-123611 · GHSA-w44r-93j7-qv28 · amended
14 Oct 2026Evidence →
Medium, CVSS 5.914 Oct 2026
Yielding in a component start function can lead to a host panic
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119140 · GHSA-5hhx-4wrr-3j9g · amended
14 Oct 2026Evidence →
Medium, CVSS 5.314 Oct 2026
Stack overflow dropping a long chain of recursive types
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 42.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119137 · GHSA-wjc8-633q-pwxr · amended
14 Oct 2026Evidence →
Low, CVSS 2.114 Oct 2026
Guests can send absolute-form HTTP requests to different hosts
crates.io wasmtime-wasi-http · Upgrade to 49.0.3, 48.0.6 or 36.0.18 by release line · >= 0.0.0-0, < 36.0.18; >= 37.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119130 · GHSA-5qpp-g3j2-8frx · amended
14 Oct 2026Evidence →
Medium, CVSS 5.314 Oct 2026
wasi-http: Request with long url before query parameter crashes host
crates.io wasmtime-wasi-http · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119131 · GHSA-w36r-2hch-9xp9 · amended
14 Oct 2026Evidence →
Medium, CVSS 4.014 Oct 2026
Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
crates.io rustls · Upgrade to 0.24.0-dev.2 (pre-release) or 0.23.46 by release line · < 0.23.46; >= 0.24.0-dev.1, < 0.24.0-dev.2 · CVE-2026-123609 · GHSA-c8m5-c952-6cm4 · amended
14 Oct 2026Evidence →
Low, CVSS 3.714 Oct 2026
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
crates.io rustls · Upgrade to 0.24.0-dev.2 (pre-release) or 0.23.46 by release line · < 0.23.46; >= 0.24.0-dev.1, < 0.24.0-dev.2 · CVE-2026-123610 · GHSA-h2v8-394m-p7vv · amended
14 Oct 2026Evidence →
Low, CVSS 2.114 Oct 2026
Exception tags can cause host data structures to be unaligned
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 47.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119133 · GHSA-p79w-pv2r-29qp · amended
14 Oct 2026Evidence →
Medium, CVSS 6.214 Oct 2026
Component-model handle tables are capped only per instance and charged to no limit
crates.io wasmtime · Upgrade to 49.0.3, 48.0.6 or 36.0.18 by release line · >= 0.0.0-0, < 36.0.18; >= 37.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119134 · GHSA-q554-3cjc-rx7p · amended
14 Oct 2026Evidence →
Medium, CVSS 5.914 Oct 2026
Panic when invoking an async-lifted function via call
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119139 · GHSA-m6w2-jwq2-cv2c · amended
14 Oct 2026Evidence →
Medium, CVSS 5.914 Oct 2026
Out-of-bounds zero-length stream writes can panic
crates.io wasmtime · Upgrade to 49.0.3 or 48.0.6 by release line · >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3 · CVE-2026-119143 · GHSA-93g3-36p8-x2gc · amended
14 Oct 2026Evidence →
High, CVSS 8.813 Oct 2026
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 10.0.0, <= 10.0.12; >= 8.0.0, <= 8.0.31; >= 9.0.0, <= 9.0.20; >= 11.0.0-preview.1, <= 11.0.0-rc.1 · CVE-2026-70035 · GHSA-4j9v-h7pp-725h · amended
13 Oct 2026Evidence →
High, CVSS 7.513 Oct 2026
Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +10 · Upgrade all 11 to 10.0.13, 9.0.21 or 8.0.32 by release line · >= 8.0.0, <= 8.0.31; >= 10.0.0, <= 10.0.12; >= 9.0.0, <= 9.0.20 · CVE-2026-70186 · GHSA-mf4x-w4gh-4656 · amended
13 Oct 2026Evidence →
High, CVSS 8.813 Oct 2026
Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 9.0.0, <= 9.0.20; >= 11.0.0-preview.1, <= 11.0.0-rc.1; >= 10.0.0, <= 10.0.12; >= 8.0.0, <= 8.0.31 · CVE-2026-70007 · GHSA-pfwj-2f93-rf42 · amended
13 Oct 2026Evidence →
High, CVSS 8.813 Oct 2026
Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 9.0.0, <= 9.0.20; >= 8.0.0, <= 8.0.31; >= 11.0.0-preview.1, <= 11.0.0-rc.1; >= 10.0.0, <= 10.0.12 · CVE-2026-87697 · GHSA-c27m-942f-rcfh · amended
13 Oct 2026Evidence →
High, CVSS 7.813 Oct 2026
Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability
NuGet microsoft.netcore.app.runtime.linux-musl-x64 +7 · Upgrade all 8 to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 8.0.0, <= 8.0.31; >= 10.0.0, <= 10.0.12; >= 11.0.0-preview.1, <= 11.0.0-rc.1; >= 9.0.0, <= 9.0.20 · CVE-2026-96225 · GHSA-w6wh-p4g7-mpj2 · amended
13 Oct 2026Evidence →
High, CVSS 8.813 Oct 2026
Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability
NuGet microsoft.aspnetcore.components.webassembly.server · Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 10.0.0, <= 10.0.12; >= 11.0.0-preview.1, <= 11.0.0-rc.1; >= 8.0.0, <= 8.0.31; >= 9.0.0, <= 9.0.20 · CVE-2026-96230 · GHSA-qjpx-jqm5-h2c4 · amended
13 Oct 2026Evidence →
High, CVSS 7.513 Oct 2026
Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.authentication.negotiate · Upgrade to 10.0.13, 9.0.21 or 8.0.32 by release line · >= 10.0.0, <= 10.0.12; >= 8.0.0, <= 8.0.31; >= 9.0.0, <= 9.0.20 · CVE-2026-70179 · GHSA-vrrp-6v32-2p8g · amended
13 Oct 2026Evidence →
High, CVSS 8.813 Oct 2026
Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 10.0.0, <= 10.0.12; >= 11.0.0-preview.1, <= 11.0.0-rc.1; >= 8.0.0, <= 8.0.31; >= 9.0.0, <= 9.0.20 · CVE-2026-96224 · GHSA-xq57-crx4-g373 · amended
13 Oct 2026Evidence →
High, CVSS 8.813 Oct 2026
Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 8.0.0, <= 8.0.31; >= 10.0.0, <= 10.0.12; >= 9.0.0, <= 9.0.20; >= 11.0.0-preview.1, <= 11.0.0-rc.1 · CVE-2026-85363 · GHSA-f63g-mx39-3r38 · amended
13 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Wasmtime may not properly enforce async-entrypoint requirement

Filesystem sandbox escape when renaming symlinks with trailing slashes

Overlapping string transcode in a fused adapter can panic

Panic viewing component model stream or future as the wrong type

Remote DoS through unchecked `IdList` allocation in negentropy

rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

Yielding in a component start function can lead to a host panic

Stack overflow dropping a long chain of recursive types

Guests can send absolute-form HTTP requests to different hosts

`wasi-http`: Request with long url before query parameter crashes host

Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Exception tags can cause host data structures to be unaligned

Component-model handle tables are capped only per instance and charged to no limit

Panic when invoking an async-lifted function via `call`

Out-of-bounds zero-length stream writes can panic

Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence